I85PREP
⌘ K
CCAS study materials
CCAS study resources

CCAS practice questions

One question at a time. Build your CCAS understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cloud Application Architecture and Design Security

A security architect is mapping the shared responsibility model for an IaaS deployment. Which control remains the customer's responsibility regardless of the provider?

  1. Hypervisor patching
  2. Network backbone redundancy
  3. Physical security of the data center
  4. Identity and access management configuration Correct answer.

Explanation

In IaaS the provider secures the physical facilities, hypervisor, and underlying network, while the customer retains control of guest operating systems, applications, and identity configuration. IAM policy design determines who can reach cloud resources and is never delegated to the provider.

Question 2Cloud Application Architecture and Design Security

Which cloud deployment model places infrastructure on customer premises while still using provider-managed orchestration software?

  1. Public cloud
  2. Private cloud Correct answer.
  3. Hybrid cloud
  4. Community cloud

Explanation

A private cloud is provisioned for exclusive use by a single organization and may be hosted on premises while still employing cloud-style automation and orchestration. Exclusivity of the infrastructure, not its physical location, is the defining characteristic.

Question 3Cloud Application Architecture and Design Security

An application team needs to store encryption keys so that even the cloud provider cannot read them. Which key management approach satisfies this requirement?

  1. TLS termination at the provider edge
  2. Client-side encryption with keys held in an external HSM Correct answer.
  3. Provider-managed server-side encryption with periodic rotation
  4. Customer-managed keys stored in the provider's KMS

Explanation

Only client-side encryption with keys retained outside the provider's control ensures the provider cannot decrypt the data. Provider-managed and customer-managed KMS keys still reside within infrastructure the provider operates.

Question 4Cloud Application Architecture and Design Security

A design review flags that a web tier can reach the database tier on all ports. Which control most directly enforces least privilege between these tiers?

  1. Security groups scoped to the application port and source security group Correct answer.
  2. Encryption of the database storage volume
  3. A web application firewall in front of the load balancer
  4. Multi-factor authentication on the database administrator account

Explanation

Security groups that permit only the application port and reference the web tier's security group as the source implement network-level least privilege between tiers. A WAF, MFA, and storage encryption address different threats and do not restrict tier-to-tier traffic.

Question 5Cloud Application Architecture and Design Security

Which practice best protects long-lived cloud access keys used by a CI/CD pipeline?

  1. Embedding them in the pipeline configuration file
  2. Rotating them once every two years
  3. Storing them in a private Git repository
  4. Replacing them with short-lived tokens from an identity federation Correct answer.

Explanation

Workload identity federation issues short-lived credentials scoped to the pipeline, eliminating static secrets that can leak. Long-lived keys stored in configuration or repositories remain exposed for their entire lifetime.

Question 6Cloud Application Architecture and Design Security

A regulated workload requires that data at rest be unreadable to the cloud operator. Which design element is essential?

  1. Field-level masking applied in the reporting layer
  2. Server-side encryption using provider-managed keys
  3. Envelope encryption with keys held in a customer-controlled HSM Correct answer.
  4. TLS 1.3 on all internal service calls

Explanation

Envelope encryption with a customer-controlled root of trust keeps the data encryption key wrapped by a key the provider cannot access. Masking and transport encryption do not prevent the operator from reading stored plaintext.

Question 7Cloud Application Architecture and Design Security

Which architecture pattern most reduces the blast radius of a compromised workload?

  1. A flat network with a perimeter firewall only
  2. Shared service accounts across workloads
  3. A single shared VPC for all environments
  4. Microsegmentation with per-workload identities and policies Correct answer.

Explanation

Microsegmentation combined with distinct per-workload identities limits lateral movement because a compromised instance holds only its own narrow permissions. Flat networks and shared accounts let an attacker pivot broadly.

Question 8Cloud Application Architecture and Design Security

Which logging design best supports forensic investigation of a compromised cloud account?

  1. Audit logs shipped to a separate, immutable logging account Correct answer.
  2. Host logs retained only on the affected instance
  3. Application logs written to the same account's object storage
  4. Debug output streamed to the console

Explanation

Shipping audit logs to a separate account with write-once retention prevents an attacker who compromises the workload account from deleting evidence. Local and same-account logs are vulnerable to tampering.

