A company stores sensitive data in Azure Blob Storage. They want to encrypt data in transit between their on-premises application and Azure, and they also want to prevent data from being accessed over HTTP. What should they configure?

Use a shared access signature (SAS) with a short expiry for all requests.

Enable 'Secure transfer required' on the storage account and use HTTPS for all client connections.

Enable Azure Storage Service Encryption with a customer-managed key.

Configure a firewall on the storage account to allow only the on-premises IP range.

A developer accidentally made an Azure Blob Storage container publicly accessible. The security team wants to prevent this from happening again across all storage accounts in the organization. What should they implement?

Enable Azure Defender for Storage to alert on public containers.

Set the container access level to private and rely on the developer to follow the process.

Create a shared access signature (SAS) for the container and share it only with the security team.

Use Azure Policy to deny the 'Allow Blob public access' setting on storage accounts.

A company stores critical application data in an S3 bucket in the us-east-1 region. They need to ensure the data is available even if the entire region becomes unavailable. What should they configure?

Create a lifecycle policy to transition objects to S3 Glacier Deep Archive.

Enable S3 Transfer Acceleration on the bucket.

Enable S3 Cross-Region Replication to a bucket in another region and enable versioning on both buckets.

Enable S3 server-side encryption with AWS KMS.

In the shared responsibility model for cloud storage, which security control is typically the customer's responsibility?

Management of the storage hardware and underlying infrastructure

Physical security of the data center hosting the storage

Ensuring the storage service is available across regions

Configuration of access policies and permissions for stored data

GIAC Public Cloud Security

Domain 2Objective 4

Securing Cloud Storage Platforms GPCS Practice Questions (Page 5)

Part of the Cloud Platform and Service Security domain, which makes up ~60% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~30–48 in this domain), expect 6–10 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

7concepts

Questions 21–25

21application · medium
A company stores sensitive data in Azure Blob Storage. They want to encrypt data in transit between their on-premises application and Azure, and they also want to prevent data from being accessed over HTTP. What should they configure?
Select an answer first
22application · medium
A developer accidentally made an Azure Blob Storage container publicly accessible. The security team wants to prevent this from happening again across all storage accounts in the organization. What should they implement?
Select an answer first
23application · medium
A company stores critical application data in an S3 bucket in the us-east-1 region. They need to ensure the data is available even if the entire region becomes unavailable. What should they configure?
Select an answer first
24foundation · easy
In the shared responsibility model for cloud storage, which security control is typically the customer's responsibility?
Select an answer first
25foundation · easy
Which identity-based access control mechanism is used to grant permissions to a cloud storage bucket or container?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPCS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPCS” is a trademark of its owner, used for identification only.