ACA ACA Identity and Access Management 1 — Questions and Answers
Question 1: What is the primary purpose of Alibaba Cloud RAM (Resource Access Management)?
- To manage virtual machines
- To control user identities and access permissions to cloud resources (Correct answer)
- To configure network routing tables
- To monitor cloud resource usage
Correct answer: To control user identities and access permissions to cloud resources
RAM is Alibaba Cloud's identity and access management service that lets you control who can access which cloud resources and under what conditions.
Question 2: Which of the following best describes a RAM user?
- A physical server managed by Alibaba Cloud
- A virtual machine instance in an ECS cluster
- An entity created under an Alibaba Cloud account representing a person or application (Correct answer)
- A temporary security credential issued by STS
Correct answer: An entity created under an Alibaba Cloud account representing a person or application
A RAM user is a sub-identity created within an Alibaba Cloud account to represent a specific person or application with its own credentials.
Question 3: What is the difference between a System Policy and a Custom Policy in Alibaba Cloud RAM?
- System policies are free; custom policies cost extra
- System policies are predefined by Alibaba Cloud; custom policies are user-defined (Correct answer)
- System policies apply only to RAM users; custom policies apply to roles
- System policies cannot be edited; custom policies expire after 30 days
Correct answer: System policies are predefined by Alibaba Cloud; custom policies are user-defined
System policies are maintained by Alibaba Cloud with preset permissions for common services, while custom policies are authored by the account holder for fine-grained control.
Question 4: Which RAM entity should be used to grant an ECS instance permission to call other Alibaba Cloud services without embedding credentials?
- RAM User
- RAM Group
- RAM Role (Correct answer)
- STS Token
Correct answer: RAM Role
A RAM role assigned to an ECS instance lets the instance obtain temporary credentials automatically, eliminating the need to embed AccessKey credentials.
Question 5: What does STS (Security Token Service) provide in the context of Alibaba Cloud RAM?
- Permanent AccessKey pairs for RAM users
- Temporary security credentials with a configurable expiration time (Correct answer)
- SSL certificates for HTTPS endpoints
- Storage encryption keys for OSS buckets
Correct answer: Temporary security credentials with a configurable expiration time
STS issues short-lived tokens with a defined TTL, reducing risk by ensuring credentials expire and cannot be reused indefinitely.
Question 6: In Alibaba Cloud RAM, what is the effect of attaching a Deny statement to a policy when the same action is also allowed by another policy?
- The Allow takes precedence over the Deny
- The Deny is ignored if it conflicts with an Allow
- The Deny always overrides the Allow, blocking the action (Correct answer)
- The result depends on which policy was attached first
Correct answer: The Deny always overrides the Allow, blocking the action
Alibaba Cloud RAM follows an explicit Deny-overrides model, so any Deny statement on an action will block that action regardless of any Allow policies.
ACA ACA Identity and Access Management 1
What is the primary purpose of Alibaba Cloud RAM (Resource Access Management)?