A security analyst is performing a benchmark assessment of their Google Cloud Platform (GCP) environment using the CIS Google Cloud Computing Platform Benchmark. They find that several VMs have public IP addresses. What should the analyst do to assess the risk?

Remove the public IP addresses from all VMs immediately.

Enable VPC Flow Logs to monitor traffic.

Create a new VPC and move the VMs to it.

Check if the VMs have firewall rules that allow inbound traffic from the internet.

An organization is integrating a cloud-based identity provider (IdP) with an on-premises application using SAML. They want to ensure that the integration is secure and that access is properly controlled. Which combination of controls is most effective?

Use short-lived SAML assertions, enforce MFA, and regularly rotate signing certificates.

Use long-lived SAML assertions to reduce user friction.

Disable MFA to simplify the user experience.

Use a shared static signing key for simplicity.

A company uses AWS and Azure and wants to connect their VPC and VNet over a private, encrypted connection. Which approach is most appropriate for this multi-cloud connectivity?

Use AWS Direct Connect to connect directly to the Azure VNet

Establish a VPN tunnel between a VPN gateway in AWS and a VPN gateway in Azure

Use Azure Bastion to connect from AWS to Azure

Use Azure ExpressRoute to connect directly to the AWS VPC

A company is integrating a multi-cloud environment with workloads in AWS and Azure. They need to ensure that data flows between the two clouds are encrypted and that access is controlled. Which approach should they use?

Set up a direct connection using a third-party network provider.

Establish a VPN connection between the two cloud VNets/VPCs and use identity-based access controls.

Use cloud provider native peering services.

Use public internet with TLS for all data transfers.

GIAC Public Cloud Security

Domain 3Objective 1

Cloud Integration and Benchmarking GPCS Practice Questions (Page 6)

Part of the Network and Compliance Security domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 5–8 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

6concepts

Questions 26–30

26application · medium
A security analyst is performing a benchmark assessment of their Google Cloud Platform (GCP) environment using the CIS Google Cloud Computing Platform Benchmark. They find that several VMs have public IP addresses. What should the analyst do to assess the risk?
Select an answer first
27expert · hard
An organization is integrating a cloud-based identity provider (IdP) with an on-premises application using SAML. They want to ensure that the integration is secure and that access is properly controlled. Which combination of controls is most effective?
Select an answer first
28foundation · easy
A company uses AWS and Azure and wants to connect their VPC and VNet over a private, encrypted connection. Which approach is most appropriate for this multi-cloud connectivity?
Select an answer first
29foundation · easy
An e-commerce company processes credit card payments and stores cardholder data in a cloud environment. Which compliance framework is specifically designed for organizations that handle cardholder data?
Select an answer first
30application · medium
A company is integrating a multi-cloud environment with workloads in AWS and Azure. They need to ensure that data flows between the two clouds are encrypted and that access is controlled. Which approach should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPCS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPCS” is a trademark of its owner, used for identification only.