A company has a policy that requires all cloud access keys to be rotated every 90 days. A developer has an application that uses an access key to connect to a cloud storage service. The developer is concerned about downtime during rotation. What is the best practice to ensure no downtime?

Keep the same key but change the permissions.

Deactivate the old key and immediately create a new one.

Create a second access key, update the application to use the new key, then deactivate the old key.

Use a service principal instead of an access key.

A developer needs to upload a large file to a cloud storage service from a script running on a virtual machine. The script must be able to run unattended and must not require interactive login. Which access method should the developer use?

Cloud provider's CLI with a service principal and a scoped role for the storage service.

Web console with a user account and MFA.

FTP with the storage service's public endpoint.

REST API with a user's personal access key.

Which authentication mechanism requires a user to provide two different types of credentials, such as a password and a one-time code from a mobile app?

Multi-factor authentication (MFA)

A company's cloud environment experienced a credential leak. The security team wants to ensure that the leaked credentials are useless as quickly as possible and that future leaks have limited impact. Which combination of practices is most effective?

Rely on the cloud provider to detect and revoke leaked credentials.

Use long-lived credentials but change them every year.

Use short-lived credentials and enable automatic rotation.

Use a single access key for all services and monitor it.

In cloud IAM, what is the primary purpose of role-based access control (RBAC)?

To authenticate users using biometric factors

To monitor user activity in real time

To assign permissions to users based on their job function or role within the organization

To encrypt data stored in cloud resources

GIAC Public Cloud Security

Domain 1Objective 2

Securely Accessing Cloud Services GPCS Practice Questions (Page 3)

Part of the Cloud Security Fundamentals domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–17 in this domain), expect 6–9 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

6concepts

Questions 11–15

11application · medium
A company has a policy that requires all cloud access keys to be rotated every 90 days. A developer has an application that uses an access key to connect to a cloud storage service. The developer is concerned about downtime during rotation. What is the best practice to ensure no downtime?
Select an answer first
12application · medium
A developer needs to upload a large file to a cloud storage service from a script running on a virtual machine. The script must be able to run unattended and must not require interactive login. Which access method should the developer use?
Select an answer first
13foundation · easy
Which authentication mechanism requires a user to provide two different types of credentials, such as a password and a one-time code from a mobile app?
Select an answer first
14expert · hard
A company's cloud environment experienced a credential leak. The security team wants to ensure that the leaked credentials are useless as quickly as possible and that future leaks have limited impact. Which combination of practices is most effective?
Select an answer first
15foundation · easy
In cloud IAM, what is the primary purpose of role-based access control (RBAC)?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPCS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPCS” is a trademark of its owner, used for identification only.