A company's cloud application is accessed by employees from the corporate office and by external partners from a known set of IP ranges. The security team wants to ensure that external partners can only access the application from those specific IP ranges. Which IAM policy approach should be used?

Use a VPN to connect partners to the corporate network and then allow all IPs

Create an IAM policy that denies access unless the source IP is in the partner's allowed ranges

Create a separate IAM role for partners and assign it a broad access policy

Allow all authenticated users and rely on the application to check IP addresses

A company wants to restrict access to its cloud management console so that only users connecting from the corporate office's public IP range can access it. Which IAM policy condition should be used?

Condition on the source IP address

Condition on the user's email domain

A cloud engineer needs to grant a data scientist temporary access to a machine learning dataset for a 3-day project. The data scientist is an external contractor and will use the cloud CLI. What is the most appropriate way to provide this access?

Create a long-lived access key and rotate it after the project

Issue temporary credentials with a 3-day expiration using the security token service

Add the contractor to the organization's admin group

Provide the contractor with a presigned URL for the dataset

A company has a legacy on-premises application that requires direct database access from a small team of external contractors. The contractors work from various client sites with dynamic IP addresses. The security team wants to minimize the attack surface while still allowing the contractors to reach the database. Which approach best meets these requirements?

Create a site-to-site VPN from each contractor's location to the corporate network.

Expose the database to the internet with a firewall rule allowing only the contractors' current IP addresses.

Set up a bastion host in a DMZ and require contractors to SSH into it before reaching the database.

Place the database on a public subnet and rely on the database's built-in authentication to restrict access.

GIAC Cloud Security Essentials

Domain 3Objective 1

External Access and IAM Best Practices GCLD Practice Questions (Page 4)

Part of the Identity, Access, and Secrets domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 4–6 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

6concepts

Questions 16–20

16application · medium
A company's cloud application is accessed by employees from the corporate office and by external partners from a known set of IP ranges. The security team wants to ensure that external partners can only access the application from those specific IP ranges. Which IAM policy approach should be used?
Select an answer first
17application · medium
A company wants to restrict access to its cloud management console so that only users connecting from the corporate office's public IP range can access it. Which IAM policy condition should be used?
Select an answer first
18application · medium
A cloud engineer needs to grant a data scientist temporary access to a machine learning dataset for a 3-day project. The data scientist is an external contractor and will use the cloud CLI. What is the most appropriate way to provide this access?
Select an answer first
19foundation · easy
Which cloud service is typically used to record and store API calls made by external users for auditing purposes?
Select an answer first
20application · medium
A company has a legacy on-premises application that requires direct database access from a small team of external contractors. The contractors work from various client sites with dynamic IP addresses. The security team wants to minimize the attack surface while still allowing the contractors to reach the database. Which approach best meets these requirements?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCLD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCLD” is a trademark of its owner, used for identification only.

External Access and IAM Best Practices GCLD Practice Questions (Page 4)

Questions 16–20

A company's cloud application is accessed by employees from the corporate office and by external partners from a known set of IP ranges. The security team wants to ensure that external partners can only access the application from those specific IP ranges. Which IAM policy approach should be used?

A company wants to restrict access to its cloud management console so that only users connecting from the corporate office's public IP range can access it. Which IAM policy condition should be used?

A cloud engineer needs to grant a data scientist temporary access to a machine learning dataset for a 3-day project. The data scientist is an external contractor and will use the cloud CLI. What is the most appropriate way to provide this access?

Which cloud service is typically used to record and store API calls made by external users for auditing purposes?

Keep studying — Identity, Access, and Secrets