GCIH Securing Credentials and Data in Cloud — All Questions With Answers

Question 1

An incident responder discovers that an AWS IAM role associated with an EC2 instance has been used to exfiltrate sensitive data from an S3 bucket. The administrator wants to revoke all active sessions for this compromised role immediately without deleting the role itself. Which action should the responder take?

Accepted Answer

Attach an explicit Deny policy combined with the aws:TokenIssueTime condition to invalidate active STS sessions.. Revoking active sessions for an IAM role requires updating its maximum session duration or attaching an explicit Deny policy with a condition evaluating 'aws:TokenIssueTime'. This forces STS to invalidate existing temporary credentials instantly. Understanding session revocation mechanisms is crucial for incident handlers mitigating active cloud compromises effectively.

Answer

Rotate the access keys associated with the IAM role immediately.

Answer

Attach an explicit Deny policy with a NotAction condition to the IAM role.

Answer

Disable the trust relationship policy on the IAM role to stop incoming assume-role requests.

Question 2

An incident responder discovers that an AWS IAM role utilized by an EC2 instance has been persistently leveraged to exfiltrate sensitive data from an Amazon S3 bucket. The security team needs to revoke all active sessions associated with this compromised role immediately without deleting the role itself. Which action achieves this objective effectively?

Accepted Answer

Update the IAM role's trust policy to include a Deny effect with a condition evaluating aws:TokenIssueTime prior to the current timestamp.. Updating the IAM role's maximum session duration or updating its inline policies forces an invalidation of existing temporary security tokens. In AWS, session revocation for assumed roles requires invalidating the current credentials by updating policies, rotating keys, or explicitly updating the role trust policy boundary. This prevents the attacker from utilizing stolen tokens.

Answer

Delete the IAM role and recreate it immediately with identical permissions under a new Amazon Resource Name.

Answer

Rotate the associated EC2 instance root volume keys and restart the underlying virtual machine instance.

Answer

Enable multi-factor authentication requirements on the S3 bucket access control lists blocking the role.

Question 3

Which TWO of the following configurations are considered best practices for securing data at rest in a cloud environment?

Accepted Answer

Enabling server-side encryption using customer-managed keys.. Securing data at rest requires a defense-in-depth strategy. Using Cloud Provider Managed Keys (CMKs) ensures that the provider handles the underlying infrastructure, while granular IAM policies strictly limit who can access those keys. Combining encryption with strict identity governance provides a robust layer of protection against unauthorized access. This is vital in cloud environments where misconfigured storage buckets are a leading cause of massive data breaches and regulatory compliance failures.

Answer

Disabling server-side encryption to improve performance overhead.

Answer

Granting S3 bucket write permissions to the 'Everyone' group.

Answer

Storing all encryption keys in cleartext within the application source code.

Question 4

Refer to the exhibit. An administrator applies this policy to an IAM user. The user reports they cannot list the contents of the 'company-data' bucket. What is the cause?

Accepted Answer

The policy lacks the 's3:ListBucket' action permission.. The provided policy only grants 's3:GetObject' permissions, which allows the user to download files if the exact key is known. It does not provide the 's3:ListBucket' permission required to see a list of objects in the bucket. This is a common permissions error where administrators assume that read access includes listing capabilities, but in cloud IAM, these actions are distinct and must be explicitly authorized by the policy.

Answer

The resource ARN is missing the bucket name prefix.

Answer

The policy version is outdated and requires an update to 2023.

Answer

The user must have the 's3:PutObject' permission to list files.

Question 5

An organization uses an Identity Provider (IdP) for Single Sign-On (SSO). How should they best handle the revocation of access for a terminated employee?

Accepted Answer

Disable the user account in the central Identity Provider.. The IdP acts as the central authority for authentication. By revoking the user's account in the IdP, all associated sessions and tokens generated for cloud access are invalidated during the next check. This centralized approach ensures that access is immediately terminated across all integrated services, which is critical for preventing unauthorized access by former employees and maintaining a strong security posture in a federated cloud environment.

Answer

Delete the user's IAM roles in each cloud account individually.

Answer

Change the password of the user's local cloud account.

