CCSE Identity & Access Management in Cloud Environments 3 — Questions and Answers
Question 1: What is the primary security benefit of using workload identity federation instead of service account keys in Google Cloud?
- It allows workloads to access Google Cloud from any network
- It eliminates the need for long-lived credentials by mapping external identities to GCP service accounts (Correct answer)
- It provides automatic encryption of all API calls
- It grants workloads the highest level of GCP permissions by default
Correct answer: It eliminates the need for long-lived credentials by mapping external identities to GCP service accounts
Workload identity federation lets external workloads exchange short-lived tokens from their own identity provider for GCP access tokens, removing long-lived key management risk.
Question 2: In a Zero Trust architecture, what principle governs access to internal cloud resources?
- Trust is established once per session and maintained for its duration
- All traffic inside the network perimeter is implicitly trusted
- Every access request must be continuously verified regardless of network location (Correct answer)
- VPN connectivity is sufficient to grant internal resource access
Correct answer: Every access request must be continuously verified regardless of network location
Zero Trust requires continuous verification of identity, device health, and context for every request, eliminating implicit network-based trust.
Question 3: Which AWS feature allows you to centrally manage and audit IAM permissions across multiple accounts using permission guardrails?
- AWS IAM Identity Center
- AWS Organizations Service Control Policies (Correct answer)
- AWS Resource Access Manager
- AWS IAM Permission Boundaries
Correct answer: AWS Organizations Service Control Policies
Service Control Policies in AWS Organizations define maximum permission boundaries that apply across all accounts in an OU, acting as guardrails.
Question 4: An attacker compromises a JWT token that lacks an expiration claim. What vulnerability does this represent?
- Broken authentication due to missing token signature validation
- Insecure direct object reference
- Privilege escalation through token manipulation
- Persistent token that never expires, enabling long-term unauthorized access (Correct answer)
Correct answer: Persistent token that never expires, enabling long-term unauthorized access
A JWT without an 'exp' claim never expires, so a stolen token grants indefinite unauthorized access until the signing key is rotated.
Question 5: Which cloud IAM concept restricts the maximum permissions a principal can have, even if attached policies grant more?
- Service Control Policy
- Permission Boundary (Correct answer)
- Resource-based policy
- Trust policy
Correct answer: Permission Boundary
Permission Boundaries define the maximum permissions an IAM entity can have; even if policies grant broader access, the boundary caps what is actually allowed.
Question 6: A developer accidentally commits AWS access keys to a public GitHub repository. What is the FIRST action the security team should take?
- Rotate the exposed keys immediately (Correct answer)
- Scan the repository for other secrets
- Review CloudTrail logs for unauthorized use
- Notify the developer's manager
Correct answer: Rotate the exposed keys immediately
Rotating (invalidating) the exposed keys immediately stops any unauthorized use; investigation and remediation follow.
Question 7: What does Azure AD Privileged Identity Management (PIM) provide for high-privilege roles?
- Permanent assignment of admin roles to reduce friction
- Just-in-time elevation of privileged roles with approval and time limits (Correct answer)
- Automatic creation of service principals for privileged tasks
- Continuous monitoring of all user login attempts
Correct answer: Just-in-time elevation of privileged roles with approval and time limits
Azure PIM enables just-in-time role activation, requiring justification and optional approval, and automatically removing elevated access after a set period.
CCSE Identity & Access Management in Cloud Environments 3
What is the primary security benefit of using workload identity federation instead of service account keys in Google Cloud?