Multifactor Authentication and Least Privilege CSE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A cloud admin is configuring access for a new employee who will manage virtual machines in a specific project. The employee should be able to start, stop, and restart VMs, but not delete them or modify network settings. What is the best way to grant these permissions?

   • AGive the employee direct IAM permissions on each VM individually
   • BGrant the employee the Owner role on the project
   • CCreate a custom role with only the required VM start, stop, and restart permissions and assign it to the employee
   • DAssign the built-in VM Operator role on the project
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Which scenario best illustrates the value of multifactor authentication in a cloud environment?

   • AA user's password is stolen, but the attacker cannot access the account because they lack the one-time code sent to the user's phone
   • BA user's laptop is encrypted, preventing data theft if the device is lost
   • CA user's session is terminated after a period of inactivity
   • DA user's account is locked after multiple failed login attempts
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A company has a team of database administrators who need full access to the production database only during maintenance windows. Outside those windows, they should have no access. Which approach enforces least privilege while accommodating the maintenance need?

   • AUse just-in-time (JIT) access to grant the database admin role only during scheduled maintenance windows
   • BCreate a separate maintenance account with permanent admin rights for all databases
   • CPermanently assign the database admin role to the team
   • DProvide the team with the root account credentials to use during maintenance
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   In cloud RBAC, what is the primary benefit of assigning permissions to roles rather than to individual users?

   • AIt eliminates the need for periodic access reviews
   • BIt allows users to have unlimited permissions as long as they are in a role
   • CIt simplifies permission management and ensures consistency across users with similar job functions
   • DIt automatically grants permissions based on the user's email domain
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   How do MFA and least privilege complement each other in a defense-in-depth strategy?

   • AMFA verifies identity, while least privilege limits what that identity can do
   • BThey both only apply to administrative accounts
   • CLeast privilege makes MFA unnecessary
   • DMFA replaces the need for least privilege
   Reveal Solution Discussion Select an answer first