A company's cloud environment has several permanent administrators with broad access. The security team wants to reduce the risk of compromised admin accounts by granting elevated permissions only when needed and for a limited time. Which approach should they implement?

Use Azure AD Privileged Identity Management (PIM) to provide just-in-time role activation with approval and time limits.

Remove all administrator roles and assign them only when a ticket is approved.

Assign administrators the Global Administrator role permanently but require MFA.

Create a single 'SuperAdmin' account shared by all administrators and rotate the password monthly.

In cloud IAM, what is the primary difference between a user identity and a service principal?

A user identity is created automatically, while a service principal must be manually provisioned.

A user identity can only be used within a single cloud region, while a service principal is global.

A user identity is used only for read-only access, while a service principal can have full administrative rights.

A user identity represents a human, while a service principal represents an application or automated workload.

In a cloud IAM policy, what is the effect of an explicit 'Deny' statement?

It is evaluated only if there is no matching 'Allow' statement.

It applies only to the principal who created the policy.

It is a recommendation that can be overridden by an 'Allow' statement.

It overrides any 'Allow' statement for the specified actions and resources.

A company uses GCP and wants to allow data scientists to access BigQuery datasets only if the dataset is tagged with 'DataClass=Public' and the user is in the 'data-science' group. Which IAM policy should be used?

An organization policy that denies access to all BigQuery datasets except those with the 'DataClass=Public' tag.

A VPC firewall rule that restricts access to BigQuery from the data science team's IP range.

A bucket policy that allows access to the 'data-science' group and requires the 'DataClass=Public' tag.

A custom role with permissions to access BigQuery, and a condition that checks the resource tag and the user's group membership.

GIAC Public Cloud Security

Domain 2Objective 2

Cloud Identity and Access Management GPCS Practice Questions (Page 2)

Part of the Cloud Platform and Service Security domain, which makes up ~60% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~30–48 in this domain), expect 6–10 from this objective — we provide 59 practice questions to prepare you well beyond it. (estimate)

59questions here

12free pages

12concepts

Questions 6–10

6foundation · easy
Which authentication mechanism allows a user to authenticate once and then access multiple cloud applications without re-entering credentials?
Select an answer first
7application · medium
A company's cloud environment has several permanent administrators with broad access. The security team wants to reduce the risk of compromised admin accounts by granting elevated permissions only when needed and for a limited time. Which approach should they implement?
Select an answer first
8foundation · easy
In cloud IAM, what is the primary difference between a user identity and a service principal?
Select an answer first
9foundation · easy
In a cloud IAM policy, what is the effect of an explicit 'Deny' statement?
Select an answer first
10application · medium
A company uses GCP and wants to allow data scientists to access BigQuery datasets only if the dataset is tagged with 'DataClass=Public' and the user is in the 'data-science' group. Which IAM policy should be used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPCS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPCS” is a trademark of its owner, used for identification only.