CCSK Identity and Access Management in Cloud 1 — Questions and Answers
Question 1: What is 'federated identity' in the context of CCSK cloud security?
- Creating separate user accounts in each cloud provider
- Using a single identity across multiple systems through trust relationships between identity providers (Correct answer)
- A government-issued digital identity for cloud access
- Encrypting user credentials before cloud transmission
Correct answer: Using a single identity across multiple systems through trust relationships between identity providers
Federated identity allows a single identity (from an IdP) to be trusted across multiple systems or cloud providers without separate credential sets.
Question 2: In CCSK, what is the recommended approach to privileged access management (PAM) in cloud environments?
- Grant permanent admin access to all cloud engineers for efficiency
- Use just-in-time (JIT) privilege elevation with full audit logging of privileged sessions (Correct answer)
- Share admin credentials across team members to simplify management
- Disable MFA for privileged accounts to avoid lockouts
Correct answer: Use just-in-time (JIT) privilege elevation with full audit logging of privileged sessions
JIT privilege elevation grants elevated access only when needed and for a limited time, minimizing the window of exposure for privileged credentials.
Question 3: What does CCSK identify as the primary risk of using long-lived API keys for cloud service authentication?
- API keys reduce application performance
- Long-lived keys increase the window of exposure if compromised and are often not rotated properly (Correct answer)
- API keys cannot be used with MFA
- Long-lived keys are incompatible with cloud IAM systems
Correct answer: Long-lived keys increase the window of exposure if compromised and are often not rotated properly
Long-lived API keys that are never rotated represent a persistent credential risk — if leaked, they provide indefinite unauthorized access.
Question 4: What is 'attribute-based access control' (ABAC) and how does it enhance cloud IAM?
- Access control based solely on user roles defined at provisioning
- Access control that uses user attributes (department, location, device) to make fine-grained access decisions (Correct answer)
- A method of encrypting access tokens using user attributes
- Access control limited to object storage permissions
Correct answer: Access control that uses user attributes (department, location, device) to make fine-grained access decisions
ABAC evaluates multiple attributes of the user, environment, and resource to make dynamic, context-aware access control decisions beyond simple role assignments.
Question 5: According to CCSK, why is MFA (multi-factor authentication) especially critical for cloud management consoles?
- Because cloud providers require it by contract
- Because management consoles provide broad control over all cloud resources, making them high-value targets (Correct answer)
- Because MFA speeds up cloud provisioning processes
- Because cloud consoles cannot use password authentication
Correct answer: Because management consoles provide broad control over all cloud resources, making them high-value targets
Cloud management consoles grant access to provision, modify, or delete infrastructure — a single compromised credential could give attackers control of the entire environment.
Question 6: What is the purpose of 'service accounts' in cloud IAM and what is a common security mistake associated with them?
- Service accounts store encryption keys; the mistake is not rotating them monthly
- Service accounts provide machine-to-machine authentication; the mistake is granting them excessive permissions or using them interactively (Correct answer)
- Service accounts are for human users; the mistake is sharing them between services
- Service accounts manage billing; the mistake is not auditing billing reports
Correct answer: Service accounts provide machine-to-machine authentication; the mistake is granting them excessive permissions or using them interactively
Service accounts authenticate non-human workloads, but they are often over-privileged or misused as human accounts, creating unnecessary security risk.
CCSK Identity and Access Management in Cloud 1
What is 'federated identity' in the context of CCSK cloud security?