A company is using an API gateway to expose internal microservices to external partners. What security control is essential to protect this integration point?

Allow all traffic from the internet to the API gateway.

Use a shared API key for all partners to simplify management.

Disable rate limiting to avoid impacting partner performance.

Implement OAuth 2.0 with scopes to control access to specific API endpoints.

A company is integrating a cloud-based CRM with their on-premises ERP system using a middleware API. The security team wants to ensure that the API calls are authenticated and authorized. Which control should they implement?

Use OAuth 2.0 with client credentials for service-to-service authentication.

Use basic authentication with a shared username and password.

Use IP allowlisting to restrict API access to known IP addresses.

Use API keys embedded in the API requests.

A benchmark assessment of a cloud environment reveals that several VMs have unencrypted disks. The organization must remediate this finding. What is the most appropriate first step?

Enable encryption on the existing VMs using the cloud provider's disk encryption feature.

Document the finding and accept the risk.

Move the data to a different storage account that has encryption enabled.

Delete the VMs and recreate them with encryption enabled.

When developing a remediation plan for benchmark findings, which factor should be prioritized to ensure the plan is effective?

Personal preference of the security team

Ease of implementation regardless of risk

GIAC Public Cloud Security

Domain 3Objective 1

Cloud Integration and Benchmarking GPCS Practice Questions (Page 2)

Part of the Network and Compliance Security domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 5–8 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

6concepts

Questions 6–10

6application · medium
A company is using an API gateway to expose internal microservices to external partners. What security control is essential to protect this integration point?
Select an answer first
7application · medium
A company is integrating a cloud-based CRM with their on-premises ERP system using a middleware API. The security team wants to ensure that the API calls are authenticated and authorized. Which control should they implement?
Select an answer first
8foundation · easy
A healthcare organization stores protected health information (PHI) in a public cloud. Which regulatory framework specifically requires safeguards for PHI and applies to covered entities and their business associates?
Select an answer first
9application · medium
A benchmark assessment of a cloud environment reveals that several VMs have unencrypted disks. The organization must remediate this finding. What is the most appropriate first step?
Select an answer first
10foundation · easy
When developing a remediation plan for benchmark findings, which factor should be prioritized to ensure the plan is effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPCS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPCS” is a trademark of its owner, used for identification only.