A company is deploying an AWS Lambda function that processes S3 uploads and writes results to DynamoDB. The function needs to access the DynamoDB table and also needs to call an external API using a secret API key. The security team requires that the function never have access to any AWS credentials in the code or environment variables. What is the most secure way to provide the necessary access?

Create an IAM role for the Lambda function with a policy granting access to the DynamoDB table, and store the API key in AWS Secrets Manager, retrieving it at runtime.

Create an IAM user with programmatic access and store the access key and secret key in the Lambda function code.

Embed the DynamoDB credentials and the API key as environment variables in the Lambda function configuration.

Use an IAM role for DynamoDB access and store the API key in a plaintext file in the deployment package.

Why is logging important for serverless functions from a security perspective?

Logs reduce the function's execution time

Logs are required for the function to be invoked

Logs automatically fix security vulnerabilities in the function

Logs provide a record of function invocations and errors, which is essential for detecting and investigating security incidents

Which practice helps ensure data privacy when a serverless function handles sensitive data?

Storing the data in plain text for easier debugging

Logging all sensitive data to aid in troubleshooting

Encrypting the data in transit and at rest

Sharing the data with all cloud services for analysis

A security analyst needs to detect a potential data exfiltration attempt from a serverless function that reads from a database and writes to S3. The function uses an IAM role. Which combination of actions would provide the most useful evidence?

Enable function logs and add custom logging statements that record the function's input and output.

Enable detailed CloudTrail logging for the function's IAM role and enable S3 data event logging for the bucket.

Enable VPC Flow Logs for the function's VPC and review network traffic to the database.

Enable AWS Config rules to monitor changes to the function's IAM policy.

What is the purpose of output encoding in a serverless function?

To log all output for auditing purposes

To ensure that data returned to the client is rendered safely, preventing cross-site scripting (XSS)

To encrypt the output so only the intended recipient can read it

To compress the output to reduce bandwidth

GIAC Public Cloud Security

Domain 2Objective 5

Securing Serverless Functions GPCS Practice Questions (Page 8)

Part of the Cloud Platform and Service Security domain, which makes up ~60% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~30–48 in this domain), expect 6–10 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

12concepts

Questions 36–40

36application · medium
A company is deploying an AWS Lambda function that processes S3 uploads and writes results to DynamoDB. The function needs to access the DynamoDB table and also needs to call an external API using a secret API key. The security team requires that the function never have access to any AWS credentials in the code or environment variables. What is the most secure way to provide the necessary access?
Select an answer first
37foundation · easy
Why is logging important for serverless functions from a security perspective?
Select an answer first
38foundation · easy
Which practice helps ensure data privacy when a serverless function handles sensitive data?
Select an answer first
39application · medium
A security analyst needs to detect a potential data exfiltration attempt from a serverless function that reads from a database and writes to S3. The function uses an IAM role. Which combination of actions would provide the most useful evidence?
Select an answer first
40foundation · easy
What is the purpose of output encoding in a serverless function?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPCS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPCS” is a trademark of its owner, used for identification only.