Answer

Wait for the user's temporary security tokens to expire naturally.

Question 6

Which THREE actions should be taken to secure cloud-based API keys used by third-party integrations?

Accepted Answer

Use a dedicated Secrets Management service for key storage.. Securing third-party integrations requires minimizing exposure and monitoring usage. Storing keys in hardware-backed modules, rotating them frequently, and scoping them to specific tasks follows the principle of least privilege. These practices significantly limit the impact if a key is compromised. In the modern cloud landscape, third-party supply chain attacks are increasingly common, making it essential to treat external API keys with the same level of security as internal credentials.

Answer

Store API keys in an environment variable on the server.

Answer

Grant the API key broad access to all cloud resources.

Question 7

Refer to the exhibit. What is the effect of this policy on an IAM user who has NOT authenticated with MFA?

Accepted Answer

The user is denied all S3 actions.. In AWS IAM, an explicit 'Deny' always overrides any 'Allow' policy. This policy explicitly denies all S3 actions if the MFA status is false. Therefore, any user who has not authenticated with MFA will be blocked from all S3 operations, regardless of any other permissions they may have been granted elsewhere. This is a powerful, effective way to enforce MFA for critical infrastructure resources.

Answer

The user can still list buckets but not read objects.

Answer

The user is allowed all S3 actions by default.

Answer

The user is prompted to provide an MFA code on every request.

Question 8

Which of the following is the most secure way to manage database credentials for an application running on a cloud compute instance?

Accepted Answer

Using IAM database authentication with temporary tokens.. Using IAM database authentication allows the application to authenticate using its own identity (IAM role) rather than static username/password pairs. This removes the need to store hardcoded credentials, rotating secrets, or managing password files. The database instance verifies the temporary IAM token, significantly reducing the risk of credential theft and simplifying the management of access throughout the application lifecycle, which is vital for modern cloud-native security.

Answer

Storing the database password in an encrypted configuration file.

Answer

Hardcoding the database credentials in the application code.

Answer

Using an environment variable to store the database password.

Question 9

An incident responder discovers that an AWS IAM role associated with an EC2 instance has been compromised due to SSRF. The attacker has extracted temporary security credentials from the instance metadata service. Which immediate containment action prevents the attacker from continuing to use these stolen tokens while preserving forensic evidence on the running instance?

Accepted Answer

Attach an explicit Deny policy to the IAM role and revoke all active sessions by modifying the role's maximum session duration.. Revoking the IAM role's active session by updating its max session duration or attaching an explicit deny policy invalidates stolen temporary tokens immediately. Because temporary security credentials derived from IAM roles carry a hardcoded expiration and depend on valid role trust and policy evaluations, modifying the role policy cuts off API access without terminating the underlying EC2 instance, preserving volatile memory and local log artifacts for forensic acquisition.

Answer

Terminate the compromised EC2 instance immediately to stop all active network connections and API requests.

Answer

Delete the underlying IAM role entirely from the AWS Identity and Access Management console.

Answer

Modify the instance security group to block outbound traffic on port 80 and 443 to the metadata service IP address 169.254.169.254.

Question 10

Refer to the exhibit. An incident responder reviews an AWS IAM policy attached to a compromised developer role. What security flaw is present in this policy definition?

Accepted Answer

The policy grants unrestricted access to every object inside the corporate data bucket due to the trailing wildcard resource scope.. The policy scope is dangerously broad, granting read and write access to all objects within the specified S3 bucket without enforcing conditions such as multi-factor authentication or source IP restrictions. Attackers who compromise this role can exfiltrate or overwrite critical business datasets across the entire bucket structure.

Answer

The policy explicitly denies access to administrative actions, preventing incident handlers from troubleshooting the compromised resource during an active forensic investigation.

Answer

The JSON syntax contains structural errors that will cause the AWS Identity and Access Management parser to reject the policy entirely.

Answer

The policy enables cross-account assumption vulnerabilities by omitting the Principal element within the main statement block.

Question 11

An incident responder discovers that an AWS IAM user's static access key was exposed in a public code repository. The security team needs to immediately revoke active sessions and prevent any ongoing unauthorized API calls using that credential without deleting the user account right away. Which action should the responder take?

