GCIH Securing Credentials and Data in Cloud Practice Test 2 — 15 Questions

Question 1

An incident responder is investigating a breach in a Microsoft Azure environment. The attacker gained initial access by compromising a service principal that had been assigned the Contributor role at the subscription level. The service principal's credentials were stored in a configuration file on a compromised VM. Which TWO of the following actions should the responder take to contain the incident and prevent further unauthorized access? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Remove the Contributor role assignment from the service principal.. The responder should rotate the client secret to invalidate the compromised credential and remove the Contributor role assignment to revoke excessive permissions. These actions contain the incident by preventing the attacker from using the stolen secret and limiting the impact if the secret is still usable. Other options either do not apply to service principals or are too disruptive without addressing the immediate threat.

Answer

Revoke all active refresh tokens for the service principal.

Answer

Delete the service principal from Azure AD.

Answer

Enable Azure AD Identity Protection for all users.

Question 2

A company uses Google Cloud Platform (GCP) and has a requirement that all data stored in Cloud Storage buckets must be encrypted with customer-managed encryption keys (CMEK) to meet compliance. A security engineer needs to ensure that this requirement is enforced for all new buckets. Which of the following should the engineer implement?

Accepted Answer

Create an organization policy constraint that requires CMEK for all Cloud Storage buckets.. The engineer should implement an organization policy constraint that requires CMEK for all Cloud Storage buckets. This enforces the requirement across all projects and ensures that any non-compliant bucket creation is denied. Other options do not provide organization-wide enforcement or do not meet the CMEK requirement. Organization policies are the correct tool for centralized governance in GCP.

Answer

Use a Cloud Storage bucket lock to prevent changes to encryption settings.

Answer

Set a default CMEK key on the project using the gcloud command.

Answer

Enable default encryption with Google-managed keys and rotate them regularly.

Question 3

An organization is migrating to AWS and needs to ensure that IAM users do not possess long-term credentials. Which approach provides the most secure mechanism for programmatic access?

Accepted Answer

Implement IAM roles that grant temporary security credentials via STS.. Utilizing IAM roles with temporary security credentials is the best practice for cloud security. By assuming roles, you eliminate the risks associated with static access keys, which are frequently leaked or stolen. This approach aligns with the principle of least privilege, as temporary tokens expire automatically, reducing the window of opportunity for an attacker to exploit compromised credentials, thereby enhancing the overall security posture of the cloud environment.

Answer

Generate unique access keys for every developer stored in an encrypted S3 bucket.

Answer

Rotate IAM user access keys every 90 days via an automated script.

Answer

Use an IAM group policy to enforce Multi-Factor Authentication on all API requests.

Question 4

When designing a secure cloud database, which configuration best protects against unauthorized data exfiltration if the database instance is misconfigured as public?

Accepted Answer

Placing the database in a private subnet with restricted Security Group rules.. Using a Virtual Private Cloud (VPC) and placing the database in private subnets ensures that the database is not routable from the public internet. By combining this with Security Groups that act as stateful firewalls, you create an isolated environment. Even if the database configuration is accidentally set to public, the network layer denies traffic, providing a critical safety net that prevents direct exploitation by external threat actors.

Answer

Setting a complex root password for the database.

Answer

Enabling database logging for every query.

Answer

Using a public IP address for faster data synchronization.

Question 5

Which of the following describes the 'Confused Deputy' problem in the context of cloud IAM roles?

Accepted Answer

A malicious user triggers a service to use its privileges against a resource.. The Confused Deputy problem occurs when a privileged service is coerced into performing an action on behalf of a user who lacks the permissions to perform that action directly. By utilizing 'External IDs' or 'Condition keys' like 'aws:SourceArn', developers can prevent this by ensuring that the service only assumes the role when the request originates from an authorized context, preventing unauthorized cross-account access and privilege escalation.

Answer

A user is assigned two different roles with conflicting permissions.

Answer

Two cloud administrators inadvertently delete each other's work.

Answer

A service fails to refresh its temporary tokens, causing a lockout.

Question 6

Which feature is most effective for preventing the accidental upload of secrets to a public cloud source code repository?

