External Access and IAM Best Practices GCLD Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security analyst is reviewing cloud access logs and notices that a temporary credential issued to an external contractor is being used from an IP address that is not associated with the contractor's known location. What should the analyst do?

   • AImmediately revoke the temporary credential and block the IP address.
   • BContact the contractor to ask if they are using a VPN.
   • CIgnore the anomaly because temporary credentials are secure.
   • DInvestigate the log entry to determine if the access is legitimate or a sign of compromise.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A startup is building a public-facing web application and needs to allow external users to access it. The application is hosted in a cloud environment. The security team wants to minimize the risk of direct exposure of backend resources. Which access model should they choose?

   • AA bastion host for all external users to access the application.
   • BDirect internet-facing access to the application and backend resources.
   • CA VPN for all external users to access the application.
   • DA public-facing load balancer that routes traffic to the application, with backend resources in a private subnet.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company has a policy that external users can only access a cloud application from approved IP ranges. An external user reports that they are being denied access even though they are connecting from an approved IP. The security team suspects the user's traffic is being routed through a proxy. What should the team do to resolve this while maintaining the policy?

   • AAdd the proxy's IP range to the allowed list
   • BRemove the IP restriction and rely on multi-factor authentication
   • CCreate a new IAM role for the user with broader permissions
   • DAsk the user to disable the proxy and connect directly from the approved IP
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which IAM policy condition would be most effective in preventing access to a cloud resource from a country where the organization does not operate?

   • ARestricting access to a specific source IP range
   • BSetting a short session duration
   • CUsing a geolocation condition to deny access from that country
   • DRequiring multi-factor authentication
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company wants to allow its partners to access a cloud-based document repository using their own corporate credentials. The partners' IT team manages user accounts and group memberships. The company does not want to create or manage local accounts for partner users. Which solution should the company implement?

   • ASet up federated identity using SAML 2.0 between the company's cloud identity provider and the partners' identity provider.
   • BShare a common username and password with all partner users.
   • CCreate a local account for each partner user and assign them to a partner group.
   • DIssue temporary credentials to partner users that expire every 12 hours.
   Reveal Solution Discussion Select an answer first