Role-Based Access Control (RBAC) CSE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company is migrating to a cloud environment and wants to implement least privilege. They have a large number of existing users and roles. The security team wants to identify over-privileged roles and reduce permissions without breaking operations. Which approach is most effective?

   • AAssign all users the 'Owner' role temporarily and then gradually remove permissions.
   • BManually review each role and remove permissions that seem unnecessary.
   • CCreate a new role with minimal permissions and assign it to all users, then add permissions as users complain.
   • DUse cloud provider tools like AWS IAM Access Analyzer or Azure AD Privileged Identity Management to review role usage and generate least-privilege policies.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company uses both AWS and Google Cloud. In AWS, they use IAM policies attached to IAM roles. In Google Cloud, they use IAM roles with policies. The team wants to grant a user read-only access to a specific S3 bucket in AWS and a specific Cloud Storage bucket in Google Cloud. What is the correct approach in each provider?

   • AIn AWS, use a resource-based policy on the bucket; in Google Cloud, use a custom role with only the storage.objects.get permission.
   • BIn AWS, create a bucket policy that grants read access to the user; in Google Cloud, create a bucket IAM policy that grants read access to the user.
   • CIn AWS, create an IAM policy for the bucket and attach it to a role; in Google Cloud, assign the Storage Object Viewer role at the bucket level.
   • DIn AWS, assign the AmazonS3ReadOnlyAccess managed policy directly to the user; in Google Cloud, assign the Storage Object Viewer role to the user.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An organization is reviewing its cloud RBAC design. They find that several users have both the 'Storage Account Contributor' and 'Storage Blob Data Owner' roles on the same storage account. What is the primary security concern with this configuration?

   • AThe combination grants both management and data-plane access, which could allow a user to delete the storage account and its data.
   • BThe combination prevents the user from being assigned any other roles.
   • CThe combination grants read access to all storage accounts in the subscription.
   • DThe combination is redundant because both roles provide the same permissions.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the purpose of a role hierarchy in RBAC?

   • ATo create a strict separation of duties between different roles.
   • BTo assign different priorities to roles so that some roles override others.
   • CTo allow roles to inherit permissions from parent roles, reducing redundancy.
   • DTo limit the number of roles that can be assigned to a single user.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   In RBAC, what is the relationship between a session and a user?

   • AA session is the same as a user account and persists until the user is deleted.
   • BA session is a role that a user can assume without being assigned to it.
   • CA session is a collection of permissions that a user can use without authentication.
   • DA session is created when a user authenticates and activates a subset of the roles assigned to them.
   Reveal Solution Discussion Select an answer first