Multicloud and Credential Management Fundamentals GPCS Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company uses a multicloud environment with AWS and Google Cloud. The security team discovers that a service account key in AWS has been exposed in a public GitHub repository. The key has permissions to read from an S3 bucket. What is the FIRST action the team should take?

   • ADelete the S3 bucket and recreate it with a new name to prevent further access.
   • BContact the cloud provider to have the key disabled, then create a new key and update the application.
   • CChange the bucket policy to deny all access from the exposed key, then wait for the key to expire.
   • DRotate the exposed AWS access key immediately and then review CloudTrail logs for unauthorized use.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security architect is designing a credential management solution for a multicloud environment that must meet a compliance requirement for least privilege. The solution must also minimize the risk of credential leakage in CI/CD pipelines. Which design best meets both requirements?

   • AUse a single service account with broad permissions across all clouds and store its key in a vault.
   • BUse short-lived tokens generated by a federated identity provider and inject them into the pipeline at runtime.
   • CStore long-lived service account keys in the pipeline's environment variables and rotate them monthly.
   • DEmbed the credentials in the pipeline's source code and rely on repository access controls.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company runs production workloads in AWS and Azure. The security team wants to enforce a consistent password policy and multi-factor authentication (MFA) for all human users who access the AWS and Azure management consoles. The company already uses Microsoft Entra ID (Azure AD) as its corporate identity provider. Which approach satisfies the requirement with the least administrative overhead?

   • AUse AWS SSO (now IAM Identity Center) with its built-in identity store and configure MFA directly in AWS, leaving Azure AD users unchanged.
   • BCreate separate IAM users in AWS and separate users in Entra ID, then configure the same password policy and MFA requirements manually in both systems.
   • CConfigure AWS IAM to trust Microsoft Entra ID as an external identity provider via SAML 2.0 federation, and enforce MFA and password policies in Entra ID.
   • DSet up a VPN between the corporate network and both clouds, and require all console access to originate from the corporate network where MFA is enforced by network access control.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which principle is most important when assigning credentials to applications or users in a cloud environment?

   • AGrant the broadest permissions to avoid access issues
   • BGrant the minimum permissions necessary for the task
   • CStore credentials in plain text in configuration files for simplicity
   • DUse permanent credentials for all services to reduce overhead
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company uses AWS for compute and Azure for identity services. The security team wants to reduce the number of static credentials that developers handle while maintaining separate audit trails in each cloud. Which approach best aligns with multicloud credential management best practices?

   • AStore all cloud credentials in a single vault and grant every developer access to the vault.
   • BImplement federation between the corporate identity provider and both clouds, using short-lived tokens for API access.
   • CUse the AWS identity provider to authenticate to Azure and eliminate the need for Azure credentials.
   • DCreate a single service account in each cloud and share the credentials with all developers via a shared vault.
   Reveal Solution Discussion Select an answer first