IAM Policies CERTIFIED-HYBRID-CLOUD-ADMINISTRATOR Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is a recommended practice for maintaining IAM policies over time?

   • AKeep policies unchanged to avoid breaking access
   • BStore policies in a shared document without version control
   • CGrant temporary permissions permanently to avoid re-approval
   • DRegularly review and remove unused policies and permissions
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   When multiple IAM policies apply to a user, how are permissions determined?

   • AThe policy with the most permissions is applied
   • BOnly the first policy in alphabetical order is considered
   • CThe most recently attached policy overrides all others
   • DAll policies are evaluated together, and any explicit Deny overrides any Allow
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A NetApp hybrid cloud administrator is designing IAM policies for a new project. The security team requires that permissions be granted only to the minimum necessary for each role. Which practice best aligns with this requirement?

   • AStart with a permissive policy and gradually remove permissions as users prove they don't need them.
   • BGrant broad permissions to a group and then restrict individual users with explicit denies.
   • CGrant each role the specific actions and resources required for its job, and review policies regularly.
   • DUse a single policy that grants all actions on all resources, and rely on the firewall to block unauthorized access.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A NetApp hybrid cloud administrator is designing IAM policies for a new project. The project has strict compliance requirements that require access to be logged and audited. The administrator wants to ensure that all actions are logged, but also wants to minimize the risk of unauthorized access. Which practice best supports both requirements?

   • AUse inline policies for all users to ensure each user has exactly the permissions they need.
   • BGrant least privilege permissions and enable detailed logging for all IAM actions.
   • CGrant broad permissions and rely on logging to detect unauthorized access.
   • DCreate a single managed policy that grants all permissions and enable logging.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A NetApp hybrid cloud administrator is troubleshooting why a user cannot delete a volume, even though they have a policy that allows 'volume:Delete' on the specific volume. The administrator checks the user's attached policies and finds an inline policy that explicitly denies 'volume:Delete' on all volumes. What is the most likely reason the user cannot delete the volume?

   • AThe explicit deny in the inline policy overrides the allow in the other policy.
   • BThe user does not have permission to list volumes.
   • CThe volume is protected by a snapshot lock.
   • DThe allow policy is not attached to the user's group.
   Reveal Solution Discussion Select an answer first