Cloud Identity and Access Management GPCS Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A company uses AWS Organizations and has multiple S3 buckets. The security team wants to allow developers to access only the S3 buckets that are tagged with 'Environment=Dev'. The developers' IAM role already has a policy that allows s3:GetObject on all buckets. Which additional policy should be attached to the role to enforce this restriction?

   • AA service control policy (SCP) that denies access to buckets without the 'Environment=Dev' tag.
   • BA bucket policy on each dev bucket that allows access only to the developers' role.
   • CAn IAM policy with a condition that requires the resource tag 'Environment' to equal 'Dev'.
   • DAn S3 access point with a policy that allows access only to the dev buckets.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A large enterprise uses Azure Active Directory (Azure AD) and has a high turnover rate. The security team is concerned about former employees retaining access to cloud resources. They want to automate the removal of access when an employee leaves and also ensure that access rights are reviewed periodically. What should they implement?

   • AUse conditional access policies to block sign-ins from terminated employees based on their department attribute.
   • BSet all user accounts to expire after 90 days and require users to request reactivation.
   • CManually disable user accounts in Azure AD when HR notifies IT, and perform quarterly access reviews.
   • DIntegrate Azure AD with the HR system to automatically disable accounts on termination, and configure Azure AD access reviews.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A company wants to detect when a user in Azure AD is assigned the Global Administrator role. They also want to be alerted if a Global Administrator signs in from an unusual location. What should they configure?

   • AUse Azure Security Center to monitor all Azure AD activities.
   • BUse Azure Policy to deny Global Administrator role assignments.
   • CUse Azure AD Privileged Identity Management (PIM) to monitor role assignments and sign-ins.
   • DUse Azure AD audit logs and sign-in logs with Azure Monitor to create alerts on role assignments and anomalous sign-ins.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A company uses AWS and wants to ensure that an S3 bucket is accessible only from the company's VPC. Which policy should be used?

   • AAn IAM policy that allows s3:GetObject only when the request comes from the VPC's IP range.
   • BA security group rule that allows access to S3 only from the VPC.
   • CAn AWS WAF rule that blocks requests from outside the VPC.
   • DA bucket policy that denies access unless the request originates from a VPC endpoint.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A security administrator needs to detect when a user is assigned a privileged role in AWS. They want to receive alerts in real time and maintain an audit trail. What should they configure?

   • AEnable AWS Trusted Advisor to report on IAM role usage.
   • BUse AWS IAM Access Analyzer to detect external access and send alerts.
   • CUse AWS Config to monitor IAM role assignments and send alerts via SNS.
   • DEnable AWS CloudTrail and create a CloudWatch Events rule to trigger an alert on IAM role assignment events.
   Reveal Solution Discussion Select an answer first