Question 9Cloud Application Architecture and Design Security

A serverless function processes untrusted uploads. Which control most directly limits the impact of a function-level vulnerability?

  1. A per-function execution role with minimal permissions Correct answer.
  2. A longer function timeout
  3. Verbose error messages returned to callers
  4. Deployment to a single availability zone

Explanation

A narrowly scoped execution role caps what a compromised function can do, since the function can only act within its granted permissions. Timeout, placement, and error verbosity do not constrain the function's authority.

Question 10Cloud Application Architecture and Design Security

Which control prevents an attacker from reusing a stolen session token after the legitimate user logs out?

  1. Encoding tokens in the URL query string
  2. Token revocation with short validity and rotation Correct answer.
  3. Storing tokens in browser local storage
  4. Longer token lifetimes

Explanation

Short-lived tokens combined with server-side revocation invalidate a stolen token once the session ends. Long lifetimes and insecure storage extend the window in which a stolen token remains usable.

Question 11Cloud Application Architecture and Design Security

Which design choice best protects a multi-tenant SaaS application against cross-tenant data access?

  1. Tenant-scoped authorization enforced at the data access layer Correct answer.
  2. Filtering records by tenant in application code only
  3. Relying on unpredictable tenant identifiers
  4. A shared database schema with no tenant column

Explanation

Enforcing tenant scoping at the data access layer ensures every query is constrained regardless of application logic errors. Application-only filtering and obscurity-based identifiers can be bypassed.

Question 12Cloud Application Architecture and Design Security

What is the primary security benefit of infrastructure as code in a cloud deployment pipeline?

  1. It removes the need for network segmentation
  2. It eliminates the need for identity controls
  3. It guarantees that secrets are never exposed
  4. It makes configuration drift and unauthorized changes detectable and reviewable Correct answer.

Explanation

Declarative infrastructure definitions under version control make changes reviewable and drift detectable against the approved baseline. IaC does not remove the need for identity, segmentation, or secret management.

Question 13Cloud Application Architecture and Design Security

Which approach best secures secrets consumed by containers at runtime?

  1. Passing secrets as build-time arguments
  2. Committing an encrypted secrets file to the repository
  3. Baking secrets into the container image
  4. Injecting secrets at runtime from a managed secrets store Correct answer.

Explanation

Runtime injection from a managed secrets store keeps credentials out of images and build artifacts and allows rotation. Baked-in or build-time secrets persist in image layers and repositories.

Question 14Cloud Application Architecture and Design Security

Which control most effectively mitigates a denial-of-service attack against a public-facing cloud endpoint?

  1. An edge scrubbing service with rate limiting Correct answer.
  2. Strong password complexity rules
  3. Database read replicas
  4. Encryption of backup archives

Explanation

Edge scrubbing absorbs and filters volumetric traffic before it reaches the origin, and rate limiting constrains abusive request patterns. Authentication policy, replicas, and backup encryption do not address traffic floods.

Question 15Cloud Application Architecture and Design Security

An architect must ensure that a compromised compute instance cannot call administrative APIs. Which control achieves this most directly?

  1. Enabling detailed monitoring on the instance
  2. Assigning a broad role to the instance profile
  3. Requiring an instance-bound role with no administrative permissions Correct answer.
  4. Placing the instance in a public subnet

Explanation

An instance-bound role with no administrative permissions means any credential obtained from the instance lacks privileged API access. Broad roles, monitoring, and public placement do not restrict the instance's authority.

Question 16Cloud Application Architecture and Design Security

Which property of a cloud storage bucket most directly prevents accidental public exposure of objects?

  1. Versioning enabled on the bucket
  2. Cross-region replication of objects
  3. Object-level lifecycle transition to cold storage
  4. Public access blocked at the account level with bucket policies denying anonymous reads Correct answer.

Explanation

Account-level public access blocks combined with explicit deny of anonymous reads prevent objects from being served publicly even if a bucket policy is misconfigured. Versioning, lifecycle rules, and replication do not govern access.

