A security team is investigating a potential unauthorized access incident involving temporary credentials. The team needs to determine which external user used the credentials and what actions they performed. What is the most effective way to conduct this investigation?

Review the cloud provider's audit logs for API calls made with the temporary credentials

Check the user's browser history on their local machine

Ask the external user to explain what they did

Review the network firewall logs only

A security team wants to ensure that any use of temporary credentials by external users is recorded for audit purposes. What should the team enable?

A password policy that requires long passwords

A firewall rule that blocks all external traffic

Cloud audit logging for all API calls

Multi-factor authentication for all external users

A company has a small team of external contractors who need to access a single administrative web console hosted on a cloud VM. The team works from unpredictable home IP addresses. The security team wants to minimize the attack surface and avoid managing individual firewall rules. Which access model best meets these requirements?

Set up a site-to-site VPN from each contractor's home router

Expose the console directly to the internet and protect it with a strong password

Deploy a bastion host with jump access and enforce multi-factor authentication

Create a separate public IP and firewall rule for each contractor

A company has a cloud application that is accessed by employees from both the corporate office and remote locations. The security team wants to enforce a policy that allows access from the corporate office without MFA, but requires MFA for all remote access. The corporate office uses a static IP address. Which IAM policy configuration should be used?

Use a geolocation condition to allow access only from the corporate office's country.

Require MFA for all users and do not use IP conditions.

Create a VPN for all remote users and require MFA for VPN access.

Create two IAM policies: one allowing access from the corporate IP without MFA, and another requiring MFA for all other IPs.

A company wants to allow its partners to access a cloud-based document repository using their existing corporate credentials. The company does not want to create or manage user accounts for partner employees. Which approach should the company implement?

Create individual cloud accounts for each partner employee and distribute temporary passwords

Use a VPN that requires partner employees to use a company-issued smart card

Share a single set of cloud credentials with all partner employees

Configure SAML-based federation between the company's cloud identity provider and each partner's identity provider

GIAC Cloud Security Essentials

Domain 3Objective 1

External Access and IAM Best Practices GCLD Practice Questions (Page 7)

Part of the Identity, Access, and Secrets domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 4–6 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

6concepts

Questions 31–35

31expert · hard
A security team is investigating a potential unauthorized access incident involving temporary credentials. The team needs to determine which external user used the credentials and what actions they performed. What is the most effective way to conduct this investigation?
Select an answer first
32application · medium
A security team wants to ensure that any use of temporary credentials by external users is recorded for audit purposes. What should the team enable?
Select an answer first
33application · medium
A company has a small team of external contractors who need to access a single administrative web console hosted on a cloud VM. The team works from unpredictable home IP addresses. The security team wants to minimize the attack surface and avoid managing individual firewall rules. Which access model best meets these requirements?
Select an answer first
34expert · hard
A company has a cloud application that is accessed by employees from both the corporate office and remote locations. The security team wants to enforce a policy that allows access from the corporate office without MFA, but requires MFA for all remote access. The corporate office uses a static IP address. Which IAM policy configuration should be used?
Select an answer first
35application · medium
A company wants to allow its partners to access a cloud-based document repository using their existing corporate credentials. The company does not want to create or manage user accounts for partner employees. Which approach should the company implement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCLD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCLD” is a trademark of its owner, used for identification only.

External Access and IAM Best Practices GCLD Practice Questions (Page 7)

Questions 31–35

A security team is investigating a potential unauthorized access incident involving temporary credentials. The team needs to determine which external user used the credentials and what actions they performed. What is the most effective way to conduct this investigation?

A security team wants to ensure that any use of temporary credentials by external users is recorded for audit purposes. What should the team enable?

A company wants to allow its partners to access a cloud-based document repository using their existing corporate credentials. The company does not want to create or manage user accounts for partner employees. Which approach should the company implement?

Keep studying — Identity, Access, and Secrets