GIAC GCAD Certification Sample Questions
The purpose of this Sample Question Set is to provide you with information about the GIAC Cloud Security Architecture and Design (GCAD) exam. These sample questions will make you very familiar with both the type and the difficulty level of the questions on the GCAD certification test. To get familiar with real exam environment, we suggest you try our Sample GIAC GCAD Certification Practice Exam. This sample practice exam gives you the feeling of reality and is a clue to the questions asked in the actual GIAC Cloud Security Architecture and Design (GCAD) certification exam.
These sample questions are simple and basic questions that represent likeness to the real GIAC Cloud Security Architecture and Design exam questions. To assess your readiness and performance with real-time scenario based questions, we suggest you prepare with our Premium GIAC GCAD Certification Practice Exam. When you solve real time scenario based questions practically, you come across many difficulties that give you an opportunity to improve.
GIAC GCAD Sample Questions:
01. Woodgrove Bank engineers federate from the corporate IdP into a hub role in AWS, then chain into roles in workload accounts. Investigators cannot tie actions in the chained sessions to a person, because engineers pick a new session name each time they chain. The bank needs an identifier, set by the IdP, that survives role chaining and that the engineer cannot change.
Which SAML attribute should the IdP send?
a) SourceIdentity, carrying each engineer's stable user ID
b) RoleSessionName, set to each engineer's stable user ID from the directory
c) SessionDuration, capped at one shift
d) A NameID in persistent format, holding each engineer's directory ID
02. The only Owner of several Azure subscriptions at Contoso Retail has left the company. A Global Administrator cannot see those subscriptions in the Azure portal and turns on the Access management for Azure resources setting to recover them.
Which two statements about this recovery are accurate?
(Choose two.)
a) Turning the setting on elevates every member of the Global Administrator role in the tenant
b) It assigns the administrator User Access Administrator at root scope, so they can assign roles in every subscription and management group
c) The setting should be switched back off once the needed role assignments are made
d) The Global Administrator role already grants Owner on every subscription, so the setting only makes them visible
e) Ending the PIM activation of Global Administrator removes the elevated access
03. Pellmere Bank requires that no principal outside its AWS organization can read objects in S3 buckets in its member accounts, even if a bucket owner writes a bucket policy granting access to a partner company's account.
Which organization-level control meets this requirement?
a) A resource control policy at the root denying S3 reads by principals outside the organization
b) A root service control policy denying S3 reads by principals outside the organization
c) A permissions boundary attached to every IAM role in the member accounts that caps their S3 access
d) An AWS Config rule that flags bucket policies naming outside accounts
04. Brightwater Analytics publishes a data-enrichment service in Google Cloud. Its customer Halden Foods, a separate company, wants workloads to call the service through an internal IP address inside Halden's own VPC without giving Brightwater any network path into that VPC.
Which construct should Halden use?
a) Private Google Access on the subnets of Halden's VPC
b) A Private Service Connect endpoint in Halden's VPC
c) Shared VPC with Brightwater's project attached as a service project
d) VPC Network Peering between Halden's VPC and Brightwater's VPC
05. Ostrander Retail runs its cardholder-data workloads in the same AWS account and VPC as dozens of internal applications, segmented by security groups that reference each other. An assessor asks for a boundary that would still hold if an internal-application administrator's credentials in that account were compromised.
Which design should the architect propose?
a) Tighten the cardholder security groups so they admit traffic only from the instances that belong to the payment-gateway security group
b) Insert AWS Network Firewall between the cardholder subnet and the other subnets of the shared VPC
c) Move the cardholder workloads to a dedicated account in their own OU, with a VPC reached through inspected connections
d) Place the cardholder workloads in a dedicated subnet whose network ACL denies traffic from every other subnet in the VPC
06. During an incident at a media company, responders disable the customer managed KMS key that protects a suspect EC2 instance's attached EBS volumes, expecting the instance to lose access to its disk. An hour later the instance is still reading and writing those volumes.
Why does the instance still have access?
a) Disabling a key takes effect only after its mandatory waiting period has ended
b) The attached volume uses a data key that EC2 already decrypted
c) EBS falls back to the AWS managed key once a customer managed key is disabled
d) Automatic rotation keeps an older key version active after the key is disabled
07. Northwind Freight runs GitHub Enterprise Server in its own data center, and the server's Actions jobs must deploy to a Google Cloud project. The team will not store any service-account key, and a regulator forbids exposing the server's OIDC endpoint on a public URL.
Which design lets the jobs authenticate to Google Cloud?
a) A service-account JSON key stored as an encrypted secret on the server
b) A workforce identity pool federated with the corporate identity provider
c) An OIDC provider in a workload identity pool with the server's JSON Web Key Set uploaded to it
d) The server's OIDC discovery endpoint published on a public load balancer for Google
08. Larkspur Logistics runs a hub VNet with an ExpressRoute private-peering connection to its data center and two spoke VNets peered to the hub. Servers in the data center and VMs in both spokes must reach one Azure Storage account through a private IP address from the company's own address space, never through the account's public endpoint.
Which design meets this requirement?
a) An Azure NAT Gateway on the spoke subnets with its public IP allowed in the storage firewall
b) Storage service endpoints on the hub and spoke subnets with a virtual network rule for each subnet in the storage firewall
c) Storage firewall rules allowing the public NAT addresses used by ExpressRoute Microsoft peering
d) A private endpoint for the account in the hub VNet with a privatelink private DNS zone for its name
09. Quillon Media's data team must freely query and share BigQuery tables but must not reach tables that hold high-sensitivity customer personal data. New tables appear daily, and classification has to keep pace without anyone labelling tables by hand.
Which two Google Cloud measures together meet this requirement?
(Choose two.)
a) Review Data Access audit logs daily for reads of sensitive tables
b) Place the BigQuery project inside a VPC Service Controls perimeter that admits the data team's corporate network and devices
c) Grant the team's BigQuery role through an IAM conditional binding matching only low and moderate sensitivity tags
d) Have data owners apply a sensitivity label to each new table and reference that label in IAM conditions on the team's role
e) Run Sensitive Data Protection discovery to attach and refresh a sensitivity-level tag on each profiled table
10. Fabrikam Logistics runs an on-premises Kubernetes cluster whose OIDC issuer is already trusted by a workload identity pool provider in Google Cloud. Only workloads in the billing namespace may act as the billing-export-sa service account, and the target API does not accept federated principals directly.
Which two configurations meet the requirement?
(Choose two.)
a) An attribute mapping on the provider that derives a custom namespace attribute from the token's namespace claim
b) Workload Identity User on billing-export-sa granted to every federated identity in the workload identity pool
c) The API's role granted to federated principals directly on the target resource
d) Workload Identity User on billing-export-sa granted to the principalSet whose attribute.namespace is billing
e) A billing-export-sa key file mounted as a Kubernetes Secret in that namespace
Answers:
|
Question: 01 Answer: a |
Question: 02 Answer: b, c |
Question: 03 Answer: a |
Question: 04 Answer: b |
Question: 05 Answer: c |
|
Question: 06 Answer: b |
Question: 07 Answer: c |
Question: 08 Answer: d |
Question: 09 Answer: c, e |
Question: 10 Answer: a, d |
Note: For any error in GIAC Cloud Security Architecture and Design (GCAD) certification exam sample questions, please update us by writing an email on feedback@edusum.com.
