A company wants to allow its employees to use their existing corporate credentials to access a third-party SaaS application. The company also wants to enforce MFA. Which authentication mechanism should they use?

SAML-based federation with the corporate identity provider.

OpenID Connect (OIDC) with the SaaS application as the identity provider.

OAuth 2.0 with client credentials.

Basic authentication with a shared username and password.

An organization uses Azure and wants to allow developers to access only those storage accounts tagged with 'Environment=Dev'. Developers should not access production storage. The company also requires that access be automatically denied if a developer's employment status is 'Terminated' in the HR system. Which approach best meets these requirements?

Assign developers the Storage Blob Data Reader role at the subscription level.

Use a service principal for each developer and assign it to dev storage accounts.

Use Azure RBAC with a condition that checks the storage account tag and the user's employment status attribute.

Create a role assignment for each developer on each dev storage account.

A company has a policy that no user should have permanent write access to production databases. However, database administrators (DBAs) need temporary write access during maintenance windows. The company also requires that all access be logged and that a second person approves each access request. Which solution best meets these requirements?

Use a service principal with write access and give the password to DBAs.

Create a shared admin account for DBAs to use during maintenance windows.

Use Azure AD PIM to make DBAs eligible for a custom role that allows write access, with activation requiring approval and a time limit.

Assign DBAs the Contributor role on the production database permanently and rely on auditing.

A company uses GCP and has a microservices application running on Google Kubernetes Engine (GKE). The application needs to access Google Cloud Storage (GCS) buckets. Which identity should be used for the application to authenticate to GCS?

A Google service account associated with the GKE nodes.

An API key with storage permissions.

A user account with a service account key.

A Google group with storage permissions.

Why is regular auditing of IAM policies and permissions considered a best practice?

It eliminates the need for multi-factor authentication.

It automatically increases the security of all passwords.

It helps identify and remove excessive or unused permissions.

It ensures that all users have the same level of access.

GIAC Public Cloud Security

Domain 2Objective 2

Cloud Identity and Access Management GPCS Practice Questions (Page 9)

Part of the Cloud Platform and Service Security domain, which makes up ~60% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~30–48 in this domain), expect 6–10 from this objective — we provide 59 practice questions to prepare you well beyond it. (estimate)

59questions here

12free pages

12concepts

Questions 41–45

41application · medium
A company wants to allow its employees to use their existing corporate credentials to access a third-party SaaS application. The company also wants to enforce MFA. Which authentication mechanism should they use?
Select an answer first
42application · medium
An organization uses Azure and wants to allow developers to access only those storage accounts tagged with 'Environment=Dev'. Developers should not access production storage. The company also requires that access be automatically denied if a developer's employment status is 'Terminated' in the HR system. Which approach best meets these requirements?
Select an answer first
43expert · hard
A company has a policy that no user should have permanent write access to production databases. However, database administrators (DBAs) need temporary write access during maintenance windows. The company also requires that all access be logged and that a second person approves each access request. Which solution best meets these requirements?
Select an answer first
44application · medium
A company uses GCP and has a microservices application running on Google Kubernetes Engine (GKE). The application needs to access Google Cloud Storage (GCS) buckets. Which identity should be used for the application to authenticate to GCS?
Select an answer first
45foundation · easy
Why is regular auditing of IAM policies and permissions considered a best practice?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPCS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPCS” is a trademark of its owner, used for identification only.

Cloud Identity and Access Management GPCS Practice Questions (Page 9)

Questions 41–45

A company wants to allow its employees to use their existing corporate credentials to access a third-party SaaS application. The company also wants to enforce MFA. Which authentication mechanism should they use?

A company uses GCP and has a microservices application running on Google Kubernetes Engine (GKE). The application needs to access Google Cloud Storage (GCS) buckets. Which identity should be used for the application to authenticate to GCS?

Why is regular auditing of IAM policies and permissions considered a best practice?

Keep studying — Cloud Platform and Service Security