An organization is implementing MFA for a remote workforce. They are concerned about phishing attacks that trick users into approving fraudulent push notifications. Which MFA method should they deploy to specifically address this concern?

Push notifications with number matching

A cloud administrator is setting up a new project for a data analytics team. The team only needs to read data from a specific storage bucket and write results to another bucket. They do not need to manage any cloud resources. What is the most appropriate way to apply least privilege?

Assign the team the built-in Owner role on the project

Create a custom role with read access to the source bucket and write access to the destination bucket, then assign it to the team

Grant each team member individual permissions directly on the buckets

Assign the built-in Viewer role to the team

Which of the following correctly pairs an authentication factor with an example?

Knowledge factor: a fingerprint scan

Possession factor: a one-time password generated by a hardware token

A company is implementing a zero-trust model for cloud access. They want to ensure that every access request is authenticated and authorized, and that users have the minimum necessary permissions. They are considering using conditional access policies, MFA, and JIT access. Which combination best implements zero-trust principles?

Use conditional access policies only, without MFA

Require MFA only for privileged users and grant all users broad access

Implement JIT access for all users, but do not use conditional access policies

Require MFA for all access, use conditional access policies to evaluate risk, and implement JIT access for privileged roles

A company uses RBAC in its cloud environment. A developer needs to deploy code to a test environment but should not have access to production. Which RBAC approach should the administrator use?

Assign the developer the built-in Contributor role at the subscription level

Add the developer to the global administrators group

Give the developer the same role as the production operations team

Assign the developer a custom role with deploy permissions scoped to the test environment only

EC-CouncilCloud Security Essentials

Domain 2Objective 4

Multifactor Authentication and Least Privilege CSE Practice Questions (Page 6)

Part of the Identity and Access Management in the Cloud domain, which makes up ~12% of our current practice bank.

50questions here

10free pages

8concepts

Questions 26–30

26application · medium
An organization is implementing MFA for a remote workforce. They are concerned about phishing attacks that trick users into approving fraudulent push notifications. Which MFA method should they deploy to specifically address this concern?
Select an answer first
27application · medium
A cloud administrator is setting up a new project for a data analytics team. The team only needs to read data from a specific storage bucket and write results to another bucket. They do not need to manage any cloud resources. What is the most appropriate way to apply least privilege?
Select an answer first
28foundation · easy
Which of the following correctly pairs an authentication factor with an example?
Select an answer first
29expert · hard
A company is implementing a zero-trust model for cloud access. They want to ensure that every access request is authenticated and authorized, and that users have the minimum necessary permissions. They are considering using conditional access policies, MFA, and JIT access. Which combination best implements zero-trust principles?
Select an answer first
30application · medium
A company uses RBAC in its cloud environment. A developer needs to deploy code to a test environment but should not have access to production. Which RBAC approach should the administrator use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSE” is a trademark of its owner, used for identification only.