GIAC GCPN Certification Sample Questions
The purpose of this Sample Question Set is to provide you with information about the GIAC Cloud Penetration Tester (GCPN) exam. These sample questions will make you very familiar with both the type and the difficulty level of the questions on the GCPN certification test. To get familiar with real exam environment, we suggest you try our Sample GIAC GCPN Certification Practice Exam. This sample practice exam gives you the feeling of reality and is a clue to the questions asked in the actual GIAC Cloud Penetration Tester (GCPN) certification exam.
These sample questions are simple and basic questions that represent likeness to the real GIAC Cloud Penetration Tester exam questions. To assess your readiness and performance with real-time scenario based questions, we suggest you prepare with our Premium GIAC GCPN Certification Practice Exam. When you solve real time scenario based questions practically, you come across many difficulties that give you an opportunity to improve.
GIAC GCPN Sample Questions:
01. On the Azure Public cloud default, an assessor notes that Entra smart lockout did not advance an account's failed-attempt counter even though the same incorrect password was submitted several times in a row.
What best explains why the counter did not move?
a) The account had already reached the lockout threshold, so further attempts were ignored.
b) Smart lockout keeps the most recent bad password hashes on record, so resubmitting a password already seen as wrong does not advance the counter.
c) Any failed attempt originating from a recognized, familiar location is tracked in a separate bucket and is only added to the lockout total once the unfamiliar-location threshold has itself been exceeded.
d) A successful sign-in from the same address reset the counter to zero between attempts.
02. During an authorized review the assessor wants to inventory the account's IAM roles and the policies attached to them using read-only calls, without changing any configuration.
Which two AWS CLI calls return that inventory?
(Choose two.)
a) aws iam attach-user-policy
b) aws iam create-policy-version
c) aws iam list-attached-role-policies
d) aws iam update-assume-role-policy
e) aws iam list-roles
03. Two assessment reports describe the same activity — one common password tried once against many accounts — but each names a different spraying utility as the vulnerability. A reviewer insists the finding be keyed to the technique instead.
Why is keying on the method, rather than the tool, the correct analytical choice?
a) Because mitigation and detection map to the technique, not the tool.
b) Because all spraying tools are functionally interchangeable in every case.
c) Because the tool's exact version could not be verified.
d) Because naming the tool touches authorization and disclosure, not the defensive classification.
04. A blue team must improve detection of command-and-control that blends with legitimate TLS traffic to trusted cloud services, including fronted channels.
Which two controls most directly address this exposure?
(Choose two.)
a) Blocking the published IP ranges of all major CDNs at the perimeter firewall.
b) Egress monitoring that baselines outbound destinations and volumes to flag anomalies.
c) DNSSEC validation on internal resolvers to authenticate DNS responses.
d) TLS inspection at egress to compare the SNI against the HTTP Host header.
e) Endpoint antivirus signatures for the C2 framework's default HTTP traffic profile.
05. Service discovery enumerates two managed databases in the client's environment. DB-1 accepts connections from 0.0.0.0/0 and permits anonymous access. DB-2 is reachable only from the corporate range 198.51.100.0/24 and requires authentication.
Which should be reported as the critical exposure, and why?
a) DB-1, because it accepts connections from across the public internet and requires no authentication, so any remote host can reach it and attempt to query its data.
b) Both are equivalent, since any network-reachable database carries the same level of risk.
c) Neither, because discovering a listening service is not by itself a reportable finding.
d) DB-2, because an internal corporate network is where most breaches originate and already-trusted hosts face fewer controls, so an insider can reach it and pivot more easily.
06. While reviewing a developer workstation during an authorized assessment, you find a set of AWS credentials consisting of an access key ID, a secret access key, and a session token. The access key ID begins with ASIA.
What does this combination indicate about the credentials?
a) They are an EC2 key pair used to open an SSH session
b) They are long-term IAM user credentials that do not expire
c) They are temporary STS credentials
d) They are the account root user's permanent access keys
07. Users at a client are being bombarded with repeated Microsoft Authenticator push approval prompts, in the hope that one tired user eventually taps Approve.
Which Entra control most directly defeats this push-approval fatigue technique?
a) Shortening the refresh-token lifetime for all enterprise applications
b) Enabling a forced 60-day password expiry policy for all tenant users
c) Allowing only SMS one-time codes as the second factor
d) Number matching on Authenticator push
08. After a user's account was confirmed compromised, the help desk reset the password at 09:00. The Entra ID sign-in logs then show successful access to Microsoft Graph at 09:42 from the attacker's earlier IP, with this detail:
authenticationProtocol: none; tokenIssuedAt: 08:15; incomingTokenType: refreshToken
What best explains how the attacker retained access after the password reset?
a) The password reset silently failed, and the attacker signed in again with the old password
b) Microsoft Graph does not require authentication for read operations
c) A refresh token issued before the reset was replayed to obtain new access tokens; resetting the password does not revoke tokens already issued, so the sessions must be explicitly revoked
d) The attacker brute-forced the new password within the 42-minute window
09. In an authorized engagement, an operator-registered application is granted tenant-wide delegated permissions through an OAuth consent in a Microsoft Entra ID tenant, modeling a persistence technique.
Which record is where a defender would find evidence of this grant?
a) The virtual machine's guest operating-system event logs
b) The sign-in logs for the single user whose password was reset
c) The storage account diagnostic logs for blob read operations
d) The Microsoft Entra ID audit logs
10. Responding to a confirmed compromise of a Microsoft Entra ID user account, an analyst has already reset the account password but observes that the attacker's access continues.
Which two additional actions are required to actually terminate the attacker's standing access?
(Choose two.)
a) Review and remove any OAuth application consents the attacker added
b) Enforce a 90-day forced password rotation policy
c) Revoke the user's refresh tokens and sign-in sessions
d) Enable number matching for Authenticator push across the tenant
e) Rotate the storage account access keys for the subscription
Answers:
|
Question: 01 Answer: b |
Question: 02 Answer: c, e |
Question: 03 Answer: a |
Question: 04 Answer: b, c |
Question: 05 Answer: a |
|
Question: 06 Answer: c |
Question: 07 Answer: d |
Question: 08 Answer: c |
Question: 09 Answer: d |
Question: 10 Answer: a, c |
Note: For any error in GIAC Cloud Penetration Tester (GCPN) certification exam sample questions, please update us by writing an email on feedback@edusum.com.
