A company uses Azure AD and has a high turnover of contractors. The security team wants to ensure that when a contractor's employment ends, their access to Azure resources is removed automatically. Which approach should be used?

Manually delete the contractor's user account from Azure AD when the contract ends.

Use Azure AD Connect to sync the contractor's account from the HR system and disable the account in the HR system when the contract ends.

Create a conditional access policy that blocks sign-in for contractors after a certain date.

Set the contractor's account to expire after a fixed number of days.

A company uses Okta as its identity provider and wants employees to access AWS resources using their existing corporate credentials. The company requires that MFA be enforced for all AWS console access. What should the company configure?

Configure AWS IAM Identity Center with Okta as the external identity provider using SAML 2.0, and enforce MFA in Okta.

Create an IAM role that trusts Okta and map the Okta attribute 'MFAEnabled' to the role's condition.

Use AWS SSO with OIDC and require users to enter a TOTP code in both Okta and AWS.

Set up AWS IAM users with the same passwords as Okta and enable MFA on each IAM user.

What is the primary purpose of IAM monitoring and auditing in the cloud?

To detect unauthorized access and ensure compliance with security policies

To replace the need for identity lifecycle management

To encrypt all data stored in the cloud

To automatically grant more permissions to users who need them

A company uses Azure AD as its identity provider and wants to allow employees to access AWS resources. They have a requirement that MFA must be enforced, and they want to avoid maintaining separate AWS credentials. Additionally, they need to map Azure AD groups to AWS IAM roles for permissions. What should they configure?

Create IAM users in AWS with the same names as Azure AD users and sync passwords.

Use AWS STS to assume roles directly from Azure AD tokens without an identity provider.

Set up AWS IAM Identity Center with Azure AD as the external IdP using SAML, and configure attribute-based access control to map groups to roles.

Use OIDC federation with Azure AD and manually assign roles to each user.

What is the purpose of deprovisioning in identity lifecycle management?

To assign additional permissions to a user for a new project

To create new user accounts when employees join the organization

To remove or disable access rights when an employee leaves or changes roles

To reset a user's password when they forget it

GIAC Public Cloud Security

Domain 2Objective 2

Cloud Identity and Access Management GPCS Practice Questions (Page 10)

Part of the Cloud Platform and Service Security domain, which makes up ~60% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~30–48 in this domain), expect 6–10 from this objective — we provide 59 practice questions to prepare you well beyond it. (estimate)

59questions here

12free pages

12concepts

Questions 46–50

46application · medium
A company uses Azure AD and has a high turnover of contractors. The security team wants to ensure that when a contractor's employment ends, their access to Azure resources is removed automatically. Which approach should be used?
Select an answer first
47application · medium
A company uses Okta as its identity provider and wants employees to access AWS resources using their existing corporate credentials. The company requires that MFA be enforced for all AWS console access. What should the company configure?
Select an answer first
48foundation · easy
What is the primary purpose of IAM monitoring and auditing in the cloud?
Select an answer first
49expert · hard
A company uses Azure AD as its identity provider and wants to allow employees to access AWS resources. They have a requirement that MFA must be enforced, and they want to avoid maintaining separate AWS credentials. Additionally, they need to map Azure AD groups to AWS IAM roles for permissions. What should they configure?
Select an answer first
50foundation · easy
What is the purpose of deprovisioning in identity lifecycle management?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPCS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPCS” is a trademark of its owner, used for identification only.