CCSK Identity and Access Management in Cloud

Question 1

What is 'federated identity' in the context of CCSK cloud security?

Accepted Answer

Using a single identity across multiple systems through trust relationships between identity providers

Answer

Creating separate user accounts in each cloud provider

Answer

A government-issued digital identity for cloud access

Answer

Encrypting user credentials before cloud transmission

Question 2

In CCSK, what is the recommended approach to privileged access management (PAM) in cloud environments?

Accepted Answer

Use just-in-time (JIT) privilege elevation with full audit logging of privileged sessions

Answer

Grant permanent admin access to all cloud engineers for efficiency

Answer

Share admin credentials across team members to simplify management

Answer

Disable MFA for privileged accounts to avoid lockouts

Question 3

What does CCSK identify as the primary risk of using long-lived API keys for cloud service authentication?

Accepted Answer

Long-lived keys increase the window of exposure if compromised and are often not rotated properly

Answer

API keys reduce application performance

Answer

API keys cannot be used with MFA

Answer

Long-lived keys are incompatible with cloud IAM systems

Question 4

What is 'attribute-based access control' (ABAC) and how does it enhance cloud IAM?

Accepted Answer

Access control that uses user attributes (department, location, device) to make fine-grained access decisions

Answer

Access control based solely on user roles defined at provisioning

Answer

A method of encrypting access tokens using user attributes

Answer

Access control limited to object storage permissions

Question 5

According to CCSK, why is MFA (multi-factor authentication) especially critical for cloud management consoles?

Accepted Answer

Because management consoles provide broad control over all cloud resources, making them high-value targets

Answer

Because cloud providers require it by contract

Answer

Because MFA speeds up cloud provisioning processes

Answer

Because cloud consoles cannot use password authentication

Question 6

What is the purpose of 'service accounts' in cloud IAM and what is a common security mistake associated with them?

Accepted Answer

Service accounts provide machine-to-machine authentication; the mistake is granting them excessive permissions or using them interactively

Answer

Service accounts store encryption keys; the mistake is not rotating them monthly

Answer

Service accounts are for human users; the mistake is sharing them between services

Answer

Service accounts manage billing; the mistake is not auditing billing reports