1.02 Apply Concepts Related to Cloud Identity Access Management Technologies 402 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following is an example of a 'something you have' factor in MFA?

   • AA one-time code generated by an authenticator app on a smartphone
   • BA password
   • CA security question answer
   • DA fingerprint scan
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An administrator is writing an IAM policy to allow a service account to list objects in a specific bucket, but only if the request originates from a specific VPC network. Which policy element is essential to enforce this constraint?

   • AA condition block that checks the source IP address or VPC network
   • BA principal block that specifies the service account
   • CAn action block that includes 'storage.objects.list'
   • DA resource block that specifies the bucket name
   Reveal Solution Discussion Select an answer first
4. 18application · easy

   A cloud administrator is designing access for a new project. The team wants to ensure that each user has only the permissions necessary to perform their job. Which principle should guide the assignment of IAM roles?

   • APrinciple of least privilege
   • BFail-safe defaults
   • CDefense in depth
   • DSeparation of duties
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company has a large number of temporary contractors who need access to a cloud environment for short periods. The security team wants to automate the provisioning and deprovisioning of these identities to reduce manual effort and ensure timely revocation. Which approach is most effective?

   • AGrant contractors access to the cloud environment via a guest user account that never expires.
   • BUse an identity lifecycle management tool that integrates with the HR system and automatically creates and deletes accounts based on contract dates.
   • CManually create accounts for each contractor and set a calendar reminder to delete them when the contract ends.
   • DCreate a single shared account for all contractors and change the password frequently.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the primary purpose of a service account in cloud IAM?

   • ATo provide a human user with a second set of credentials for backup access.
   • BTo allow multiple users to share a single login for convenience.
   • CTo grant permissions to an application or service rather than to an individual human user.
   • DTo store encrypted passwords for all users in the organization.
   Reveal Solution Discussion Select an answer first