Accepted Answer

Attach an explicit Deny IAM policy to the user that restricts all actions immediately.. Attaching an explicit Deny policy with a Null condition checking for the aws:TokenIssueTime or simply setting a NotAction/Deny structure ensures all ongoing temporary sessions and immediate API calls are blocked instantly. Revoking the key or deleting it stops future requests, but evaluating an explicit deny policy is the fastest enterprise method to terminate active STS sessions tied to those credentials.

Answer

Delete the exposed access key immediately from the IAM user profile to terminate all processing.

Answer

Rotate the access key by generating a new secondary key pair in the IAM console.

Answer

Enable multi-factor authentication enforcement on the compromised IAM user account.

Question 12

An attacker has obtained a copy of an EC2 instance's IAM role credentials through a server-side request forgery (SSRF) vulnerability. The role currently has permissions to read and write to an S3 bucket containing sensitive customer data. The incident response team wants to immediately stop the active exfiltration while preserving forensic evidence. Which AWS action should they take FIRST?

Accepted Answer

Detach the IAM role from the EC2 instance and terminate the instance.. The most immediate way to stop an active exfiltration from a compromised EC2 instance is to detach the IAM role and terminate the instance, which cuts off the attacker's access to new credentials and halts the running process. While other methods like explicit denies or session revocation are useful, they may not act quickly enough or may leave the attacker with valid temporary credentials. Terminating the instance ensures the attack surface is removed, though it sacrifices volatile memory evidence.

Answer

Attach an explicit deny policy to the IAM role for the S3 actions.

Answer

Delete the S3 bucket policy that grants access to the role.

Answer

Revoke the role's temporary credentials by adding the role to the AWSRevokeOlderSessions inline policy.

Question 13

An organization uses AWS Organizations with multiple accounts. A security analyst discovers that an IAM user in the development account was able to assume a role in the production account that grants full access to an S3 bucket containing customer PII. The role's trust policy allows assumption by any principal in the development account. Which AWS feature would have most effectively prevented this cross-account privilege escalation by restricting which principals can assume the production role?

Accepted Answer

A condition in the production role's trust policy that restricts the Principal to a specific IAM role in the development account. The trust policy of an IAM role is the authoritative control for who can assume it. By default, it can be broad, but best practice is to restrict the Principal to specific IAM roles or users, often with conditions such as aws:PrincipalArn or sts:ExternalId. In this scenario, allowing any principal in the development account enabled the escalation. Narrowing the Principal to a dedicated role with strict permissions and monitoring would have prevented the compromised user from assuming the production role.

Answer

Service control policies (SCPs) attached to the production account

Answer

IAM permissions boundaries on the development account IAM user

Answer

AWS Config rules that monitor IAM policy changes in the production account

Question 14

A security team is investigating an incident where an attacker gained access to an AWS environment by using stolen long-term access keys. The keys belonged to a developer who had embedded them in a script that was later committed to a public GitHub repository. The team wants to prevent this from happening again. Which of the following is the MOST effective control to mitigate this risk?

Accepted Answer

Implement IAM roles for EC2 instances and use temporary credentials via AWS STS.. The most effective control is to eliminate long-term credentials by using IAM roles that provide temporary credentials. This prevents the hardcoding of access keys in scripts and repositories, directly addressing the root cause of the incident. While other options offer security benefits, they do not remove the risk of static keys being exposed and misused. IAM roles are the recommended best practice for granting permissions to AWS services and applications.

Answer

Enable AWS CloudTrail to log all API activity and monitor for suspicious behavior.

Answer

Enforce multi-factor authentication (MFA) for all IAM users.

Answer

Use AWS Secrets Manager to store and automatically rotate database credentials.

Question 15

A GCIH incident handler is responding to a security alert indicating that an AWS Lambda function's execution role credentials may have been compromised. The function has permissions to read from an S3 bucket containing sensitive data. Which TWO immediate actions should the handler take to contain the potential data exfiltration? (Choose two.)

