An organization wants to allow access to a cloud storage bucket only if the requester's IP address is within the corporate network AND the resource has a tag 'DataClassification=Confidential'. They also want to deny access if the requester is accessing from a device that is not compliant with security policies. Which approach should they use?

Create separate buckets for confidential data and assign permissions based on user groups.

Use a service account with a static IP and allow access only from that IP.

Use IAM policies with conditions on IP address and resource tags, and integrate with device compliance signals.

Use a VPN and manually manage a list of allowed IPs.

A company has a team of cloud administrators who occasionally need to perform emergency changes in production. The security team wants to ensure that these administrators use a secure, dedicated workstation and that their actions are recorded. Which solution should be implemented?

Provide the administrators with a shared workstation that is not connected to the internet.

Allow the administrators to use their personal laptops with VPN and require them to log their actions manually.

Use a privileged access management (PAM) solution that rotates passwords and records sessions, but allow access from any device.

Require the administrators to use a jump server with multi-factor authentication and enable session recording.

A company wants to allow an external auditor to view compliance reports in their AWS environment without giving them access to any other resources. What should they create?

A service principal with access to the reports.

An IAM user with a password and access key for the auditor.

A shared access signature (SAS) token for the S3 bucket.

An IAM role with a trust policy that allows the auditor's AWS account to assume it, and a permissions policy that grants read-only access to specific S3 buckets containing reports.

GIAC Public Cloud Security

Domain 2Objective 2

Cloud Identity and Access Management GPCS Practice Questions (Page 4)

Part of the Cloud Platform and Service Security domain, which makes up ~60% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~30–48 in this domain), expect 6–10 from this objective — we provide 59 practice questions to prepare you well beyond it. (estimate)

59questions here

12free pages

12concepts

Questions 16–20

16expert · hard
An organization wants to allow access to a cloud storage bucket only if the requester's IP address is within the corporate network AND the resource has a tag 'DataClassification=Confidential'. They also want to deny access if the requester is accessing from a device that is not compliant with security policies. Which approach should they use?
Select an answer first
17expert · hard
A company has a team of cloud administrators who occasionally need to perform emergency changes in production. The security team wants to ensure that these administrators use a secure, dedicated workstation and that their actions are recorded. Which solution should be implemented?
Select an answer first
18application · medium
A company uses Google Cloud Platform (GCP) and has a team of network engineers who need to manage firewall rules and Cloud VPN tunnels. They should not have access to compute instances or storage. Which IAM role should be assigned to the team?
Select an answer first
19application · medium
A company wants to allow an external auditor to view compliance reports in their AWS environment without giving them access to any other resources. What should they create?
Select an answer first
20foundation · easy
Which type of log is most directly used to audit IAM activities such as user logins and permission changes?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPCS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPCS” is a trademark of its owner, used for identification only.

Cloud Identity and Access Management GPCS Practice Questions (Page 4)

Questions 16–20

A company has a team of cloud administrators who occasionally need to perform emergency changes in production. The security team wants to ensure that these administrators use a secure, dedicated workstation and that their actions are recorded. Which solution should be implemented?

A company uses Google Cloud Platform (GCP) and has a team of network engineers who need to manage firewall rules and Cloud VPN tunnels. They should not have access to compute instances or storage. Which IAM role should be assigned to the team?

A company wants to allow an external auditor to view compliance reports in their AWS environment without giving them access to any other resources. What should they create?

Which type of log is most directly used to audit IAM activities such as user logins and permission changes?

Keep studying — Cloud Platform and Service Security