A cloud engineer needs to allow a contractor to upload files to a cloud storage bucket for exactly one week. The contractor will use a script that requires access keys. What is the most secure way to provide this access?

Create a new IAM user with a long-lived access key and delete the user after one week

Share the root account's access key with the contractor

Use the security token service to issue temporary credentials with a one-week expiration

Generate a presigned URL that allows uploads for one week

Which service is specifically designed to issue temporary, limited-privilege credentials for external users to access cloud resources?

AWS Security Token Service (STS)

AWS Identity and Access Management (IAM) users

AWS Key Management Service (KMS)

A company wants to allow its employees to access a partner's cloud application using their corporate credentials. The partner's application supports SAML. What must the company configure to enable this?

A shared database of usernames and passwords

A SAML trust relationship between the company's identity provider and the partner's service provider

A VPN connection to the partner's network

A cloud security team is deciding how to provide external contractors with access to a management interface for a set of virtual machines. Which access model provides the least exposure of the management interface to the public internet?

Public IP address with a restrictive network security group

Direct internet-facing with a strong password

Jump host with a public IP and multi-factor authentication

VPN gateway that terminates remote users into the private network

What is the primary purpose of setting up an alert that triggers when an external user fails multiple authentication attempts?

To comply with data residency requirements

To detect potential unauthorized access attempts

To improve the user's authentication experience

To automatically revoke the user's access

GIAC Cloud Security Essentials

Domain 3Objective 1

External Access and IAM Best Practices GCLD Practice Questions (Page 6)

Part of the Identity, Access, and Secrets domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 4–6 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

6concepts

Questions 26–30

26application · medium
A cloud engineer needs to allow a contractor to upload files to a cloud storage bucket for exactly one week. The contractor will use a script that requires access keys. What is the most secure way to provide this access?
Select an answer first
27foundation · easy
Which service is specifically designed to issue temporary, limited-privilege credentials for external users to access cloud resources?
Select an answer first
28application · medium
A company wants to allow its employees to access a partner's cloud application using their corporate credentials. The partner's application supports SAML. What must the company configure to enable this?
Select an answer first
29foundation · easy
A cloud security team is deciding how to provide external contractors with access to a management interface for a set of virtual machines. Which access model provides the least exposure of the management interface to the public internet?
Select an answer first
30foundation · easy
What is the primary purpose of setting up an alert that triggers when an external user fails multiple authentication attempts?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCLD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCLD” is a trademark of its owner, used for identification only.