Which security best practice helps prevent misconfigurations in cloud storage?

Storing encryption keys in the same bucket as the data

Regularly reviewing and auditing storage policies and permissions

Using the same access key for all applications

A security team wants to receive an alert whenever a user attempts to access an S3 bucket without the required permissions. Which service should they use to detect and alert on such events?

Enable S3 server access logging and analyze the logs manually.

Use AWS Config to check bucket policies.

Enable AWS CloudTrail and create a CloudWatch Events rule for S3 AccessDenied events.

Enable S3 Inventory to list objects.

What is the primary purpose of a data lifecycle policy in cloud storage?

To automatically transition objects to cheaper storage tiers or delete them after a specified period

To replicate objects to another region

A security analyst notices unusual read activity on an S3 bucket that contains public marketing files. The analyst needs to determine who accessed the bucket and from which IP addresses. What should the analyst enable?

Enable S3 server access logging and deliver logs to a separate logging bucket.

Use AWS Trusted Advisor to review bucket permissions.

Enable S3 inventory to list all objects in the bucket.

Enable AWS CloudTrail management events for the bucket.

GIAC Public Cloud Security

Domain 2Objective 4

Securing Cloud Storage Platforms GPCS Practice Questions (Page 1)

Part of the Cloud Platform and Service Security domain, which makes up ~60% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~30–48 in this domain), expect 6–10 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

7concepts

Questions 1–5

1foundation · easy
Which key management option gives the customer the most control over encryption keys for cloud storage?
Select an answer first
2foundation · easy
Which security best practice helps prevent misconfigurations in cloud storage?
Select an answer first
3application · medium
A security team wants to receive an alert whenever a user attempts to access an S3 bucket without the required permissions. Which service should they use to detect and alert on such events?
Select an answer first
4foundation · easy
What is the primary purpose of a data lifecycle policy in cloud storage?
Select an answer first
5application · medium
A security analyst notices unusual read activity on an S3 bucket that contains public marketing files. The analyst needs to determine who accessed the bucket and from which IP addresses. What should the analyst enable?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPCS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPCS” is a trademark of its owner, used for identification only.