Accepted Answer

Using pre-commit hooks to scan code for patterns.. Pre-commit hooks are local scripts that run before a commit is finalized, scanning for patterns like API keys or passwords. They allow developers to catch mistakes immediately on their local machines before sensitive data is pushed to a remote repository. This prevents the secret from ever entering the version history, which is the most effective way to maintain the security of credentials in a distributed development workflow.

Answer

Implementing a post-push webhook to scan the repository.

Answer

Enabling public repository visibility scanning.

Answer

Enforcing HTTPS for all Git operations.

Question 7

Which security principle is violated when an IAM user is assigned the 'AdministratorAccess' policy for daily operational tasks?

Accepted Answer

Principle of Least Privilege.. The 'AdministratorAccess' policy provides full, unrestricted access to all services. Assigning this to daily tasks violates the Principle of Least Privilege, which dictates that users should only have the minimum permissions necessary to perform their jobs. Over-privileged accounts are a significant liability, as they allow an attacker who compromises the account to perform any action, including deleting logs or resources, which massively increases the potential impact of an incident.

Answer

Separation of Duties.

Answer

Defense in Depth.

Answer

Security through Obscurity.

Question 8

An incident responder discovers an EC2 instance in AWS has been compromised via a web application vulnerability. The instance profile attached to the instance has broad administrative permissions. What is the immediate priority to contain credential compromise in this scenario?

Accepted Answer

Revoke active sessions using IAM boundary conditions and rotate or restrict the attached IAM instance profile role permissions.. Revoking existing session tokens and updating the IAM role trust and permission policies immediately restricts the attacker from leveraging active temporary security credentials. Incident handlers must remember that compromising an instance profile yields immediate access to STS tokens which persist even if the application vulnerability is patched or the instance is stopped without credential invalidation.

Answer

Terminate the compromised EC2 instance immediately to destroy any running malicious processes and volatile memory artifacts.

Answer

Attach a restrictive Network ACL to the subnet to block all inbound and outbound traffic originating from the compromised instance's private IP address.

Answer

Modify the VPC route table to remove the internet gateway route, isolating the entire virtual private cloud from external communication.

Question 9

A GCIH responder is investigating a compromised AWS account where an EC2 instance's IAM role credentials were stolen from the instance metadata service. The attacker used those temporary credentials from an external IP address to download sensitive objects from an S3 bucket. Which AWS service or mechanism would have provided the earliest detection of this specific anomalous behavior?

Accepted Answer

Amazon GuardDuty with findings for unauthorized access to IAM credentials. GuardDuty analyzes CloudTrail management events to identify when EC2 instance role credentials are used from an external IP address. This specific finding type, UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration, triggers because GuardDuty correlates the credential usage with the originating IP and flags it as anomalous. CloudTrail data events alone only log the API calls without assessing whether the source is expected, while Trusted Advisor and Macie focus on configuration and data classification respectively.

Answer

AWS CloudTrail data events for S3 object-level operations

Answer

Amazon Macie sensitive data discovery jobs on the S3 bucket

Answer

AWS Trusted Advisor security checks for S3 bucket permissions

Question 10

A security analyst is investigating a suspected compromise of an AWS environment. The analyst discovers that an IAM user's access key was used from an unknown IP address to enumerate S3 buckets and download objects. The analyst needs to secure the environment and gather evidence. Which TWO actions should the analyst take to both contain the incident and preserve forensic data? (Choose two.)

Accepted Answer

Deactivate the compromised access key.. Deactivating the compromised access key immediately stops the attacker from using it, while reviewing CloudTrail logs provides the necessary forensic evidence to understand the extent of the breach. Together, these actions contain the incident without destroying evidence. Deleting the user, enabling new logging, or rotating all keys either destroy evidence, fail to address the active threat, or cause unnecessary disruption.

Answer

Rotate all IAM user access keys in the account.

Answer

Enable AWS CloudTrail logging for all regions.

Answer

Delete the IAM user associated with the access key.

Question 11

A company stores sensitive data in an Amazon S3 bucket. The security team wants to ensure that all data is encrypted at rest using keys managed by AWS Key Management Service (KMS) and that the encryption is enforced automatically for all new objects. Which configuration should they implement?

