Multicloud and Credential Management Fundamentals GPCS Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is a common challenge when adopting a multicloud strategy?

   • ASingle vendor lock-in
   • BReduced need for security policies
   • CSimplified identity management
   • DIncreased operational complexity
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   A security architect is evaluating a strategy that uses AWS for compute, Azure for identity, and Google Cloud for data analytics. Which term best describes this approach?

   • AMulticloud
   • BCommunity cloud
   • CHybrid cloud
   • DFederated cloud
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A financial services company is migrating to a multicloud environment. The compliance team requires that all service account credentials be inventoried, have an assigned owner, and be reviewed quarterly. Which control is most directly aligned with the credential lifecycle stage of 'monitoring and review'?

   • AConfigure automated expiration dates on all service account keys so they cannot be used after a defined period.
   • BImplement a break-glass procedure that allows emergency access to critical systems if a service account fails.
   • CRequire all service account keys to be stored in a hardware security module (HSM) rather than in software.
   • DDeploy a cloud security posture management (CSPM) tool that continuously discovers service accounts and flags those without an owner or with unused permissions.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company runs workloads in AWS and Azure. The security team wants to implement a single sign-on (SSO) solution that allows users to access both clouds with their corporate credentials. The company uses Okta as its identity provider. Which approach is most appropriate?

   • AUse AWS IAM Identity Center as the primary identity source and configure Azure AD to trust AWS IAM Identity Center.
   • BUse Azure AD as the primary identity source and configure AWS IAM to trust Azure AD via SAML, but do not configure Okta.
   • CConfigure Okta as a SAML identity provider for both AWS IAM Identity Center and Azure AD, and map Okta groups to cloud roles.
   • DCreate separate user accounts in AWS IAM and Azure AD, and synchronize passwords from Okta using a password sync tool.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A DevOps team uses service accounts in AWS, Azure, and Google Cloud to allow a CI/CD pipeline to deploy infrastructure. The team currently stores the service account keys in a shared Git repository. The security team mandates that secrets must be stored in a dedicated secrets manager and rotated automatically. Which solution meets the mandate with the least operational burden?

   • ACreate a single cross-cloud service account with permissions in all three clouds, and store its key in a HashiCorp Vault instance running on-premises.
   • BEncrypt the service account keys with a PGP key and commit the encrypted files to Git, then decrypt them in the pipeline using a passphrase stored in the CI/CD tool's variables.
   • CStore all service account keys in a single cloud provider's secrets manager, and use that provider's SDK in the pipeline to retrieve secrets at deployment time.
   • DUse each cloud provider's native secrets manager (AWS Secrets Manager, Azure Key Vault, Google Secret Manager) and configure the CI/CD tool to fetch secrets from each during pipeline execution.
   Reveal Solution Discussion Select an answer first