Securely Accessing Cloud Services GPCS Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A cloud administrator needs to grant a third-party monitoring service read-only access to a specific storage bucket. The monitoring service does not have cloud credentials. The administrator must ensure the service can access the bucket without exposing the company's main cloud account credentials. What should the administrator do?

   • AMake the bucket public so the monitoring service can read it without credentials.
   • BShare the main account's access key with the monitoring service.
   • CCreate a role with read-only permissions for the bucket and allow the monitoring service to assume that role.
   • DCreate a new user with full access to the storage bucket and give the credentials to the monitoring service.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which practice is recommended for managing long-term access keys used by applications to access cloud services?

   • AShare keys among team members to simplify access
   • BEmbed keys directly in application source code for convenience
   • CRotate keys regularly and store them securely
   • DDisable logging of key usage to protect privacy
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company uses a third-party identity provider (IdP) for single sign-on (SSO) to its cloud services. The security team wants to ensure that users who have left the company lose access to the cloud within minutes of their termination. Which authentication mechanism should the company configure?

   • ALocal cloud user accounts with passwords and MFA enabled.
   • BFederated identity with short session durations and periodic re-authentication through the IdP.
   • CFederated identity with long session durations and no re-authentication.
   • DAPI keys for each user that are rotated monthly.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   A company uses an external identity provider (IdP) to authenticate employees into its cloud environment. This allows employees to use their existing corporate credentials. What is this authentication mechanism called?

   • APassword-based authentication
   • BMulti-factor authentication
   • CFederated identity
   • DSingle sign-on (SSO)
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A security team wants to ensure that all cloud access is monitored and that anomalies are detected. They have enabled audit logging. Which additional measure is most important to make the monitoring effective?

   • ARely on the cloud provider's default alerts.
   • BStore logs in a private bucket and review them once a year.
   • CIntegrate logs with a SIEM and create alert rules for suspicious patterns.
   • DDisable logging for high-volume services to reduce noise.
   Reveal Solution Discussion Select an answer first