Identify the Access Control Required to Implement Data Permissions for ECS Client Access ECS-DESIGN Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An organization requires that all ECS client access be authenticated using temporary credentials that are automatically rotated. Which authentication mechanism should be used?

   • AIAM roles with temporary security credentials
   • BClient certificates with long validity
   • CStatic access keys for each user
   • DLDAP authentication with user passwords
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company has a bucket with objects that should be readable by all authenticated users in the company, but only writable by a specific group. Which configuration should be used?

   • ABucket policy granting full control to all authenticated users
   • BIAM roles with read and write permissions for all users
   • CBucket policy granting read access to all authenticated users and write access to the specific group
   • DObject ACLs granting read to all and write to the group
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company is designing its ECS access control strategy. They have a mix of internal users, external partners, and automated applications. They want to minimize administrative overhead while maintaining strong security. Which approach best balances these requirements?

   • AUse only bucket policies for all access
   • BUse ACLs for all access to provide fine-grained control
   • CGrant all users full control to simplify management
   • DUse RBAC with groups for internal users, bucket policies for partners, and IAM roles for applications
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security team requires that a specific object be readable by a select group of users, but the bucket policy currently denies all access to that object. The object ACL allows read access for the group. What must be done to allow the group to read the object?

   • AModify the bucket policy to allow read access for the group
   • BModify the object ACL to allow read access for the group
   • CRemove the group from the bucket policy deny
   • DCreate a new bucket with a permissive policy
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company wants to allow its employees to access ECS using their existing corporate single sign-on (SSO) credentials. Which authentication mechanism should be integrated?

   • AIAM roles with temporary credentials
   • BStatic access keys for each employee
   • CLDAP integration with Active Directory
   • DClient certificates for each employee
   Reveal Solution Discussion Select an answer first