GCIH Securing Credentials and Data in Cloud — 10 Questions

Question 1

An incident responder discovers that an AWS IAM role associated with an EC2 instance has been used to exfiltrate sensitive data from an S3 bucket. The administrator wants to revoke all active sessions for this compromised role immediately without deleting the role itself. Which action should the responder take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Attach an explicit Deny policy combined with the aws:TokenIssueTime condition to invalidate active STS sessions.. Revoking active sessions for an IAM role requires updating its maximum session duration or attaching an explicit Deny policy with a condition evaluating 'aws:TokenIssueTime'. This forces STS to invalidate existing temporary credentials instantly. Understanding session revocation mechanisms is crucial for incident handlers mitigating active cloud compromises effectively.

Answer

Rotate the access keys associated with the IAM role immediately.

Answer

Attach an explicit Deny policy with a NotAction condition to the IAM role.

Answer

Disable the trust relationship policy on the IAM role to stop incoming assume-role requests.

Question 2

An incident responder discovers that an AWS IAM role associated with an EC2 instance has been used to exfiltrate sensitive data from an S3 bucket. The administrator wants to revoke all active sessions for this compromised role immediately without deleting the role itself. Which action should the responder take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Update the IAM role's trust policy to include a Deny effect with a condition evaluating aws:TokenIssueTime prior to the current timestamp.. Updating the IAM role's maximum session duration or updating its inline policies forces an invalidation of existing temporary security tokens. In AWS, session revocation for assumed roles requires invalidating the current credentials by updating policies, rotating keys, or explicitly updating the role trust policy boundary. This prevents the attacker from utilizing stolen tokens.

Answer

Delete the IAM role and recreate it immediately with identical permissions under a new Amazon Resource Name.

Answer

Rotate the associated EC2 instance root volume keys and restart the underlying virtual machine instance.

Answer

Enable multi-factor authentication requirements on the S3 bucket access control lists blocking the role.

Question 3

Which TWO of the following configurations are considered best practices for securing data at rest in a cloud environment?

Accepted Answer

Enabling server-side encryption using customer-managed keys.. Securing data at rest requires a defense-in-depth strategy. Using Cloud Provider Managed Keys (CMKs) ensures that the provider handles the underlying infrastructure, while granular IAM policies strictly limit who can access those keys. Combining encryption with strict identity governance provides a robust layer of protection against unauthorized access. This is vital in cloud environments where misconfigured storage buckets are a leading cause of massive data breaches and regulatory compliance failures.

Answer

Disabling server-side encryption to improve performance overhead.

Answer

Granting S3 bucket write permissions to the 'Everyone' group.

Answer

Storing all encryption keys in cleartext within the application source code.

Question 4

Refer to the exhibit. An administrator applies this policy to an IAM user. The user reports they cannot list the contents of the 'company-data' bucket. What is the cause?

Accepted Answer

The policy lacks the 's3:ListBucket' action permission.. The provided policy only grants 's3:GetObject' permissions, which allows the user to download files if the exact key is known. It does not provide the 's3:ListBucket' permission required to see a list of objects in the bucket. This is a common permissions error where administrators assume that read access includes listing capabilities, but in cloud IAM, these actions are distinct and must be explicitly authorized by the policy.

Answer

The resource ARN is missing the bucket name prefix.

Answer

The policy version is outdated and requires an update to 2023.

Answer

The user must have the 's3:PutObject' permission to list files.

Question 5

An organization uses an Identity Provider (IdP) for Single Sign-On (SSO). How should they best handle the revocation of access for a terminated employee?

Accepted Answer

Disable the user account in the central Identity Provider.. The IdP acts as the central authority for authentication. By revoking the user's account in the IdP, all associated sessions and tokens generated for cloud access are invalidated during the next check. This centralized approach ensures that access is immediately terminated across all integrated services, which is critical for preventing unauthorized access by former employees and maintaining a strong security posture in a federated cloud environment.

Answer

Delete the user's IAM roles in each cloud account individually.