Question 17Cloud Application Architecture and Design Security

Which design element is required to satisfy data residency obligations in a multi-region cloud architecture?

  1. Global replication of all datasets
  2. A content delivery network caching user records
  3. Regional pinning of storage and processing with policy enforcement Correct answer.
  4. Automatic failover to any available region

Explanation

Residency obligations require that data be stored and processed only in approved jurisdictions, enforced through region-pinned resources and policy guardrails. Global replication and unrestricted failover can move data across borders.

Question 18Cloud Application Architecture and Design Security

Which control best detects unauthorized configuration changes to production cloud resources?

  1. Encryption of management traffic
  2. Periodic manual review of the console
  3. Continuous configuration monitoring with drift alerts against a baseline Correct answer.
  4. Annual penetration testing

Explanation

Continuous monitoring compares live configuration against an approved baseline and alerts on drift, catching unauthorized changes quickly. Manual reviews, annual tests, and transport encryption do not provide timely detection of configuration change.

Question 19Cloud Application Architecture and Design Security

Which approach best secures service-to-service communication in a zero-trust cloud architecture?

  1. IP allowlisting alone
  2. A shared API key distributed to all services
  3. Relying on network location inside the VPC
  4. Mutual TLS with workload identity verification Correct answer.

Explanation

Mutual TLS with workload identity verifies both parties cryptographically, so trust no longer depends on network position. Shared keys and IP allowlists are weaker because they can be reused or spoofed.

Question 20Cloud Application Architecture and Design Security

A team wants to detect anomalous API activity indicative of credential misuse. Which design is most effective?

  1. Static threshold alerts on total request count
  2. Disabling audit logging to reduce noise
  3. Weekly review of billing reports
  4. Behavioral baselining of identity activity with anomaly alerting Correct answer.

Explanation

Behavioral baselining learns normal patterns per identity and flags deviations such as unusual regions, times, or API sets that signal credential misuse. Static thresholds and billing reviews are too coarse, and disabling logs removes the evidence.

Question 21Cloud Application Architecture and Design Security

Which pattern best limits the impact of a compromised third-party SaaS integration holding cloud API access?

  1. Disabling logging for integration calls
  2. Sharing a single credential across all integrations
  3. Scoping the integration to least privilege with periodic access review Correct answer.
  4. Granting the integration a broad administrator role

Explanation

Least-privilege scoping plus periodic review ensures an integration holds only the permissions it needs and that stale grants are removed. Broad roles and shared credentials magnify the impact of compromise.

Question 22Cloud Application Architecture and Design Security

Which control most directly protects against a supply chain attack that injects malicious code into a container image?

  1. Using the latest tag for all images
  2. Signing images and verifying signatures before deployment Correct answer.
  3. Running containers as root
  4. Increasing the container memory limit

Explanation

Image signing with admission-time verification ensures only artifacts from trusted builders are deployed, blocking tampered images. Resource limits, root execution, and mutable tags do not establish provenance.

Question 23Cloud Application Architecture and Design Security

Which design decision best supports secure deletion of data when a customer requests erasure in a cloud environment?

  1. Overwriting blocks on shared multi-tenant storage
  2. Crypto-shredding by destroying the per-tenant encryption key Correct answer.
  3. Removing the record from the primary index only
  4. Relying on provider backups expiring eventually

Explanation

Crypto-shredding destroys the key that protects the tenant's data, rendering all copies including backups unreadable without needing to locate every replica. Physical overwrite is impractical on shared storage and index deletion leaves copies intact.

Question 24Cloud Application Architecture and Design Security

Which control is most appropriate for protecting data in transit between cloud regions over the public internet?

  1. Network address translation
  2. IPsec or TLS tunnels with certificate validation Correct answer.
  3. Domain name system filtering
  4. Storage volume encryption

Explanation

Encrypted tunnels with certificate validation provide confidentiality and authentication for inter-region traffic crossing untrusted networks. NAT, DNS filtering, and volume encryption do not protect data in transit.

Question 25Cloud Application Architecture and Design Security

A regulated workload must prove that no human administrator can read production data. Which combination best satisfies this?