Accepted Answer

Revoke the temporary credentials by attaching an inline policy to the role that denies all actions. The two most effective immediate containment actions are to revoke the compromised temporary credentials by applying an explicit deny policy to the Lambda execution role, and to review CloudTrail logs to determine the extent of unauthorized access. These steps stop ongoing exfiltration and gather necessary forensic data. Deleting the function, rotating non-existent access keys, or altering S3 public access settings do not address the credential compromise and may hinder the investigation.

Answer

Disable the S3 bucket's public access block to allow faster investigation

Answer

Delete the Lambda function to prevent further invocations

Answer

Rotate the AWS access keys of the IAM user associated with the Lambda function

Question 16

An incident responder is investigating a breach in a Microsoft Azure environment. The attacker gained initial access by compromising a service principal that had been assigned the Contributor role at the subscription level. The service principal's credentials were stored in a configuration file on a compromised VM. Which TWO of the following actions should the responder take to contain the incident and prevent further unauthorized access? (Choose two.)

Accepted Answer

Remove the Contributor role assignment from the service principal.. The responder should rotate the client secret to invalidate the compromised credential and remove the Contributor role assignment to revoke excessive permissions. These actions contain the incident by preventing the attacker from using the stolen secret and limiting the impact if the secret is still usable. Other options either do not apply to service principals or are too disruptive without addressing the immediate threat.

Answer

Revoke all active refresh tokens for the service principal.

Answer

Delete the service principal from Azure AD.

Answer

Enable Azure AD Identity Protection for all users.

Question 17

A company uses Google Cloud Platform (GCP) and has a requirement that all data stored in Cloud Storage buckets must be encrypted with customer-managed encryption keys (CMEK) to meet compliance. A security engineer needs to ensure that this requirement is enforced for all new buckets. Which of the following should the engineer implement?

Accepted Answer

Create an organization policy constraint that requires CMEK for all Cloud Storage buckets.. The engineer should implement an organization policy constraint that requires CMEK for all Cloud Storage buckets. This enforces the requirement across all projects and ensures that any non-compliant bucket creation is denied. Other options do not provide organization-wide enforcement or do not meet the CMEK requirement. Organization policies are the correct tool for centralized governance in GCP.

Answer

Use a Cloud Storage bucket lock to prevent changes to encryption settings.

Answer

Set a default CMEK key on the project using the gcloud command.

Answer

Enable default encryption with Google-managed keys and rotate them regularly.

Question 18

An organization is migrating to AWS and needs to ensure that IAM users do not possess long-term credentials. Which approach provides the most secure mechanism for programmatic access?

Accepted Answer

Implement IAM roles that grant temporary security credentials via STS.. Utilizing IAM roles with temporary security credentials is the best practice for cloud security. By assuming roles, you eliminate the risks associated with static access keys, which are frequently leaked or stolen. This approach aligns with the principle of least privilege, as temporary tokens expire automatically, reducing the window of opportunity for an attacker to exploit compromised credentials, thereby enhancing the overall security posture of the cloud environment.

Answer

Generate unique access keys for every developer stored in an encrypted S3 bucket.

Answer

Rotate IAM user access keys every 90 days via an automated script.

Answer

Use an IAM group policy to enforce Multi-Factor Authentication on all API requests.

Question 19

When designing a secure cloud database, which configuration best protects against unauthorized data exfiltration if the database instance is misconfigured as public?

Accepted Answer

Placing the database in a private subnet with restricted Security Group rules.. Using a Virtual Private Cloud (VPC) and placing the database in private subnets ensures that the database is not routable from the public internet. By combining this with Security Groups that act as stateful firewalls, you create an isolated environment. Even if the database configuration is accidentally set to public, the network layer denies traffic, providing a critical safety net that prevents direct exploitation by external threat actors.

Answer

Setting a complex root password for the database.

Answer

Enabling database logging for every query.

Answer

Using a public IP address for faster data synchronization.

Question 20

Which of the following describes the 'Confused Deputy' problem in the context of cloud IAM roles?

