CCSE Identity & Access Management in Cloud Environments 5 — Questions and Answers
Question 1: A security engineer discovers that a third-party SaaS application was granted excessive OAuth scopes including access to all email data. What remediation reduces this risk immediately?
- Reset the user's password
- Revoke the OAuth token or application authorization (Correct answer)
- Disable MFA on the affected account
- Block the SaaS application's IP at the firewall
Correct answer: Revoke the OAuth token or application authorization
Revoking the OAuth token or authorization immediately removes the third-party app's ability to access resources, regardless of its granted scopes.
Question 2: Which AWS IAM feature generates detailed findings about cross-account and external access to resources, helping enforce least-privilege?
- AWS CloudTrail
- AWS IAM Access Analyzer (Correct answer)
- AWS Config
- AWS Security Hub
Correct answer: AWS IAM Access Analyzer
IAM Access Analyzer continuously analyzes resource policies and reports findings where resources are accessible from outside the trusted zone.
Question 3: In OpenID Connect (OIDC), what token type carries identity claims about the authenticated user?
- Access token
- Refresh token
- ID token (Correct answer)
- Bearer token
Correct answer: ID token
The ID token is a signed JWT issued by the authorization server that contains identity claims (sub, email, name) about the authenticated user.
Question 4: An enterprise requires that privileged cloud admin accounts never be used for day-to-day tasks. Which IAM practice enforces this separation?
- Shared admin accounts for all team members
- Separate privileged accounts used only for administrative tasks via just-in-time access (Correct answer)
- Storing admin credentials in a shared password manager
- Granting admin rights to all users and relying on audit logs
Correct answer: Separate privileged accounts used only for administrative tasks via just-in-time access
Maintaining separate privileged accounts used only for elevated tasks reduces exposure of admin credentials and limits blast radius if a daily-use account is compromised.
Question 5: Which cloud IAM concept ensures that two or more individuals must cooperate to perform a sensitive action, preventing unilateral abuse?
- Role rotation
- Separation of duties (Correct answer)
- Permission boundary
- Attribute-based access control
Correct answer: Separation of duties
Separation of duties requires multiple principals to authorize sensitive operations, reducing the risk of insider threat or single-account compromise enabling critical actions.
Question 6: What is the security implication of enabling 'public access' on a cloud storage bucket's ACL?
- Only authenticated IAM users can access the bucket
- Any internet user can read or write bucket contents depending on permissions granted (Correct answer)
- The bucket is only accessible within the cloud provider's network
- MFA is required for all access attempts
Correct answer: Any internet user can read or write bucket contents depending on permissions granted
Setting a storage bucket ACL to public allows unauthenticated access from the internet, exposing all contents to anyone with the bucket URL.
Question 7: Which capability in AWS IAM allows a mobile app to authenticate users via social identity providers (Google, Facebook) and obtain temporary AWS credentials?
- AWS IAM Identity Center
- Amazon Cognito Identity Pools (Correct answer)
- AWS Directory Service
- AWS Security Token Service direct call
Correct answer: Amazon Cognito Identity Pools
Amazon Cognito Identity Pools federate external identity provider tokens and exchange them for short-lived AWS credentials scoped to an IAM role.
CCSE Identity & Access Management in Cloud Environments 5
A security engineer discovers that a third-party SaaS application was granted excessive OAuth scopes including access to all email data.
What remediation reduces this risk immediately?