A company is migrating a legacy application to the cloud and must grant external partners access to a shared database. The partners require write access to specific tables, but the application's service account currently has broad database permissions. The security team wants to enforce least privilege and ensure that any misuse is detected. Which approach best meets these requirements?

Allow the partners to use their own database credentials and rely on the database's built-in access controls.

Create a new service account with permissions limited to the required tables and enable detailed auditing on that account.

Grant the partners' service account broad database permissions and rely on database auditing to detect misuse.

Use temporary credentials for the partners and grant them full database access for the duration of the migration.

A company wants to allow its customers to access a partner portal using their social media accounts (e.g., Google or Facebook). The company does not want to manage customer credentials. Which federated identity approach should they use?

SAML 2.0 with a corporate identity provider.

Create a local account for each customer and require them to set a password.

Use a VPN for customers to access the portal.

OIDC with social identity providers as the external identity source.

GIAC Cloud Security Essentials

Domain 3Objective 1

External Access and IAM Best Practices GCLD Practice Questions (Page 8)

Part of the Identity, Access, and Secrets domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 4–6 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

6concepts

Questions 36–40

36foundation · easy
Which IAM practice is specifically intended to prevent a single external user from having both the ability to create a vendor invoice and approve that same invoice?
Select an answer first
37foundation · easy
An IAM policy includes a condition that denies access if the request does not originate from a specific IP address range. What type of contextual factor is this policy using?
Select an answer first
38foundation · easy
Which external access model is characterized by providing a single, hardened entry point that users connect to before reaching internal resources, and is often used to reduce the attack surface?
Select an answer first
39expert · hard
A company is migrating a legacy application to the cloud and must grant external partners access to a shared database. The partners require write access to specific tables, but the application's service account currently has broad database permissions. The security team wants to enforce least privilege and ensure that any misuse is detected. Which approach best meets these requirements?
Select an answer first
40application · medium
A company wants to allow its customers to access a partner portal using their social media accounts (e.g., Google or Facebook). The company does not want to manage customer credentials. Which federated identity approach should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCLD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCLD” is a trademark of its owner, used for identification only.

External Access and IAM Best Practices GCLD Practice Questions (Page 8)

Questions 36–40

Which IAM practice is specifically intended to prevent a single external user from having both the ability to create a vendor invoice and approve that same invoice?

An IAM policy includes a condition that denies access if the request does not originate from a specific IP address range. What type of contextual factor is this policy using?

Which external access model is characterized by providing a single, hardened entry point that users connect to before reaching internal resources, and is often used to reduce the attack surface?

A company wants to allow its customers to access a partner portal using their social media accounts (e.g., Google or Facebook). The company does not want to manage customer credentials. Which federated identity approach should they use?

Keep studying — Identity, Access, and Secrets