Role-Based Access Control (RBAC) CSE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A financial services company requires that no single user can both create a vendor invoice and approve payment for that invoice. The company uses a cloud RBAC system. Which RBAC configuration best enforces this requirement?

   • AAssign the create permission to all finance users and the approve permission only to senior finance users.
   • BCreate a single role with both create and approve permissions, but require a second approval from a manager.
   • CCreate two separate roles, Invoice Creator and Invoice Approver, and ensure no user is assigned both roles.
   • DUse a role hierarchy where the Invoice Approver role inherits from the Invoice Creator role.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A cloud architect is explaining RBAC to a new team member. The team member asks: 'When a user logs in and performs an action, what determines whether the action is allowed?' Which answer correctly describes the RBAC decision process?

   • AThe resource owner decides on each access request at the time it is made.
   • BThe user's active session combines permissions from all roles assigned to the user, and the action is allowed if any of those permissions match the action.
   • CThe system checks the user's security clearance against the resource's security label.
   • DThe user's manager must approve each action before it is executed.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A cloud security team is onboarding a new DevOps engineer who will only manage CI/CD pipeline configurations in a single project. The engineer should not be able to view or modify any other project's resources. The team wants to follow least privilege while keeping administrative overhead low. Which approach should the team take?

   • AAssign the engineer a custom role with only pipeline-configuration permissions scoped to that single project.
   • BAssign the engineer the built-in Viewer role at the organization level.
   • CCreate a group for all DevOps engineers and assign the group the pipeline role at the folder level.
   • DAssign the engineer the built-in Editor role scoped to that single project.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following is a best practice for designing RBAC policies in a cloud environment?

   • AUse the principle of least privilege and regularly review role assignments.
   • BCreate a new role for each individual user to ensure customization.
   • CAvoid using roles and assign permissions directly to users for better control.
   • DAssign the same broad role to all users to simplify management.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company is migrating from AWS to Azure. In AWS, they use IAM roles attached to EC2 instances to grant the instances permissions to access S3. The team wants the equivalent behavior in Azure for a VM accessing Azure Storage. Which Azure RBAC mechanism should they use?

   • ACreate a user account for the VM and assign it the Storage Blob Data Reader role.
   • BAssign a managed identity to the VM and grant that identity the Storage Blob Data Reader role on the storage account.
   • CCreate a service principal and store its credentials in the VM's configuration file.
   • DAssign the VM's private IP address the Storage Blob Data Reader role.
   Reveal Solution Discussion Select an answer first