Identify the Access Control Required to Implement Data Permissions for ECS Client Access ECS-DESIGN Practice Questions (Page 2)

Questions 6–10

1. 6application · easy

   A user needs to be able to delete objects in a bucket but not delete the bucket itself. Which permission should be granted?

   • AFull control on the bucket
   • Bs3:PutObject permission
   • Cs3:DeleteBucket permission
   • Ds3:DeleteObject permission on the bucket
   Reveal Solution Discussion Select an answer first
2. 7application · easy

   A security audit recommends that ECS access be restricted to the principle of least privilege. Which practice should be implemented?

   • AGrant users only the permissions necessary for their job functions
   • BUse the same credentials for all users
   • CGrant all users full control to simplify management
   • DDisable all access controls to avoid misconfiguration
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A user is able to list objects in a bucket but cannot read the contents of any object. The bucket policy grants s3:ListBucket and s3:GetObject permissions. The object ACLs do not grant read access to the user. What is the most likely reason for this behavior?

   • AThe bucket policy does not actually grant s3:GetObject
   • BThe object ACLs deny read access, overriding the bucket policy allow
   • CThe user is not authenticated
   • DThe user does not have permission to list objects
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   How are ECS users and groups typically created and managed?

   • AAutomatically by the ECS system when a new bucket is created
   • BThrough the ECS management UI, REST API, or command-line interface
   • CBy editing configuration files on each ECS node
   • DOnly through the ECS command-line interface (CLI)
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   An administrator needs to grant a contractor temporary access to a specific bucket for one week. The contractor does not have an account in the corporate LDAP. What is the most appropriate way to provide access?

   • AShare the credentials of an existing user
   • BAdd the contractor to the corporate LDAP directory
   • CGrant the contractor full control over all buckets
   • DCreate a temporary ECS user with a bucket policy that expires after one week
   Reveal Solution Discussion Select an answer first