Accepted Answer

A malicious user triggers a service to use its privileges against a resource.. The Confused Deputy problem occurs when a privileged service is coerced into performing an action on behalf of a user who lacks the permissions to perform that action directly. By utilizing 'External IDs' or 'Condition keys' like 'aws:SourceArn', developers can prevent this by ensuring that the service only assumes the role when the request originates from an authorized context, preventing unauthorized cross-account access and privilege escalation.

Answer

A user is assigned two different roles with conflicting permissions.

Answer

Two cloud administrators inadvertently delete each other's work.

Answer

A service fails to refresh its temporary tokens, causing a lockout.

GCIH Securing Credentials and Data in Cloud — All Questions With Answers

Which TWO of the following configurations are considered best practices for securing data at rest in a cloud environment?

Refer to the exhibit. An administrator applies this policy to an IAM user. The user reports they cannot list the contents of the 'company-data' bucket. What is the cause?

Exhibit

An organization uses an Identity Provider (IdP) for Single Sign-On (SSO). How should they best handle the revocation of access for a terminated employee?

Which THREE actions should be taken to secure cloud-based API keys used by third-party integrations?

Refer to the exhibit. What is the effect of this policy on an IAM user who has NOT authenticated with MFA?

Exhibit

Which of the following is the most secure way to manage database credentials for an application running on a cloud compute instance?

Refer to the exhibit. An incident responder reviews an AWS IAM policy attached to a compromised developer role. What security flaw is present in this policy definition?

Exhibit

An organization is migrating to AWS and needs to ensure that IAM users do not possess long-term credentials. Which approach provides the most secure mechanism for programmatic access?

When designing a secure cloud database, which configuration best protects against unauthorized data exfiltration if the database instance is misconfigured as public?

Which of the following describes the 'Confused Deputy' problem in the context of cloud IAM roles?

Which feature is most effective for preventing the accidental upload of secrets to a public cloud source code repository?

Which security principle is violated when an IAM user is assigned the 'AdministratorAccess' policy for daily operational tasks?

An incident responder discovers an EC2 instance in AWS has been compromised via a web application vulnerability. The instance profile attached to the instance has broad administrative permissions. What is the immediate priority to contain credential compromise in this scenario?

A company stores sensitive data in an Amazon S3 bucket. The security team wants to ensure that all data is encrypted at rest using keys managed by AWS Key Management Service (KMS) and that the encryption is enforced automatically for all new objects. Which configuration should they implement?

GCIH Securing Credentials and Data in Cloud — All Questions With Answers

Which TWO of the following configurations are considered best practices for securing data at rest in a cloud environment?

Refer to the exhibit. An administrator applies this policy to an IAM user. The user reports they cannot list the contents of the 'company-data' bucket. What is the cause?

Exhibit

An organization uses an Identity Provider (IdP) for Single Sign-On (SSO). How should they best handle the revocation of access for a terminated employee?

Which THREE actions should be taken to secure cloud-based API keys used by third-party integrations?

Refer to the exhibit. What is the effect of this policy on an IAM user who has NOT authenticated with MFA?

Exhibit

Which of the following is the most secure way to manage database credentials for an application running on a cloud compute instance?

Refer to the exhibit. An incident responder reviews an AWS IAM policy attached to a compromised developer role. What security flaw is present in this policy definition?

Exhibit

An organization is migrating to AWS and needs to ensure that IAM users do not possess long-term credentials. Which approach provides the most secure mechanism for programmatic access?

When designing a secure cloud database, which configuration best protects against unauthorized data exfiltration if the database instance is misconfigured as public?

Which of the following describes the 'Confused Deputy' problem in the context of cloud IAM roles?

Which feature is most effective for preventing the accidental upload of secrets to a public cloud source code repository?

Which security principle is violated when an IAM user is assigned the 'AdministratorAccess' policy for daily operational tasks?

An incident responder discovers an EC2 instance in AWS has been compromised via a web application vulnerability. The instance profile attached to the instance has broad administrative permissions. What is the immediate priority to contain credential compromise in this scenario?

A company stores sensitive data in an Amazon S3 bucket. The security team wants to ensure that all data is encrypted at rest using keys managed by AWS Key Management Service (KMS) and that the encryption is enforced automatically for all new objects. Which configuration should they implement?