A company uses an S3 bucket to store confidential data. They have a requirement that the bucket must be accessible only from their corporate network (a fixed IP range). They also want to allow a partner organization to upload files using their own AWS account. The security team wants to enforce this without creating IAM users for the partner. Which approach should they take?

Create an IAM role for the partner and attach a policy that allows s3:PutObject, then share the role credentials.

Make the bucket public and rely on the partner's IAM permissions.

Use a pre-signed URL generated by the company for each upload, and restrict the bucket to the corporate IP range.

Create a bucket policy that allows s3:PutObject from the partner's AWS account and restricts access to the corporate IP range.

What is the purpose of a bucket policy in cloud object storage?

To control access to the bucket and its objects

To define the physical location of the storage bucket

To set up replication to another region

A company has an S3 bucket with a bucket policy that grants s3:GetObject to a specific IAM role. The security team discovers that the role can also access the bucket through an IAM policy attached to the role. They want to ensure that only the bucket policy grants access, and they want to audit all access. What should they do?

Use S3 Block Public Access to restrict access.

Remove the bucket policy and rely on the IAM policy; enable CloudTrail management events.

Keep both policies and enable S3 server access logging.

Remove the IAM policy from the role and keep the bucket policy; enable CloudTrail data events for the bucket.

A security team is investigating a potential data exfiltration from an S3 bucket. They need to determine which IAM user accessed a specific object and from which IP address. They have enabled CloudTrail, but they are not seeing object-level events. What should they do?

Use AWS Config to review the bucket policy.

Enable CloudTrail data events for the S3 bucket.

Enable S3 server access logging on the bucket.

Use AWS Trusted Advisor to check for public access.

A security analyst notices unusual read activity on an Azure Storage account. They need to determine who accessed a specific blob, from which IP address, and whether the access was authorized. Which logging and monitoring configuration should they use?

Enable Azure Activity Log and send it to Event Hubs.

Enable storage analytics logging and configure diagnostic settings to send logs to a Log Analytics workspace.

Use Azure Monitor metrics for the storage account and set an alert on read operations.

Enable Azure Defender for Storage and review its security alerts.

GIAC Public Cloud Security

Domain 2Objective 4

Securing Cloud Storage Platforms GPCS Practice Questions (Page 2)

Part of the Cloud Platform and Service Security domain, which makes up ~60% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~30–48 in this domain), expect 6–10 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

7concepts

Questions 6–10

6expert · hard
A company uses an S3 bucket to store confidential data. They have a requirement that the bucket must be accessible only from their corporate network (a fixed IP range). They also want to allow a partner organization to upload files using their own AWS account. The security team wants to enforce this without creating IAM users for the partner. Which approach should they take?
Select an answer first
7foundation · easy
What is the purpose of a bucket policy in cloud object storage?
Select an answer first
8expert · hard
A company has an S3 bucket with a bucket policy that grants s3:GetObject to a specific IAM role. The security team discovers that the role can also access the bucket through an IAM policy attached to the role. They want to ensure that only the bucket policy grants access, and they want to audit all access. What should they do?
Select an answer first
9expert · hard
A security team is investigating a potential data exfiltration from an S3 bucket. They need to determine which IAM user accessed a specific object and from which IP address. They have enabled CloudTrail, but they are not seeing object-level events. What should they do?
Select an answer first
10application · medium
A security analyst notices unusual read activity on an Azure Storage account. They need to determine who accessed a specific blob, from which IP address, and whether the access was authorized. Which logging and monitoring configuration should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPCS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPCS” is a trademark of its owner, used for identification only.

Securing Cloud Storage Platforms GPCS Practice Questions (Page 2)

Questions 6–10

What is the purpose of a bucket policy in cloud object storage?

A security team is investigating a potential data exfiltration from an S3 bucket. They need to determine which IAM user accessed a specific object and from which IP address. They have enabled CloudTrail, but they are not seeing object-level events. What should they do?

A security analyst notices unusual read activity on an Azure Storage account. They need to determine who accessed a specific blob, from which IP address, and whether the access was authorized. Which logging and monitoring configuration should they use?

Keep studying — Cloud Platform and Service Security