CCSE Identity & Access Management in Cloud Environments 4

Question 1

In AWS, which resource policy element specifies which identities are allowed to assume a role?

Accepted Answer

Trust policy

Answer

The trust policy (role's assume-role-policy-document) defines which principals are permitted to call sts:AssumeRole for that role.

Question 2

An organization deploys a multi-cloud strategy. Which identity standard enables seamless SSO across AWS, Azure, and GCP without managing separate credentials?

Accepted Answer

SAML 2.0 or OIDC federation with a central IdP

Answer

SAML 2.0 or OIDC federation with a central IdP (e.g., Okta, Azure AD) allows users to authenticate once and be federated into each cloud provider.

Question 3

Which Google Cloud IAM role type provides a minimal set of curated permissions for a specific service action, following least privilege?

Accepted Answer

Predefined role

Answer

Predefined roles are managed by Google and grant only the permissions needed for specific tasks, unlike basic/primitive roles which are overly broad.

Question 4

What is a key security risk of long-lived IAM access keys compared to temporary credentials?

Accepted Answer

They remain valid indefinitely unless manually rotated, increasing exposure window

Answer

Long-lived access keys do not expire automatically, so a compromised key provides persistent access until it is manually rotated or deleted.

Question 5

During a cloud security review, you find an IAM role with 'Effect: Allow, Action: *, Resource: *'. What risk does this create?

Accepted Answer

The role grants full administrative access to all resources

Answer

Wildcards on both Action and Resource grant unrestricted access to every AWS service and resource, creating a critical over-privilege risk.

(CCSE) Certified Cloud Security Engineer Practice Test

(CCSE) Certified Cloud Security Engineer Practice Test

CCSE Identity & Access Management in Cloud Environments 4