Cloud Identity and Access Management GPCS Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A company uses Google Cloud and wants to allow its employees to sign in to GCP using their existing corporate Active Directory credentials. The company has a hybrid setup with Active Directory Federation Services (AD FS). Which configuration should be used?

   • AConfigure GCP as a SAML service provider and AD FS as the identity provider.
   • BUse OIDC with Google as the identity provider and AD FS as the service provider.
   • CCreate a Google Cloud directory and sync users from Active Directory using Google Cloud Directory Sync.
   • DSet up a VPN between the corporate network and GCP and use RADIUS authentication.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company uses Azure AD and has enabled Azure AD Privileged Identity Management (PIM) for its Global Administrators. The security team wants to ensure that any activation of the Global Administrator role is immediately visible to the security operations center (SOC). Which configuration should be used?

   • ARequire the SOC team to manually review the PIM activation history each day.
   • BStream Azure AD audit logs to Azure Sentinel and create an alert for role activation events.
   • CDisable PIM and use permanent Global Administrator assignments to simplify monitoring.
   • DConfigure PIM to send email notifications to the SOC team whenever a role is activated.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company uses AWS and has an S3 bucket that contains sensitive data. The security team wants to ensure that only a specific IAM role can access the bucket, and that the role can only be assumed by users from the company's identity provider. Which policy configuration should be used?

   • ACreate a new IAM user for each user from the identity provider and attach a policy to each user.
   • BUse a resource-based policy on the S3 bucket that allows access to the identity provider's users directly.
   • CAttach a bucket policy that allows access only to the specific IAM role.
   • DAttach an IAM policy to the role that allows s3:GetObject on the bucket, and configure the role's trust policy to allow only the identity provider to assume the role.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which standard is commonly used for federated identity and supports exchanging authentication and authorization data between an identity provider and a service provider?

   • ARADIUS
   • BKerberos
   • CLDAP
   • DSAML 2.0
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A company uses AWS and has a large number of IAM roles and users. The security team wants to conduct periodic access reviews to ensure that users have only the permissions they need. Which approach is most effective?

   • AUse AWS Identity and Access Management Access Analyzer to generate findings for unused permissions and review them quarterly.
   • BUse AWS Config rules to automatically remove any IAM user that has not signed in for 90 days.
   • CManually review each IAM policy and user assignment on an annual basis.
   • DCreate a new IAM role for each user and attach policies based on their job function.
   Reveal Solution Discussion Select an answer first