Answer

Change the password of the user's local cloud account.

Answer

Wait for the user's temporary security tokens to expire naturally.

Question 6

Which THREE actions should be taken to secure cloud-based API keys used by third-party integrations?

Accepted Answer

Use a dedicated Secrets Management service for key storage.. Securing third-party integrations requires minimizing exposure and monitoring usage. Storing keys in hardware-backed modules, rotating them frequently, and scoping them to specific tasks follows the principle of least privilege. These practices significantly limit the impact if a key is compromised. In the modern cloud landscape, third-party supply chain attacks are increasingly common, making it essential to treat external API keys with the same level of security as internal credentials.

Answer

Store API keys in an environment variable on the server.

Answer

Grant the API key broad access to all cloud resources.

Question 7

Refer to the exhibit. What is the effect of this policy on an IAM user who has NOT authenticated with MFA?

Accepted Answer

The user is denied all S3 actions.. In AWS IAM, an explicit 'Deny' always overrides any 'Allow' policy. This policy explicitly denies all S3 actions if the MFA status is false. Therefore, any user who has not authenticated with MFA will be blocked from all S3 operations, regardless of any other permissions they may have been granted elsewhere. This is a powerful, effective way to enforce MFA for critical infrastructure resources.

Answer

The user can still list buckets but not read objects.

Answer

The user is allowed all S3 actions by default.

Answer

The user is prompted to provide an MFA code on every request.

Question 8

Which of the following is the most secure way to manage database credentials for an application running on a cloud compute instance?

Accepted Answer

Using IAM database authentication with temporary tokens.. Using IAM database authentication allows the application to authenticate using its own identity (IAM role) rather than static username/password pairs. This removes the need to store hardcoded credentials, rotating secrets, or managing password files. The database instance verifies the temporary IAM token, significantly reducing the risk of credential theft and simplifying the management of access throughout the application lifecycle, which is vital for modern cloud-native security.

Answer

Storing the database password in an encrypted configuration file.

Answer

Hardcoding the database credentials in the application code.

Answer

Using an environment variable to store the database password.

Question 9

An incident responder discovers that an AWS IAM role associated with an EC2 instance has been used to exfiltrate sensitive data from an S3 bucket. The administrator wants to revoke all active sessions for this compromised role immediately without deleting the role itself. Which action should the responder take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Attach an explicit Deny policy to the IAM role and revoke all active sessions by modifying the role's maximum session duration.. Revoking the IAM role's active session by updating its max session duration or attaching an explicit deny policy invalidates stolen temporary tokens immediately. Because temporary security credentials derived from IAM roles carry a hardcoded expiration and depend on valid role trust and policy evaluations, modifying the role policy cuts off API access without terminating the underlying EC2 instance, preserving volatile memory and local log artifacts for forensic acquisition.

Answer

Terminate the compromised EC2 instance immediately to stop all active network connections and API requests.

Answer

Delete the underlying IAM role entirely from the AWS Identity and Access Management console.

Answer

Modify the instance security group to block outbound traffic on port 80 and 443 to the metadata service IP address 169.254.169.254.

Question 10

Refer to the exhibit. An incident responder reviews an AWS IAM policy attached to a compromised developer role. What security flaw is present in this policy definition?

Accepted Answer

The policy grants unrestricted access to every object inside the corporate data bucket due to the trailing wildcard resource scope.. The policy scope is dangerously broad, granting read and write access to all objects within the specified S3 bucket without enforcing conditions such as multi-factor authentication or source IP restrictions. Attackers who compromise this role can exfiltrate or overwrite critical business datasets across the entire bucket structure.

Answer

The policy explicitly denies access to administrative actions, preventing incident handlers from troubleshooting the compromised resource during an active forensic investigation.

Answer

The JSON syntax contains structural errors that will cause the AWS Identity and Access Management parser to reject the policy entirely.

Answer

The policy enables cross-account assumption vulnerabilities by omitting the Principal element within the main statement block.