A company stores critical application data in Azure Blob Storage. They need to protect against accidental deletion and ransomware, and they want to be able to restore data to a point in time. They also want to encrypt data at rest with a customer-managed key. Which configuration should they implement?

Enable Azure Backup for the storage account, and configure a retention policy.

Enable soft delete for blobs, enable versioning, and configure point-in-time restore.

Enable change feed and use Azure Event Grid to replicate data to another region.

Enable immutable storage with a legal hold, and use a read-only storage account.

Which storage configuration setting is a common cause of data exposure if enabled unintentionally?

Public access to the storage container or bucket

A company wants to ensure that no S3 bucket in their AWS account is publicly accessible. They want an automated way to detect and remediate any bucket that becomes public. What should they implement?

Use AWS Config with a managed rule to detect public S3 buckets and an automatic remediation action to remove public access.

Use AWS Trusted Advisor to check for public buckets and manually fix them.

Use AWS CloudTrail to monitor PutBucketPolicy events.

Enable S3 Block Public Access at the account level.

A security team suspects that a compromised IAM user has been downloading objects from a Google Cloud Storage bucket. They need to confirm which objects were accessed, from which IP addresses, and whether the access was authorized. What should they enable?

Enable Cloud Storage versioning and review the object versions.

Enable Cloud Audit Logs for the bucket with data access read logs, and export to Cloud Logging.

Enable Cloud Monitoring metrics for the bucket and set an alert on download count.

Enable VPC Service Controls and review the access logs.

A developer accidentally made an S3 bucket publicly readable. The security team wants to prevent this from happening again across all current and future buckets. They also want to be alerted if any bucket becomes public. Which combination of controls should they implement?

Enable S3 Block Public Access at the account level and use AWS Trusted Advisor to check bucket permissions.

Create an IAM policy that denies s3:PutBucketPolicy for all users, and enable CloudTrail for S3.

Use S3 bucket policies that explicitly deny public access, and enable S3 server access logging.

Use AWS Organizations with an SCP that denies s3:PutBucketPolicy and s3:PutBucketAcl, and enable AWS Config managed rule s3-bucket-public-read-prohibited.

GIAC Public Cloud Security

Domain 2Objective 4

Securing Cloud Storage Platforms GPCS Practice Questions (Page 4)

Part of the Cloud Platform and Service Security domain, which makes up ~60% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~30–48 in this domain), expect 6–10 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

7concepts

Questions 16–20

16application · medium
A company stores critical application data in Azure Blob Storage. They need to protect against accidental deletion and ransomware, and they want to be able to restore data to a point in time. They also want to encrypt data at rest with a customer-managed key. Which configuration should they implement?
Select an answer first
17foundation · easy
Which storage configuration setting is a common cause of data exposure if enabled unintentionally?
Select an answer first
18application · medium
A company wants to ensure that no S3 bucket in their AWS account is publicly accessible. They want an automated way to detect and remediate any bucket that becomes public. What should they implement?
Select an answer first
19application · medium
A security team suspects that a compromised IAM user has been downloading objects from a Google Cloud Storage bucket. They need to confirm which objects were accessed, from which IP addresses, and whether the access was authorized. What should they enable?
Select an answer first
20application · medium
A developer accidentally made an S3 bucket publicly readable. The security team wants to prevent this from happening again across all current and future buckets. They also want to be alerted if any bucket becomes public. Which combination of controls should they implement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPCS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPCS” is a trademark of its owner, used for identification only.