A company has a policy that all cloud access must be reviewed quarterly. They also want to automate the removal of access for employees who have not used their access in 90 days. What should they implement?

Use Azure AD access reviews to recertify access quarterly and configure automatic removal of unused access.

Manually review access logs every quarter and disable accounts that appear unused.

Set all user accounts to expire after 90 days and require reactivation.

Use conditional access to block sign-ins after 90 days of inactivity.

A company uses AWS and wants to enforce MFA for all IAM users who access the AWS Management Console. Which configuration should be used?

Configure a password policy that requires MFA.

Use AWS Organizations to require MFA for all accounts.

Create an IAM policy that denies all actions unless the user has authenticated with MFA, and attach it to all users.

Enable MFA on the root account only.

A company uses Azure AD and has a policy that requires all user accounts to be reviewed quarterly. The security team wants to automate the review process as much as possible. Which feature should be used?

Azure AD conditional access policies

A company wants to implement separation of duties in their cloud environment. They want to ensure that the person who creates a storage account cannot also grant access to it. Which approach should they use?

Use Azure Policy to deny storage account creation.

Use a service principal for creating storage accounts and a user account for granting access.

Use two different roles: one for creating storage accounts and another for managing access permissions, and ensure no user holds both roles.

Use a single role that includes both create and grant permissions but require MFA.

GIAC Public Cloud Security

Domain 2Objective 2

Cloud Identity and Access Management GPCS Practice Questions (Page 6)

Part of the Cloud Platform and Service Security domain, which makes up ~60% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~30–48 in this domain), expect 6–10 from this objective — we provide 59 practice questions to prepare you well beyond it. (estimate)

59questions here

12free pages

12concepts

Questions 26–30

26expert · hard
A company has a policy that all cloud access must be reviewed quarterly. They also want to automate the removal of access for employees who have not used their access in 90 days. What should they implement?
Select an answer first
27foundation · easy
Which cloud IAM best practice requires that no single individual should have the ability to both create a user and approve that user's access?
Select an answer first
28application · medium
A company uses AWS and wants to enforce MFA for all IAM users who access the AWS Management Console. Which configuration should be used?
Select an answer first
29expert · hard
A company uses Azure AD and has a policy that requires all user accounts to be reviewed quarterly. The security team wants to automate the review process as much as possible. Which feature should be used?
Select an answer first
30expert · hard
A company wants to implement separation of duties in their cloud environment. They want to ensure that the person who creates a storage account cannot also grant access to it. Which approach should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPCS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPCS” is a trademark of its owner, used for identification only.