A cloud team is designing permissions for a new application. The application needs to read from a database, write to a storage bucket, and send messages to a queue. The team wants to follow least privilege while minimizing the number of roles to manage. Which approach is best?

Assign permissions directly to each service account without roles.

Use the cloud provider's built-in administrator role for the application.

Create one role per application component with only the permissions that component needs.

Create a single role with all three permissions and assign it to every component.

A company wants to allow its employees to use their existing corporate credentials to access a cloud application without creating separate cloud accounts. The company also wants to enforce MFA for all access. Which authentication mechanism should the company implement?

Use API keys for each employee and require MFA on the API keys.

Federated identity with the corporate IdP and configure MFA at the IdP.

Create local cloud users with the same passwords as corporate credentials.

Use the cloud provider's built-in user directory and enable MFA.

A user reports that when they access the cloud console, the browser shows a certificate warning. The user proceeds anyway. What is the most likely risk?

The cloud provider will be notified of the warning.

The user's password will be automatically changed.

The cloud service will stop functioning after the warning.

An attacker could intercept or modify the traffic between the user and the cloud service.

Which protocol is commonly used to encrypt communication between a client and a cloud service over the internet?

SNMP (Simple Network Management Protocol)

HTTP (Hypertext Transfer Protocol)

A startup uses a single cloud provider. The lead developer creates a service account with full admin permissions and embeds its long-lived access key in a public GitHub repository to allow CI/CD builds to deploy infrastructure. After a security review, the team must reduce risk without disrupting the CI/CD pipeline. Which action best addresses the immediate exposure?

Change the repository visibility to private and leave the key in place.

Delete the service account and create a new one with the same permissions, then update the pipeline.

Rotate the service account key and store the new key in the CI/CD system's secret vault.

Disable the service account and switch the pipeline to use the developer's personal credentials.

GIAC Public Cloud Security

Domain 1Objective 2

Securely Accessing Cloud Services GPCS Practice Questions (Page 2)

Part of the Cloud Security Fundamentals domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–17 in this domain), expect 6–9 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

6concepts

Questions 6–10

6expert · hard
A cloud team is designing permissions for a new application. The application needs to read from a database, write to a storage bucket, and send messages to a queue. The team wants to follow least privilege while minimizing the number of roles to manage. Which approach is best?
Select an answer first
7application · medium
A company wants to allow its employees to use their existing corporate credentials to access a cloud application without creating separate cloud accounts. The company also wants to enforce MFA for all access. Which authentication mechanism should the company implement?
Select an answer first
8application · medium
A user reports that when they access the cloud console, the browser shows a certificate warning. The user proceeds anyway. What is the most likely risk?
Select an answer first
9foundation · easy
Which protocol is commonly used to encrypt communication between a client and a cloud service over the internet?
Select an answer first
10application · medium
A startup uses a single cloud provider. The lead developer creates a service account with full admin permissions and embeds its long-lived access key in a public GitHub repository to allow CI/CD builds to deploy infrastructure. After a security review, the team must reduce risk without disrupting the CI/CD pipeline. Which action best addresses the immediate exposure?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPCS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPCS” is a trademark of its owner, used for identification only.