IAM Fundamentals, Principals, and Roles CSE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A cloud security team needs to grant a third-party auditor temporary read-only access to audit logs in an AWS account. The auditor does not have an identity in the company's identity provider. Which approach should the team use?

   • ACreate an IAM role with a read-only policy and a trust policy that allows the auditor's external account to assume it.
   • BShare the root account credentials with the auditor for the duration of the audit.
   • CCreate an IAM user for the auditor with a long-term access key and attach a read-only policy.
   • DAttach a read-only policy directly to the auditor's external account.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company has a policy that only the 'DatabaseAdmin' role can modify production database settings. A user in the 'Developer' group needs to occasionally view database configuration but not modify it. What should the IAM administrator do?

   • ACreate a 'DatabaseViewer' role with read-only permissions and allow the user to assume it when needed.
   • BAttach a read-only policy directly to the user's account.
   • CGive the user the 'DatabaseAdmin' role and rely on the user to be careful.
   • DAdd the user to the 'DatabaseAdmin' group temporarily whenever they need to view configuration.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   An organization has a compliance requirement that no single user can both approve and execute changes to production infrastructure. They use RBAC. Which configuration enforces this separation of duties?

   • ACreate a single 'ChangeManager' role that includes both approve and execute permissions.
   • BUse a single role and rely on the change management process to prevent misuse.
   • CCreate a 'ChangeApprover' role and a 'ChangeExecutor' role, and ensure no user is assigned to both roles.
   • DAssign all users to a 'ProductionAdmin' group that has both permissions.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security auditor recommends that no single user should have both the ability to create new IAM users and the ability to delete IAM users. Which IAM best practice does this recommendation primarily address?

   • ACredential rotation
   • BRole separation
   • CMulti-factor authentication
   • DLeast privilege
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A developer requests full administrator access to all cloud resources to 'make things easier.' The security team wants to follow the principle of least privilege. What is the best response?

   • ACreate a custom role with only the permissions the developer needs for their current projects and grant that role.
   • BDeny the request and require the developer to submit a detailed justification for each permission they need.
   • CGrant the developer read-only access to all resources and let them request more if needed.
   • DGrant the developer full administrator access because they asked for it and it will speed up their work.
   Reveal Solution Discussion Select an answer first