Which statement best describes the relationship between authentication and authorization in cloud IAM?

Authentication determines what a user can do; authorization verifies the user's identity.

Authentication and authorization are interchangeable terms for the same process.

Authorization is performed before authentication to ensure only valid users are authenticated.

Authentication verifies identity; authorization determines what actions the authenticated identity can perform.

What is the primary goal of just-in-time (JIT) access in privileged access management?

To provide permanent administrative access to all users.

To grant privileged access only for the duration needed to perform a task, then automatically revoke it.

To eliminate the need for monitoring privileged accounts.

To allow users to bypass multi-factor authentication for privileged tasks.

A company wants to allow its employees to use their existing Microsoft 365 credentials to sign in to a third-party SaaS application that supports SAML 2.0. The company uses Azure AD. Which configuration should be used?

Use OAuth 2.0 with the authorization code flow and no SAML.

Create a user account in the SaaS application for each employee and sync passwords from Azure AD.

Add the SaaS application as an enterprise application in Azure AD and configure SAML-based single sign-on.

Configure the SaaS application as the identity provider and Azure AD as the service provider.

A security team wants to ensure that privileged actions in AWS are performed from a dedicated, hardened workstation. They also want to require temporary credentials for these actions. Which combination of services should they use?

AWS IAM users with long-term access keys and a VPN.

AWS CloudTrail to log privileged actions and review them monthly.

AWS IAM roles with temporary credentials via STS, and enforce that these roles can only be assumed from a specific IP range (the hardened workstations).

AWS Organizations SCPs to deny all privileged actions.

GIAC Public Cloud Security

Domain 2Objective 2

Cloud Identity and Access Management GPCS Practice Questions (Page 7)

Part of the Cloud Platform and Service Security domain, which makes up ~60% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~30–48 in this domain), expect 6–10 from this objective — we provide 59 practice questions to prepare you well beyond it. (estimate)

59questions here

12free pages

12concepts

Questions 31–35

31foundation · easy
Which statement best describes the relationship between authentication and authorization in cloud IAM?
Select an answer first
32foundation · easy
What is the primary goal of just-in-time (JIT) access in privileged access management?
Select an answer first
33application · medium
A company has a team of network engineers who need to manage virtual networks and network security groups in Azure, but they should not be able to create or delete virtual machines. Which built-in role should be assigned to the team?
Select an answer first
34application · medium
A company wants to allow its employees to use their existing Microsoft 365 credentials to sign in to a third-party SaaS application that supports SAML 2.0. The company uses Azure AD. Which configuration should be used?
Select an answer first
35expert · hard
A security team wants to ensure that privileged actions in AWS are performed from a dedicated, hardened workstation. They also want to require temporary credentials for these actions. Which combination of services should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPCS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPCS” is a trademark of its owner, used for identification only.