  1. Customer-held keys in an external HSM with break-glass approval workflows Correct answer.
  2. Database auditing with quarterly access reviews
  3. Role-based access control on the database with MFA
  4. Provider-managed keys with administrator access logging

Explanation

Keys held in a customer-controlled external HSM keep ciphertext unreadable to provider and internal administrators, while break-glass workflows make any exceptional access explicit and auditable. RBAC, MFA, and reviews govern access but do not make plaintext unreadable to a privileged operator.

Question 26Cloud Application Architecture and Design Security

An architect is designing a multi-account structure on a major cloud platform and wants to enforce that no workload account can ever create a public-facing object storage bucket. Which design element most directly achieves this?

  1. Per-account IAM policies written by each application team and reviewed quarterly by security
  2. Organization-level service control policies that deny public bucket creation and are inherited by every workload account Correct answer.
  3. An alerting rule that notifies the security team whenever a bucket policy changes
  4. A tagging standard that flags buckets containing regulated data for monthly audit

Explanation

Guardrails that must hold regardless of individual team behavior belong at a level above the workload account, so an organization-level policy that denies the action and is inherited cannot be overridden by account administrators. Detective controls such as tagging standards and alerting only reveal exposure after it happens. IAM policies authored per account depend on each team's discipline and can be edited away.

Question 27Cloud Application Architecture and Design Security

A payment service must call a fraud-scoring API hosted in the same cloud provider. The security team requires that the caller's identity be verifiable by the API without distributing long-lived API keys, and that a stolen credential cannot be replayed from an unrelated workload. Which design best meets both requirements?

  1. Issue each caller a static API key stored in a managed secrets service and rotate it every 90 days
  2. Encrypt request bodies with a shared symmetric key that only the payment service and the fraud API hold
  3. Configure the caller with a workload identity that obtains short-lived tokens bound to its attested identity, and have the API validate the token audience and issuer Correct answer.
  4. Have the API accept calls only from a shared NAT gateway IP range that all internal services egress through

Explanation

Workload identity issues credentials tied to the attested identity of the calling workload, and short lifetimes plus audience validation mean a stolen token is both narrowly scoped and quickly useless. Static keys and shared network egress identify a location or a secret rather than a specific workload, so any holder or any host behind that range can impersonate the caller. Body encryption protects content in transit but does not authenticate who is calling.

Question 28Cloud Application Architecture and Design Security

A company runs a regulated analytics platform in one cloud region. Auditors require that data be readable only inside a hardware-backed trust boundary the cloud operator cannot inspect, and that the encryption keys never leave the customer's on-premises hardware security module except as wrapped blobs. The team also needs to run existing containerized queries with minimal code change. Which combination of design choices satisfies all of these constraints together?

  1. Field-level application encryption using keys stored in the cloud provider's managed key service, with envelope caching on the worker nodes
  2. Full-disk encryption with provider-managed keys on the worker nodes, plus a private network path from on-premises to the region
  3. Tokenization of sensitive columns at ingest, with the token vault hosted in the same region as the analytics workers
  4. Confidential computing enclaves for the query workers, customer-managed keys held in an external HSM and released only to attested enclaves, and remote attestation verified before any key release Correct answer.

Explanation

Only confidential computing keeps memory unreadable to the operator, and binding key release to remote attestation ensures the external HSM hands unwrapped keys solely to verified enclave code, which preserves the trust boundary end to end. Provider-managed or provider-hosted keys place the key material inside the operator's control plane. Tokenization and disk encryption reduce exposure of stored data but leave plaintext visible in worker memory during query execution.

Question 29Identity, Authentication, and Access Management for Cloud Applications

In an OAuth 2.0 authorization code flow for a cloud-hosted web application, which component is responsible for exchanging the authorization code for tokens at the token endpoint?

  1. The resource server hosting the protected APIs
  2. The client application's backend server Correct answer.
  3. The user agent (browser) using a client-side script
  4. The authorization server's consent page

Explanation

The authorization code is returned to the client's redirect URI and must be exchanged at the token endpoint by the confidential client, typically the backend server, which can authenticate with its client credentials. Performing the exchange server-side prevents the client secret from being exposed to the browser.

