Which governance practice is essential for credential management across multiple cloud providers?

Establishing a consistent policy for credential creation, rotation, and revocation

Using provider-specific policies that do not align with corporate standards

Allowing each team to manage credentials independently without oversight

Storing credentials in each provider's native secret service without central monitoring

A company uses AWS and Azure. The security team discovers that a service account in AWS has permissions to list all S3 buckets, but it only needs to access one specific bucket. The team wants to remediate this issue. Which action is most appropriate?

Delete the service account and create a new one with the same permissions.

Use a different service account that already has the correct permissions.

Modify the IAM policy attached to the service account to restrict access to the specific bucket only.

Change the S3 bucket policy to deny access from the service account.

A company uses a centralized secrets manager for AWS and Azure. The security team discovers that a developer's laptop was compromised and the developer had access to the secrets manager. Which immediate action best limits the exposure?

Rotate only the most critical credentials and monitor for unusual activity.

Revoke the developer's access to the secrets manager and rotate all credentials the developer could access.

Change the developer's password and require multi-factor authentication on the next login.

Disable the developer's cloud user accounts but leave the secrets manager access intact.

What is a key consideration when rotating credentials across multiple cloud providers?

Ensure applications can update to the new credential without manual intervention

Rotate all credentials at the same time to ensure consistency

Rotate credentials only when a breach is suspected

Use the same rotation schedule for all providers regardless of their capabilities

A company is evaluating a multicloud strategy. The CISO is concerned about the complexity of managing credentials across multiple clouds. Which approach best addresses this concern?

Use the same password for all cloud accounts to simplify management.

Implement a centralized identity and access management (IAM) solution that federates with all cloud providers.

Use separate credentials for each cloud and store them in a spreadsheet for easy reference.

Use a single cloud provider for all workloads to avoid credential management complexity.

GIAC Public Cloud Security

Domain 1Objective 1

Multicloud and Credential Management Fundamentals GPCS Practice Questions (Page 3)

Part of the Cloud Security Fundamentals domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–17 in this domain), expect 6–9 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

5concepts

Questions 11–15

11foundation · easy
Which governance practice is essential for credential management across multiple cloud providers?
Select an answer first
12expert · hard
A company uses AWS and Azure. The security team discovers that a service account in AWS has permissions to list all S3 buckets, but it only needs to access one specific bucket. The team wants to remediate this issue. Which action is most appropriate?
Select an answer first
13expert · hard
A company uses a centralized secrets manager for AWS and Azure. The security team discovers that a developer's laptop was compromised and the developer had access to the secrets manager. Which immediate action best limits the exposure?
Select an answer first
14foundation · easy
What is a key consideration when rotating credentials across multiple cloud providers?
Select an answer first
15expert · hard
A company is evaluating a multicloud strategy. The CISO is concerned about the complexity of managing credentials across multiple clouds. Which approach best addresses this concern?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPCS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPCS” is a trademark of its owner, used for identification only.