CCSK Identity and Access Management in Cloud 2 — Questions and Answers
Question 1: What is 'identity sprawl' in cloud environments and why is it a security concern?
- The growth of cloud storage capacity over time
- The proliferation of unmanaged identities across multiple cloud services, creating governance blind spots (Correct answer)
- The spread of encryption keys across multiple providers
- The expansion of network access rules across cloud regions
Correct answer: The proliferation of unmanaged identities across multiple cloud services, creating governance blind spots
Identity sprawl occurs when identities multiply across cloud services without central governance, making it difficult to track, manage, and revoke access.
Question 2: According to CCSK, what is the significance of the 'principle of least privilege' in cloud IAM?
- Users should only receive the minimum access necessary to perform their job functions (Correct answer)
- Cloud providers should limit the number of user accounts they host
- Organizations should minimize the number of cloud services they subscribe to
- Encryption keys should be as short as possible to reduce processing overhead
Correct answer: Users should only receive the minimum access necessary to perform their job functions
Least privilege limits the potential damage of compromised credentials by ensuring each identity has only the permissions needed for its specific tasks.
Question 3: What is 'OAuth 2.0' and how is it relevant to CCSK cloud security?
- A symmetric encryption standard for cloud data
- An authorization framework that allows third-party applications to access resources on behalf of users without exposing credentials (Correct answer)
- A network protocol for securing cloud API endpoints
- A certificate standard for cloud TLS connections
Correct answer: An authorization framework that allows third-party applications to access resources on behalf of users without exposing credentials
OAuth 2.0 enables delegated authorization — applications obtain scoped access tokens without the user's credentials being shared with the third party.
Question 4: What is 'SAML' and what role does it play in cloud federated identity?
- Security Assertion Markup Language; it enables SSO by passing authentication assertions between identity and service providers (Correct answer)
- Secure Access Management Layer; it encrypts cloud management API calls
- System Access Monitoring Language; it logs cloud user activity
- Service Account Management Library; it manages cloud service accounts
Correct answer: Security Assertion Markup Language; it enables SSO by passing authentication assertions between identity and service providers
SAML is an XML-based standard for exchanging authentication and authorization data, enabling single sign-on between an identity provider and cloud service providers.
Question 5: In CCSK, what is the recommended practice for managing dormant or unused cloud accounts?
- Keep them active in case users return
- Regularly audit and disable or delete accounts that have been inactive beyond a defined threshold (Correct answer)
- Assign dormant accounts to other users to avoid reprovisioning
- Change their passwords quarterly and leave them active
Correct answer: Regularly audit and disable or delete accounts that have been inactive beyond a defined threshold
Dormant accounts represent unnecessary risk; regular access reviews and removal of unused accounts reduces the attack surface.
Question 6: What is a 'permission boundary' in cloud IAM and how does it support security?
- A firewall rule that limits network access per identity
- A policy that sets the maximum permissions an identity can receive, regardless of other policies attached (Correct answer)
- A compliance requirement defining minimum access rights for auditors
- A threshold that triggers MFA when exceeded
Correct answer: A policy that sets the maximum permissions an identity can receive, regardless of other policies attached
Permission boundaries cap the maximum effective permissions for an identity, preventing privilege escalation even if other permissive policies are attached.
CCSK Identity and Access Management in Cloud 2
What is 'identity sprawl' in cloud environments and why is it a security concern?