CCSE Identity & Access Management in Cloud Environments 5

Question 1

A security engineer discovers that a third-party SaaS application was granted excessive OAuth scopes including access to all email data. What remediation reduces this risk immediately?

Accepted Answer

Revoke the OAuth token or application authorization

Answer

Revoking the OAuth token or authorization immediately removes the third-party app's ability to access resources, regardless of its granted scopes.

Question 2

Which AWS IAM feature generates detailed findings about cross-account and external access to resources, helping enforce least-privilege?

Accepted Answer

AWS IAM Access Analyzer

Answer

IAM Access Analyzer continuously analyzes resource policies and reports findings where resources are accessible from outside the trusted zone.

Question 3

In OpenID Connect (OIDC), what token type carries identity claims about the authenticated user?

Accepted Answer

ID token

Answer

The ID token is a signed JWT issued by the authorization server that contains identity claims (sub, email, name) about the authenticated user.

Question 4

An enterprise requires that privileged cloud admin accounts never be used for day-to-day tasks. Which IAM practice enforces this separation?

Accepted Answer

Separate privileged accounts used only for administrative tasks via just-in-time access

Answer

Maintaining separate privileged accounts used only for elevated tasks reduces exposure of admin credentials and limits blast radius if a daily-use account is compromised.

Question 5

Which cloud IAM concept ensures that two or more individuals must cooperate to perform a sensitive action, preventing unilateral abuse?

Accepted Answer

Separation of duties

Answer

Separation of duties requires multiple principals to authorize sensitive operations, reducing the risk of insider threat or single-account compromise enabling critical actions.

(CCSE) Certified Cloud Security Engineer Practice Test

(CCSE) Certified Cloud Security Engineer Practice Test

CCSE Identity & Access Management in Cloud Environments 5