Free GPCS Practice Questions

Question 1

After an application moves from Azure VNet A to VNet B, Blob Storage reads fail. The storage hostname resolves to the private endpoint's 10.4.1.6 address in A but to a public address in B. Both networks use Azure-provided DNS, and B can reach 10.4.1.6 on TCP 443. The existing private endpoint has a private DNS zone; A still hosts production applications. Which change corrects B's name resolution while keeping storage access private?

Accepted Answer

Link VNet B to the existing private DNS zone.

Answer

Grant Storage Blob Data Contributor on the storage account.

Answer

Recreate the endpoint while retaining the current DNS configuration.

Answer

Peer the networks so VNet B inherits VNet A's private DNS-zone link.

Question 2

A mobile app signs in as user u7. Firestore rules permit reads only when request.auth.uid equals the document's ownerUid. Reading a single invoice owned by u7 succeeds, but collection('invoices').get() is denied. Every invoice currently in that collection belongs to u7. What makes the collection request unacceptable?

Accepted Answer

The query could return documents outside the ownership allowed by the rules.

Answer

Collection queries require mobile users to hold an IAM read role.

Answer

Authorization depends on client code filtering the downloaded documents in memory.

Answer

A compound index must be created before ownership rules can authorize collection reads.

Question 3

A planned archive migration must replace an AWS KMS wrapping key without rewriting the encrypted file payloads. Each file has its own data encryption key (DEK), wrapped by the original KMS key. Neither key is compromised, both KMS keys are available, and the migration role has the required permissions. Which operation changes the key dependency while meeting the migration constraint?

Accepted Answer

Rewrap each DEK with the new KMS key and retain the file ciphertext.

Answer

Replace every DEK and re-encrypt its corresponding file payload.

Answer

Redirect the application's key alias without changing the stored wrapped DEKs.

Answer

Rotate the original KMS key's material while retaining its existing identity.

Question 4

An Azure engineer has two custom role assignments on the same VM. One allows virtual-machine management but excludes deletion through NotActions; the other permits VM deletion. Both assignments are effective, and no deny assignment or resource lock applies. How will Azure evaluate a deletion request from this engineer?

Accepted Answer

Allow it; the second role grants the permission excluded from the first.

Answer

Deny it; NotActions vetoes deletion permissions from any other role.

Answer

Deny it; both roles must independently permit the requested operation.

Answer

Use the role assigned most recently to decide whether deletion is allowed.

Question 5

During active data theft, responders isolate a compromised EC2 instance and disable its metadata endpoint. CloudTrail then records further object downloads from an external address using role credentials issued before isolation. The instance's IAM role is dedicated to this workload. Which action blocks the credentials already in use?

Accepted Answer

Deny sessions issued before the containment cutoff.

Answer

Remove the EC2 instance profile.

Answer

Require IMDSv2 and reduce its token lifetime.

Answer

Rebuild the instance and reattach the same IAM role.

Question 6

The billing API receives a JWT access token using the RFC 9068 profile. Its signature and time checks pass, its issuer is trusted, and scope includes billing.read. The aud claim identifies only the inventory API. Which response respects the token's intended use?

Accepted Answer

Reject it; the billing API is outside the token's intended audience.

Answer

Accept it; valid signature, lifetime, issuer, and scope checks are sufficient.

Answer

Accept it; the aud claim restricts clients rather than receiving APIs.

Answer

Accept it if introspection confirms the token is active at the authorization server.

Question 7

A packet trace shows a partner at 203.0.113.20:53000 reaching an EC2 API at 10.0.2.8:443. The server's response is rejected by the subnet network ACL. The ACL allows inbound TCP 443 from the partner but denies outbound traffic; security groups and routing permit the exchange. Which allowance belongs on the return path?

Accepted Answer

Outbound TCP to 203.0.113.20/32, destination port 53000.

Answer

Inbound TCP from 203.0.113.20/32, destination port 53000.

Answer

Outbound TCP to 203.0.113.20/32, destination port 443.

Answer

Outbound TCP to 10.0.2.8/32, destination port 53000.

Question 8

Partner A's read-only Azure Blob service SAS is exposed in a public incident ticket. It references stored access policy partner-a. Partner B's still-valid SAS references partner-b; both were signed with account key 1, which was not exposed. After the change propagates, A's SAS must fail while B keeps using its existing SAS. How can this separation be achieved?

Accepted Answer

Delete the partner-a stored access policy while preserving partner-b.

Answer

Regenerate account key 1 and replace the SAS tokens of every affected partner.

Answer

Disallow anonymous access to the storage account.

Answer

Remove the issuer's Storage Blob Data Reader role without changing either policy.

Question 9

A deployment operator cannot read confidential exports directly and lacks Service Account Token Creator. The operator can, however, create Compute Engine VMs with chosen startup code and attach a service account that can read those exports. A review concludes that the missing token-creation role prevents indirect access. What capability has the reviewer overlooked?

Accepted Answer

Running chosen VM code with the attached service account's access.

Answer

Inheriting the service account's storage role as the operator.

Answer

Editing the service account's IAM policy through permission to act as that account.

Answer

Downloading a service-account private key through VM-creation permission.

Question 10

A release audit has 100 applicable cloud-security checks: 80 passed, 5 failed, and 15 could not run because the collector lacked permissions. The organization's release policy requires at least 90% passing among assessed checks and assessment of at least 95% of applicable checks. Which evaluation correctly handles both the results and the missing evidence?

Accepted Answer

94.1% pass; 85% coverage. Keep unassessed results unknown; repair collection and reevaluate before approval.

Answer

94.1% pass; 100% coverage. Approve and record the five failed checks.

Answer

80.0% pass; 85% coverage. Count all unassessed checks as failures in the pass rate.

Answer

94.1% pass; 85% coverage. Treat the unassessed checks as proven failures that require configuration fixes.

Free GPCS Practice Questions

Domain 1: Cloud Data Protection

Question 1

Question 2

Domain 2: Cloud Identity and Access Management

Question 3

Domain 3: Cloud Integration and Benchmarking

Question 4

Question 5

Domain 4: Multicloud and Credential Management Fundamentals

Question 6

Question 7

Domain 5: Securely Accessing Cloud Services

Question 8

Domain 6: Securing Cloud Application Service Platforms

Question 9

Domain 7: Securing Cloud Storage Platforms

Question 10

The rest of the GPCS blueprint

That's 10 of 1,030