A company stores sensitive customer data in an S3 bucket. The security team wants to ensure that only the finance application (running on an EC2 instance) can read the bucket, and that no other IAM user or role can access it. They also want to detect any unauthorized access attempts. Which combination of controls should they implement?

Create a bucket policy that denies all principals except the finance application's IAM role, and enable S3 server access logging.

Use a pre-signed URL generated by the finance application for each read, and enable S3 inventory.

Attach an IAM policy to the finance application's role granting s3:GetObject, and enable default encryption on the bucket.

Make the bucket private and rely on the default deny-all behavior, then enable CloudTrail for the bucket.

What is the primary purpose of enabling monitoring and alerting on cloud storage?

To replicate data to another region

To automatically delete unused objects

To detect and respond to security events such as unauthorized access

A company stores critical data in Azure Blob Storage. They want to ensure data availability if a regional outage occurs, but they also want to minimize cost. They are considering using read-access geo-redundant storage (RA-GRS). What is the trade-off?

RA-GRS provides read access to a secondary region, but the data may not be immediately consistent if the primary region fails.

RA-GRS requires a customer-managed key for encryption.

RA-GRS is the cheapest option but does not provide any redundancy.

RA-GRS provides a synchronous copy in the secondary region, ensuring no data loss.

GIAC Public Cloud Security

Domain 2Objective 4

Securing Cloud Storage Platforms GPCS Practice Questions (Page 6)

Part of the Cloud Platform and Service Security domain, which makes up ~60% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~30–48 in this domain), expect 6–10 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

7concepts

Questions 26–30

26foundation · easy
Which cloud storage feature records detailed information about requests made to a storage account or bucket?
Select an answer first
27application · medium
A company stores sensitive customer data in an S3 bucket. The security team wants to ensure that only the finance application (running on an EC2 instance) can read the bucket, and that no other IAM user or role can access it. They also want to detect any unauthorized access attempts. Which combination of controls should they implement?
Select an answer first
28foundation · easy
What is the primary purpose of enabling monitoring and alerting on cloud storage?
Select an answer first
29expert · hard
A company stores critical data in Azure Blob Storage. They want to ensure data availability if a regional outage occurs, but they also want to minimize cost. They are considering using read-access geo-redundant storage (RA-GRS). What is the trade-off?
Select an answer first
30foundation · easy
Which cloud storage feature provides redundancy across multiple geographically separated data centers?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPCS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPCS” is a trademark of its owner, used for identification only.

Securing Cloud Storage Platforms GPCS Practice Questions (Page 6)

Questions 26–30

Which cloud storage feature records detailed information about requests made to a storage account or bucket?

What is the primary purpose of enabling monitoring and alerting on cloud storage?

A company stores critical data in Azure Blob Storage. They want to ensure data availability if a regional outage occurs, but they also want to minimize cost. They are considering using read-access geo-redundant storage (RA-GRS). What is the trade-off?

Which cloud storage feature provides redundancy across multiple geographically separated data centers?

Keep studying — Cloud Platform and Service Security