A cloud administrator needs to grant a team of developers the ability to create and manage virtual machines, but they should not be able to delete any resources. Which IAM approach should the administrator use?

Create a group for developers and assign the Reader role.

Assign the built-in Owner role to the developers.

Assign the built-in Contributor role to the developers.

Create a custom role that includes permissions for creating and managing VMs but excludes delete permissions.

Which IAM component is typically used to grant an application running on a cloud virtual machine permission to access a cloud storage bucket?

An IAM user with a long-term password

An IAM role with temporary credentials

An IAM group with a shared access key

An IAM policy attached directly to the storage bucket

A cloud administrator notices that a service account has been inactive for six months but still holds permissions to delete backups. The team wants to reduce the attack surface. What is the most appropriate action?

Leave the account active in case it is needed later.

Add the account to a monitoring group to watch its activity.

Disable or delete the service account and remove its permissions.

Change the account's password and keep the permissions.

A company is merging with another company and needs to grant the new employees access to a shared cloud environment. The new employees are currently managed in a different identity provider. The security team wants to avoid creating duplicate user accounts and wants to enforce the same MFA policy for all users. What is the best approach?

Establish federation between the two identity providers and configure a single MFA policy at the cloud provider.

Use a single sign-on solution that requires users to log in separately to each cloud service.

Migrate all users to a single identity provider and then configure federation.

Create new cloud users for the new employees and manually configure MFA for each.

A security auditor finds that many users have permissions that they no longer need. The company wants to automate the cleanup without breaking ongoing work. Which strategy is most effective?

Immediately remove all permissions that have not been used in 30 days.

Disable all users who have not logged in for 30 days.

Grant everyone the same minimal permissions to simplify.

Use access reviews to identify unused permissions and then remove them.

GIAC Public Cloud Security

Domain 1Objective 2

Securely Accessing Cloud Services GPCS Practice Questions (Page 8)

Part of the Cloud Security Fundamentals domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–17 in this domain), expect 6–9 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

6concepts

Questions 36–40

36application · medium
A cloud administrator needs to grant a team of developers the ability to create and manage virtual machines, but they should not be able to delete any resources. Which IAM approach should the administrator use?
Select an answer first
37foundation · easy
Which IAM component is typically used to grant an application running on a cloud virtual machine permission to access a cloud storage bucket?
Select an answer first
38application · medium
A cloud administrator notices that a service account has been inactive for six months but still holds permissions to delete backups. The team wants to reduce the attack surface. What is the most appropriate action?
Select an answer first
39expert · hard
A company is merging with another company and needs to grant the new employees access to a shared cloud environment. The new employees are currently managed in a different identity provider. The security team wants to avoid creating duplicate user accounts and wants to enforce the same MFA policy for all users. What is the best approach?
Select an answer first
40expert · hard
A security auditor finds that many users have permissions that they no longer need. The company wants to automate the cleanup without breaking ongoing work. Which strategy is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPCS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPCS” is a trademark of its owner, used for identification only.