A company needs to automate the creation of cloud resources every time a new developer joins the team. The automation must run without human interaction and must be auditable. Which access method is most appropriate?

Use the web console with MFA for the automation script.

Use a shared administrator account with the CLI.

Use the cloud provider's API with a service account and scoped permissions.

Use the web console and manually create resources for each developer.

A cloud administrator must grant a third-party auditor read-only access to a specific storage bucket for one week. The auditor does not have an account in the company's IdP. Which approach is most appropriate?

Share the cloud account's root credentials with the auditor.

Create a permanent user account with full storage access.

Give the auditor the storage bucket's access key.

Create a temporary role with read-only permissions and use short-lived credentials.

A company's security policy requires that all administrative access to the cloud console be protected by a second factor. The identity provider (IdP) supports TOTP and WebAuthn. Administrators currently use only passwords. Which change directly satisfies the policy while maintaining usability?

Switch administrators to a dedicated bastion host for console access.

Implement a conditional access policy that blocks access from unknown IP addresses.

Enable MFA for all administrator accounts using TOTP or WebAuthn.

Require administrators to use a VPN before accessing the console.

A company is using a cloud provider's IAM system. A developer needs to grant a third-party vendor temporary access to a specific project. The vendor must not see other projects. Which approach is best?

Create a role scoped to the project and issue short-lived credentials to the vendor.

Give the vendor the project's service account key.

Add the vendor to the organization's admin group.

Create a vendor user with viewer access to all projects.

GIAC Public Cloud Security

Domain 1Objective 2

Securely Accessing Cloud Services GPCS Practice Questions (Page 9)

Part of the Cloud Security Fundamentals domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–17 in this domain), expect 6–9 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

6concepts

Questions 41–45

41foundation · easy
Which principle states that users and applications should be granted only the minimum permissions necessary to perform their job functions?
Select an answer first
42application · medium
A company needs to automate the creation of cloud resources every time a new developer joins the team. The automation must run without human interaction and must be auditable. Which access method is most appropriate?
Select an answer first
43application · medium
A cloud administrator must grant a third-party auditor read-only access to a specific storage bucket for one week. The auditor does not have an account in the company's IdP. Which approach is most appropriate?
Select an answer first
44application · medium
A company's security policy requires that all administrative access to the cloud console be protected by a second factor. The identity provider (IdP) supports TOTP and WebAuthn. Administrators currently use only passwords. Which change directly satisfies the policy while maintaining usability?
Select an answer first
45expert · hard
A company is using a cloud provider's IAM system. A developer needs to grant a third-party vendor temporary access to a specific project. The vendor must not see other projects. Which approach is best?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPCS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPCS” is a trademark of its owner, used for identification only.