1.4 Explain the Configuration and Management Lifecycle of User Identity, Roles, Permissions, and Access Controls Within a Cortex Tenant (e.g., Scope-Based Access Control [SBAC], Custom Role-Based Access Control [RBAC] Roles, API Keys) CLOUD-SECURITY-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An administrator discovers that an API key used by a third-party integration has been exposed in a public code repository. What is the immediate action the administrator should take?

   • AChange the permissions of the API key to read-only.
   • BMonitor the API key for unusual activity.
   • CRotate the API key by creating a new one and updating the integration.
   • DDisable the API key and re-enable it after a few hours.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following can be configured when creating a custom RBAC role in Cortex?

   • AThe user's email notification preferences
   • BThe user's password policy
   • CThe tenant's data retention period
   • DSpecific permissions such as view, create, edit, or delete on various resources
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What does Scope-Based Access Control (SBAC) restrict in a Cortex tenant?

   • AThe data a user can access, such as specific folders or datasets
   • BThe number of API calls a user can make per hour
   • CThe network IP addresses from which a user can access the tenant
   • DThe type of authentication method used to log in
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   When should an API key be revoked in Cortex?

   • AWhen the user changes their password
   • BWhen the user logs in from a new device
   • CWhen the key has been used more than 100 times
   • DWhen the associated user leaves the organization or the key is compromised
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A Cortex tenant has multiple folders: 'Finance', 'HR', and 'Marketing'. A new analyst needs read-only access to the 'Finance' folder only. The analyst is a member of the 'Analysts' group, which currently has a role that grants read access to all folders. What is the most appropriate configuration to meet the requirement?

   • ACreate a new folder named 'Finance' and move the analyst's user account into that folder.
   • BCreate a custom role with read-only permissions and assign it to the analyst with a scope limited to the 'Finance' folder.
   • CAssign the existing 'Analysts' role to the analyst, but change the role's scope to 'Finance' only.
   • DAssign the 'Analysts' group a new role that has read access to all folders, and add the analyst to that group.
   Reveal Solution Discussion Select an answer first