GIAC GPCS Certification Sample Questions
The purpose of this Sample Question Set is to provide you with information about the GIAC Public Cloud Security (GPCS) exam. These sample questions will make you very familiar with both the type and the difficulty level of the questions on the GPCS certification test. To get familiar with real exam environment, we suggest you try our Sample GIAC GPCS Certification Practice Exam. This sample practice exam gives you the feeling of reality and is a clue to the questions asked in the actual GIAC Public Cloud Security (GPCS) certification exam.
These sample questions are simple and basic questions that represent likeness to the real GIAC Public Cloud Security exam questions. To assess your readiness and performance with real-time scenario based questions, we suggest you prepare with our Premium GIAC GPCS Certification Practice Exam. When you solve real time scenario based questions practically, you come across many difficulties that give you an opportunity to improve.
GIAC GPCS Sample Questions:
01. Over time, roles in an organization have accumulated permissions that are never exercised, and the team wants to right-size them toward least privilege based on evidence rather than guesswork.
Which two practices most directly support this right-sizing?
(Choose two.)
a) Run periodic access reviews that require an owner to recertify or revoke each standing grant.
b) Enforce multi-factor authentication on every principal.
c) Use last-accessed and access-analyzer data to identify permissions and grants that have gone unused, then remove them.
d) Rotate the credentials on every role on a fixed schedule.
02. A containerized application shares a host with other pods, and any pod can reach the node's link-local metadata endpoint to obtain the node identity's credentials.
Which two measures most directly reduce this exposure?
(Choose two.)
a) Give each pod its own least-privilege identity federated to the workload rather than sharing the node role.
b) Grant the node role administrative access so pods never hit permission errors.
c) Disable audit logging on the cluster to reduce noise.
d) Block pod access to the node metadata endpoint and issue each workload its own scoped identity instead.
03. In GCP, a broad role is granted at the folder level and inherited additively by all projects beneath it. The team wants a particular binding to apply only to resources whose name carries a given prefix, without relying on a lower level to cancel the inherited grant.
Which capability expresses this?
a) Set a project-level policy that removes the folder-inherited grant for the non-matching resources.
b) Add an IAM Condition to the binding so the grant applies only when the request's resource attribute matches the prefix.
c) Replace the binding with a primitive Editor role at the project level.
d) Apply an Organization Policy constraint at the folder.
04. A security team wants to detect when an EC2 instance role's credentials are being used from somewhere other than the instance itself. Which signal most directly indicates the credentials have been exfiltrated?
a) The role's identity making API calls from an IP outside the instance.
b) An increase in the instance's CPU utilization during business hours.
c) A rise in the number of objects stored in an unrelated storage bucket.
d) The instance's boot volume approaching its provisioned size.
05. In an AWS account, application teams are allowed to create their own IAM roles for their workloads. The security team must ensure a team cannot create a role that is more powerful than the team's own permitted maximum.
Which mechanism enforces this ceiling on the roles they create?
a) Attach an identity-based policy that grants the teams the exact actions their roles should have.
b) Create an IAM group and place the teams' users in it.
c) Enable multi-factor authentication for the teams' sign-in.
d) Require a permission boundary on every role the teams create, capping the maximum permissions those roles can hold.
06. Reviewing a cloud estate, an assessor is asked which credential type is most often the source of a serious breach. Which is the highest-risk credential to find in use?
a) A managed identity whose secret the platform rotates automatically.
b) A short-lived credential issued to an attached role for a single session.
c) A long-lived static access or service-account key embedded in code.
d) A federated token exchanged at runtime and valid for minutes.
07. A team wants their AWS Lambda functions to stop reading database credentials from environment variables and to minimize both the secret-leak and persistence risk that stored variables create.
Which two measures best achieve this?
(Choose two.)
a) Rotate the entire function's code on a weekly schedule.
b) Encrypt the environment variable with a customer-managed key.
c) Retrieve the credential at runtime from the managed secrets store instead of holding it in an environment variable.
d) Grant the execution role read access to only the one secret the function needs.
08. During an assessment, credentials are found to be leaking through a vulnerable application on an instance with an attached role.
Which three measures together form the durable fix?
(Choose three.)
a) Remediate the application flaw (for example the SSRF) that lets requests reach the metadata endpoint.
b) Require the session-oriented metadata service and disable the legacy mode.
c) Scope the attached identity to least privilege so a stolen token accomplishes little.
d) Increase the instance's memory to reduce application errors.
e) Publish the instance's role name so responders can recognize it.
09. A workload is suspected of beaconing to attacker infrastructure using randomly generated domain names. Investigators want both the volume and destinations of its outbound connections and the actual domain names it looked up.
Which two log sources provide that evidence?
(Choose two.)
a) A control-plane audit log, which reconstructs the beaconing destinations and the resolved domain names from the account's configuration-change history.
b) DNS query logging, which records the specific domain names the workload resolved.
c) At-rest encryption on the workload's disk, which surfaces the exfiltration attempts as it protects the stored data.
d) Network flow logs, which show the outbound connections' destination addresses, ports and byte volumes.
10. Responding to a suspected serverless backdoor, an incident responder needs the evidence that would show a function's code was altered, a new trigger was added, an environment variable was injected, or the execution role was widened.
Which log source most directly records these persistence changes?
a) VPC flow logs for the subnet the function runs in.
b) The control-plane audit log of update actions on the function's code, triggers, configuration, and execution role.
c) Function execution tracing that records per-invocation latency and downstream calls.
d) The function's own application logs written during each invocation.
Answers:
|
Question: 01 Answer: a, c |
Question: 02 Answer: a, d |
Question: 03 Answer: b |
Question: 04 Answer: a |
Question: 05 Answer: d |
|
Question: 06 Answer: c |
Question: 07 Answer: c, d |
Question: 08 Answer: a, b, c |
Question: 09 Answer: b, d |
Question: 10 Answer: b |
Note: For any error in GIAC Public Cloud Security (GPCS) certification exam sample questions, please update us by writing an email on feedback@edusum.com.