Question 30Identity, Authentication, and Access Management for Cloud Applications

A cloud SaaS application needs to call a downstream API on behalf of a signed-in user without storing the user's password. Which OAuth 2.0 grant is designed for this delegated access scenario?

  1. Implicit grant
  2. Resource owner password credentials grant
  3. Authorization code grant Correct answer.
  4. Client credentials grant

Explanation

The authorization code grant obtains user consent through the authorization server and issues tokens scoped to the user, so the application never handles the user's password. The other grants either require password collection, represent the application itself, or expose tokens directly to the browser.

Question 31Identity, Authentication, and Access Management for Cloud Applications

Which statement best describes the role of an OpenID Connect ID token in a cloud application sign-in?

  1. It is a refresh token used to obtain new access tokens without user interaction.
  2. It is a signed assertion of the user's authentication event and identity claims for the client. Correct answer.
  3. It is a long-lived credential that the client presents to APIs in place of an access token.
  4. It is a symmetric key that the client uses to encrypt session cookies.

Explanation

An ID token is a JWT issued by the OpenID Provider that asserts the authentication event and contains claims such as subject, issuer, and audience for the client. It is consumed by the client to establish the user's session and is not a substitute for an API access token.

Question 32Identity, Authentication, and Access Management for Cloud Applications

A cloud identity provider issues short-lived access tokens and longer-lived refresh tokens. What is the primary security reason for this design?

  1. Refresh tokens are only used for single sign-on across unrelated identity providers.
  2. Short access tokens reduce the window in which a stolen bearer token can be replayed. Correct answer.
  3. Refresh tokens are easier to revoke than access tokens, so they can be long-lived.
  4. Access tokens must be short-lived because they are stored in browser local storage.

Explanation

Access tokens are bearer credentials, so limiting their lifetime limits the damage if one is leaked. Refresh tokens allow the client to obtain new access tokens without re-authenticating the user and can be revoked server-side.

Question 33Identity, Authentication, and Access Management for Cloud Applications

In SAML 2.0 web browser SSO, which party signs the assertion that the service provider consumes to establish a user session?

  1. The service provider
  2. The user agent
  3. The identity provider Correct answer.
  4. The relying party's federation metadata server

Explanation

The identity provider authenticates the user and signs the SAML assertion, allowing the service provider to verify its origin and integrity. The service provider validates the signature against the identity provider's published signing certificate.

Question 34Identity, Authentication, and Access Management for Cloud Applications

A cloud administrator wants to enforce that all users in a tenant authenticate with a phishing-resistant method. Which authenticator best meets this requirement?

  1. Time-based one-time password in a mobile app
  2. Security questions configured by the help desk
  3. SMS one-time passcode
  4. FIDO2 security key bound to the user's account Correct answer.

Explanation

FIDO2/WebAuthn security keys use public-key cryptography bound to the relying party origin, which resists real-time phishing and credential replay. SMS, security questions, and TOTP codes can be relayed by an attacker in a phishing session.

Question 35Identity, Authentication, and Access Management for Cloud Applications

In a cloud IAM policy model, what does the principle of least privilege require when assigning roles to an application's service account?

  1. Granting permissions only for the actions and resources the application actually needs Correct answer.
  2. Granting permissions to the service account's owning team rather than the account itself
  3. Granting the broadest predefined role so the application never fails due to missing permissions
  4. Granting permissions temporarily and then converting them to permanent standing access

Explanation

Least privilege means the identity receives only the permissions required for its function, reducing the blast radius if the credential is compromised. Broad predefined roles and permanent standing access violate this principle.

Question 36Identity, Authentication, and Access Management for Cloud Applications

Which cloud IAM construct is used to attach a policy directly to a user, group, or role so that the permissions apply to that principal?

  1. Identity-based policy Correct answer.
  2. Permissions boundary
  3. Service control policy
  4. Resource-based policy

Explanation

Identity-based policies are attached to an IAM principal such as a user, group, or role and define what that principal can do. Resource-based policies attach to the resource, while boundaries and SCPs constrain rather than grant permissions directly.

