CCSE Identity & Access Management in Cloud Environments 2 — Questions and Answers
Question 1: A cloud engineer needs to grant a Lambda function access to an S3 bucket without storing credentials in code. What is the best approach?
- Hardcode IAM access keys in environment variables
- Assign an IAM execution role to the Lambda function (Correct answer)
- Store credentials in AWS Secrets Manager and retrieve at runtime
- Use a shared IAM user account for all Lambda functions
Correct answer: Assign an IAM execution role to the Lambda function
IAM execution roles allow Lambda functions to assume temporary credentials automatically without any stored secrets.
Question 2: Which OAuth 2.0 flow is most appropriate for a server-side web application that authenticates users and calls a backend API?
- Implicit flow
- Client Credentials flow
- Authorization Code flow (Correct answer)
- Device Authorization flow
Correct answer: Authorization Code flow
The Authorization Code flow is designed for server-side apps where the client secret can be securely stored and tokens are exchanged via back-channel.
Question 3: What does SCIM (System for Cross-domain Identity Management) primarily enable in cloud IAM?
- Single sign-on across cloud providers
- Automated provisioning and deprovisioning of user identities (Correct answer)
- Multi-factor authentication enforcement
- Role-based access control policy evaluation
Correct answer: Automated provisioning and deprovisioning of user identities
SCIM is a protocol that automates the syncing of user identities between an identity provider and cloud services.
Question 4: An organization wants to enforce that all API calls to AWS must originate from a specific IP range. Which IAM policy condition key achieves this?
- aws:RequestedRegion
- aws:SourceVpc
- aws:SourceIp (Correct answer)
- aws:PrincipalOrgID
Correct answer: aws:SourceIp
The aws:SourceIp condition key restricts API requests to those coming from a defined IP address or CIDR range.
Question 5: In Azure AD, what is the purpose of Conditional Access policies?
- To assign Azure RBAC roles to users automatically
- To enforce access controls based on signals like user location, device compliance, and risk level (Correct answer)
- To synchronize on-premises Active Directory with Azure AD
- To configure multi-tenant application registrations
Correct answer: To enforce access controls based on signals like user location, device compliance, and risk level
Conditional Access policies evaluate signals at authentication time and can block, allow, or require MFA based on defined conditions.
Question 6: Which attack targets federated identity by forging SAML assertions to gain unauthorized access?
- Pass-the-Hash attack
- Golden SAML attack (Correct answer)
- Kerberoasting
- Token replay attack
Correct answer: Golden SAML attack
Golden SAML attacks involve stealing the identity provider's private signing key to forge arbitrary SAML assertions and impersonate any user.
Question 7: A security team wants to ensure no IAM policy grants S3 full access across the entire AWS organization. Which control enforces this preventively?
- AWS Config rule
- AWS CloudTrail alert
- Service Control Policy (SCP) with an explicit deny (Correct answer)
- IAM Access Analyzer finding
Correct answer: Service Control Policy (SCP) with an explicit deny
SCPs applied at the organization or OU level can include explicit deny statements that override any permissive IAM policies in member accounts.
CCSE Identity & Access Management in Cloud Environments 2
A cloud engineer needs to grant a Lambda function access to an S3 bucket without storing credentials in code.
What is the best approach?