Accepted Answer

Enable default encryption on the S3 bucket using SSE-KMS with a customer managed key.. Enabling default encryption with SSE-KMS and a customer managed key ensures that all new objects are encrypted using KMS-managed keys, meeting both the encryption at rest and key management requirements. It also provides auditability and control over the keys. Other options either use non-KMS keys, only enforce encryption without specifying key type, or address transit encryption instead of at rest.

Answer

Use AWS Certificate Manager (ACM) to provision SSL/TLS certificates for the S3 bucket.

Answer

Create a bucket policy that denies unencrypted PutObject requests.

Answer

Enable default encryption on the S3 bucket using SSE-S3 (AES-256).

Question 12

An incident responder is analyzing a potential compromise in an AWS environment. The responder notices that an IAM role attached to an EC2 instance has been used to access an S3 bucket from an external IP address. The role's trust policy allows the EC2 service to assume it. Which technique is the attacker MOST likely using to abuse this role?

Accepted Answer

Credential exfiltration from the EC2 instance metadata service (IMDS).. The attacker most likely exfiltrated temporary credentials from the EC2 instance metadata service (IMDS) and used them from an external IP. Since the role's trust policy only allows EC2, the credentials must have been obtained from the instance itself. Cross-account assumption is blocked, confused deputy involves service manipulation, and long-term credentials are not used with roles.

Answer

Use of long-term IAM user credentials embedded in the EC2 instance.

Answer

Cross-account role assumption via sts:AssumeRole.

Answer

Exploitation of a confused deputy vulnerability in the S3 bucket policy.

Question 13

A security team is configuring encryption for data at rest in an Amazon S3 bucket that stores regulated financial records. They need to ensure that the encryption keys are managed by the organization and can be rotated on demand, while also providing an audit trail of key usage. Which AWS service should they use to meet these requirements?

Accepted Answer

AWS Key Management Service (KMS) with customer managed keys. AWS KMS with customer managed keys provides the necessary control over encryption keys, including the ability to rotate them on demand and define key policies. It integrates with CloudTrail to log key usage, which is essential for auditing access to sensitive financial records. Other S3 encryption options either do not allow customer management of keys or lack the audit trail required for compliance.

Answer

S3 server-side encryption with Amazon S3 managed keys (SSE-S3)

Answer

S3 server-side encryption with customer-provided keys (SSE-C)

Answer

Amazon S3 default encryption with AES-256

Question 14

An incident responder is analyzing a potential compromise of an AWS environment. The attacker gained access to an EC2 instance and then used the instance's IAM role to call the AWS Security Token Service (STS) AssumeRole API to obtain credentials for a role in another account. The attacker then used those credentials to access sensitive data. Which AWS service or feature would provide the most detailed log of the AssumeRole API call, including the identity of the caller and the target role?

Accepted Answer

AWS CloudTrail management events. CloudTrail management events capture all API calls, including STS AssumeRole, with details such as the caller's identity, the target role, the session name, and the source IP. This makes it the most detailed log for tracing cross-account role assumption. VPC Flow Logs, AWS Config, and GuardDuty findings either lack API-level detail or are not designed for forensic auditing of individual API calls.

Answer

AWS Config configuration history

Answer

Amazon VPC Flow Logs

Answer

Amazon GuardDuty findings

Question 15

An incident responder is analyzing a compromised AWS EC2 instance that was used to exfiltrate data from an S3 bucket. The attacker gained access by exploiting a server-side request forgery (SSRF) vulnerability in a web application running on the instance. The instance had an IAM role attached that allowed s3:GetObject on a sensitive bucket. Which of the following logs would provide the MOST direct evidence of the S3 data access by the attacker?

Accepted Answer

AWS CloudTrail data events for the S3 bucket.. CloudTrail data events for S3 capture object-level API calls, including the identity of the caller (the IAM role) and the specific objects accessed. This directly evidences the exfiltration. Management events do not include data plane operations, S3 server access logs are less integrated, and VPC Flow Logs lack application-layer detail. Thus, CloudTrail data events are the most direct source.

Answer

Amazon S3 server access logs.

Answer

AWS CloudTrail management events for the S3 service.

Answer

VPC Flow Logs for the EC2 instance's network interface.