Question 37Identity, Authentication, and Access Management for Cloud Applications

A web application uses OAuth 2.0 with the authorization code flow and wants to prevent authorization code interception. Which control should be implemented?

  1. Disable PKCE because the client is confidential
  2. Store the authorization code in browser local storage for auditing
  3. Include a state parameter and validate it on the callback Correct answer.
  4. Use the implicit grant instead of the authorization code grant

Explanation

The state parameter binds the authorization request to the client's callback session and mitigates cross-site request forgery and code injection attacks. PKCE additionally protects the code exchange, but state validation is the baseline control for callback integrity.

Question 38Identity, Authentication, and Access Management for Cloud Applications

An application validates an OpenID Connect ID token. Which check ensures the token was issued for this specific client and not another application?

  1. Verify that the token uses the RS256 algorithm
  2. Verify that the nonce claim is absent
  3. Verify that the exp claim is in the future
  4. Verify that the aud claim matches the client's registered client_id Correct answer.

Explanation

The audience (aud) claim identifies the intended recipient of the ID token, so the client must confirm it equals its own client_id. Expiration, algorithm, and nonce checks address different threats such as replay and token substitution.

Question 39Identity, Authentication, and Access Management for Cloud Applications

A cloud team wants to allow an external partner's application to upload objects to a specific storage bucket without creating IAM users in the team's account. Which mechanism is most appropriate?

  1. An identity-based policy attached to a new IAM user with a shared password
  2. A permissions boundary attached to the partner's role
  3. A resource-based bucket policy that grants the partner's role access to the bucket Correct answer.
  4. A service control policy applied at the organization root

Explanation

A resource-based policy on the bucket can grant a cross-account principal access directly, which avoids creating local IAM users for the partner. The partner's own identity provider or IAM role supplies the principal identity.

Question 40Identity, Authentication, and Access Management for Cloud Applications

In SAML 2.0, what is the purpose of the RelayState parameter in the web browser SSO profile?

  1. It authenticates the user agent to the identity provider.
  2. It carries application-specific state so the service provider can return the user to the intended resource after SSO. Correct answer.
  3. It encrypts the SAML assertion between the identity provider and service provider.
  4. It specifies the signing algorithm the identity provider must use.

Explanation

RelayState is an opaque value passed through the SSO exchange that lets the service provider restore the user's original target URL or application state. It is not a security token and must be validated to prevent open redirects.

Question 41Identity, Authentication, and Access Management for Cloud Applications

A cloud application federates with an external identity provider using OIDC. Which discovery document endpoint should the application query to obtain the authorization, token, and JWKS URIs automatically?

  1. The /userinfo endpoint
  2. The /.well-known/openid-configuration endpoint Correct answer.
  3. The /oauth2/authorize endpoint
  4. The /oauth2/token endpoint

Explanation

The OpenID Provider configuration document at /.well-known/openid-configuration publishes metadata including endpoint URLs and the JWKS URI. Automated discovery reduces misconfiguration and supports key rotation.

Question 42Identity, Authentication, and Access Management for Cloud Applications

A security team wants to ensure that a compromised workload cannot escalate privileges by assuming a more powerful role. Which IAM control directly limits the maximum permissions a role can obtain?

  1. A resource-based policy on the target resource
  2. A trust policy that allows the workload to assume the role
  3. An identity-based policy with wildcard actions
  4. A permissions boundary on the role Correct answer.

Explanation

A permissions boundary sets the maximum permissions that an identity-based policy can grant to a role, so even an overly broad policy cannot exceed the boundary. Trust policies control who may assume the role, not what the role can do.

Question 43Identity, Authentication, and Access Management for Cloud Applications

An organization uses SAML SSO and wants to reduce the impact of a compromised identity provider signing key. Which practice is most effective?

  1. Configure the service provider to trust assertions from any issuer in metadata
  2. Rotate signing certificates on a schedule and publish updated metadata Correct answer.
  3. Disable assertion signature validation to avoid outages during key rotation
  4. Use the same signing certificate across all identity providers in the federation

Explanation

Scheduled certificate rotation with timely metadata publication limits the period during which a compromised key is useful. Sharing keys or disabling validation would broaden the compromise.

