CCSE Identity & Access Management in Cloud Environments 4 — Questions and Answers
Question 1: In AWS, which resource policy element specifies which identities are allowed to assume a role?
- Permission policy
- Service Control Policy
- Trust policy (Correct answer)
- Session policy
Correct answer: Trust policy
The trust policy (role's assume-role-policy-document) defines which principals are permitted to call sts:AssumeRole for that role.
Question 2: An organization deploys a multi-cloud strategy. Which identity standard enables seamless SSO across AWS, Azure, and GCP without managing separate credentials?
- LDAP directory synchronization
- SAML 2.0 or OIDC federation with a central IdP (Correct answer)
- Separate IAM users in each cloud provider
- VPN-based identity bridging
Correct answer: SAML 2.0 or OIDC federation with a central IdP
SAML 2.0 or OIDC federation with a central IdP (e.g., Okta, Azure AD) allows users to authenticate once and be federated into each cloud provider.
Question 3: Which Google Cloud IAM role type provides a minimal set of curated permissions for a specific service action, following least privilege?
- Basic role
- Primitive role
- Custom role
- Predefined role (Correct answer)
Correct answer: Predefined role
Predefined roles are managed by Google and grant only the permissions needed for specific tasks, unlike basic/primitive roles which are overly broad.
Question 4: What is a key security risk of long-lived IAM access keys compared to temporary credentials?
- They require more API calls to use
- They cannot be used for programmatic access
- They remain valid indefinitely unless manually rotated, increasing exposure window (Correct answer)
- They do not support MFA enforcement
Correct answer: They remain valid indefinitely unless manually rotated, increasing exposure window
Long-lived access keys do not expire automatically, so a compromised key provides persistent access until it is manually rotated or deleted.
Question 5: During a cloud security review, you find an IAM role with 'Effect: Allow, Action: *, Resource: *'. What risk does this create?
- The role can only be assumed by AWS services
- The role grants full administrative access to all resources (Correct answer)
- The role is restricted to read-only operations
- The role applies only within a single AWS region
Correct answer: The role grants full administrative access to all resources
Wildcards on both Action and Resource grant unrestricted access to every AWS service and resource, creating a critical over-privilege risk.
Question 6: Which authentication method uses cryptographic keys stored on a hardware token to resist phishing attacks?
- TOTP-based authenticator app
- SMS one-time password
- FIDO2/WebAuthn hardware security key (Correct answer)
- Email magic link
Correct answer: FIDO2/WebAuthn hardware security key
FIDO2/WebAuthn uses public-key cryptography with hardware-bound private keys, making credentials both phishing-resistant and device-bound.
Question 7: What does 'attribute-based access control' (ABAC) use to make authorization decisions in cloud IAM?
- Predefined role hierarchies assigned at account creation
- Static IP address allowlists
- Tags or attributes on both the principal and the resource (Correct answer)
- Network segment membership
Correct answer: Tags or attributes on both the principal and the resource
ABAC evaluates attributes (such as AWS tags) on the requesting principal and target resource to dynamically determine access, enabling fine-grained and scalable policies.
CCSE Identity & Access Management in Cloud Environments 4
In AWS, which resource policy element specifies which identities are allowed to assume a role?