CCSE Identity & Access Management in Cloud Environments 3

Question 1

What is the primary security benefit of using workload identity federation instead of service account keys in Google Cloud?

Accepted Answer

It eliminates the need for long-lived credentials by mapping external identities to GCP service accounts

Answer

Workload identity federation lets external workloads exchange short-lived tokens from their own identity provider for GCP access tokens, removing long-lived key management risk.

Question 2

In a Zero Trust architecture, what principle governs access to internal cloud resources?

Accepted Answer

Every access request must be continuously verified regardless of network location

Answer

Zero Trust requires continuous verification of identity, device health, and context for every request, eliminating implicit network-based trust.

Question 3

Which AWS feature allows you to centrally manage and audit IAM permissions across multiple accounts using permission guardrails?

Accepted Answer

AWS Organizations Service Control Policies

Answer

Service Control Policies in AWS Organizations define maximum permission boundaries that apply across all accounts in an OU, acting as guardrails.

Question 4

An attacker compromises a JWT token that lacks an expiration claim. What vulnerability does this represent?

Accepted Answer

Persistent token that never expires, enabling long-term unauthorized access

Answer

A JWT without an 'exp' claim never expires, so a stolen token grants indefinite unauthorized access until the signing key is rotated.

Question 5

Which cloud IAM concept restricts the maximum permissions a principal can have, even if attached policies grant more?

Accepted Answer

Permission Boundary

Answer

Permission Boundaries define the maximum permissions an IAM entity can have; even if policies grant broader access, the boundary caps what is actually allowed.

(CCSE) Certified Cloud Security Engineer Practice Test

(CCSE) Certified Cloud Security Engineer Practice Test

CCSE Identity & Access Management in Cloud Environments 3