Question 44Identity, Authentication, and Access Management for Cloud Applications

A cloud application uses OAuth 2.0 with PKCE. What is the role of the code_verifier and code_challenge pair?

  1. They authenticate the resource owner directly to the authorization server.
  2. They bind the authorization code to the client that initiated the request, mitigating code interception. Correct answer.
  3. They encrypt the authorization code in transit between the client and the token endpoint.
  4. They replace the client secret for confidential clients in all grant types.

Explanation

PKCE has the client send a hashed code_challenge with the authorization request and the original code_verifier at token exchange, so a stolen code cannot be redeemed without the verifier. This protects public and confidential clients against authorization code interception.

Question 45Identity, Authentication, and Access Management for Cloud Applications

A cloud IAM policy includes a condition that restricts access to requests from a specific corporate network range. Which policy element is being used?

  1. A resource element
  2. A condition element Correct answer.
  3. A principal element
  4. An action element

Explanation

The condition element specifies constraints such as source IP range, time of day, or MFA presence that must be satisfied for the policy to allow the request. Principal, action, and resource identify who, what operation, and which object.

Question 46Identity, Authentication, and Access Management for Cloud Applications

A cloud provider supports role assumption with temporary security credentials. Which benefit does this provide over long-term access keys?

  1. Temporary credentials are stored in source code for easier deployment.
  2. Temporary credentials are automatically rotated and expire, reducing exposure from leaked keys. Correct answer.
  3. Temporary credentials eliminate the need for any authorization policy.
  4. Temporary credentials never expire once issued to a workload.

Explanation

STS-issued temporary credentials have a bounded lifetime and are rotated automatically, so a leaked credential is useful only until expiration. Authorization policies are still required to define what the assumed role can do.

Question 47Identity, Authentication, and Access Management for Cloud Applications

An application receives an OIDC ID token signed with RS256. Which key should the application use to verify the signature?

  1. The access token issued alongside the ID token
  2. The user's password hash stored by the application
  3. The client secret registered for the application
  4. The public key from the identity provider's JWKS endpoint Correct answer.

Explanation

RS256 uses asymmetric signing, so the identity provider signs with its private key and publishes the corresponding public keys at its JWKS endpoint. The application validates the signature with the matching public key.

Question 48Identity, Authentication, and Access Management for Cloud Applications

A company wants to enforce that cloud administrators must authenticate with MFA before performing sensitive actions, even if their normal session is active. Which approach best implements this?

  1. Use a policy condition that requires MFA context for sensitive actions Correct answer.
  2. Share administrator credentials among the team to reduce account count
  3. Require MFA at initial sign-in only and rely on session duration
  4. Disable session timeouts so administrators are not interrupted

Explanation

Step-up authorization uses policy conditions such as MFA presence or authentication age to require re-authentication for sensitive operations. Relying only on initial sign-in MFA leaves long-lived sessions able to perform sensitive actions.

Question 49Identity, Authentication, and Access Management for Cloud Applications

In a cloud environment, a developer needs temporary access to production for an incident. Which access model best balances security and operational need?

  1. A service account with a static key checked into the repository
  2. Just-in-time elevation with approval, time-bound session, and audit logging Correct answer.
  3. Permanent standing administrator access granted at onboarding
  4. Shared break-glass credentials stored in a team wiki

Explanation

Just-in-time elevation grants elevated permissions only for the approved window, with logging for accountability. Permanent access and shared or static credentials increase the risk of misuse and complicate attribution.

Question 50Identity, Authentication, and Access Management for Cloud Applications

A cloud application uses an OAuth 2.0 access token to call a resource server. Which validation should the resource server perform to ensure the token is intended for its APIs?

  1. Check that the token's audience claim includes the resource server's identifier Correct answer.
  2. Check that the token is stored in the browser's local storage
  3. Check that the token was issued by the client application
  4. Check that the token contains the user's password

Explanation

The resource server must confirm the token's audience matches its own identifier so that tokens issued for other services cannot be replayed against it. It should also validate signature, issuer, and expiration.