I85PREP
⌘ K
CrowdStrike CCCS study materials
CrowdStrike CCCS study resources

CrowdStrike CCCS practice questions

One question at a time. Build your CrowdStrike CCCS understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cloud Security Fundamentals and Architecture

In the CrowdStrike cloud security model, what is the primary purpose of the shared responsibility model?

  1. To standardize encryption algorithms across providers
  2. To divide security duties between the cloud provider and the customer Correct answer.
  3. To guarantee compliance with every regulatory framework
  4. To transfer all security obligations to the cloud provider

Explanation

The shared responsibility model defines which security controls the cloud service provider owns and which remain the customer's duty. The split varies by service model, so customers must understand where their obligations begin, especially for data, identity, and configuration.

Question 2Cloud Security Fundamentals and Architecture

Which cloud service model places the greatest security responsibility on the customer?

  1. Platform as a Service (PaaS)
  2. Software as a Service (SaaS)
  3. Infrastructure as a Service (IaaS) Correct answer.
  4. Function as a Service (FaaS)

Explanation

With IaaS the provider manages physical infrastructure and virtualization, while the customer secures the operating system, runtime, applications, and data. Higher-level models like PaaS, SaaS, and FaaS shift more of the stack to the provider.

Question 3Cloud Security Fundamentals and Architecture

A security architect is designing a multi-account cloud environment and wants to enforce guardrails centrally while allowing teams autonomy. Which architecture pattern best supports this goal?

  1. Per-team accounts with no central governance
  2. One account per developer with full administrator rights
  3. A single shared account for all workloads
  4. An organization with accounts grouped into organizational units and service control policies Correct answer.

Explanation

Organizational units let you apply service control policies that set maximum permissions across groups of accounts. This provides centralized guardrails while teams retain autonomy within their accounts.

Question 4Cloud Security Fundamentals and Architecture

What does the principle of least privilege require in a cloud identity and access management design?

  1. Granting permissions only to service accounts and never to humans
  2. Granting only the permissions required to perform a specific task, for the needed duration Correct answer.
  3. Granting every identity the permissions needed for all anticipated future tasks
  4. Granting permissions based on the user's seniority in the organization

Explanation

Least privilege means each identity receives the minimum permissions necessary, scoped to the task and time required. This limits the blast radius if credentials are compromised and reduces accidental misuse.

Question 5Cloud Security Fundamentals and Architecture

A company stores regulated customer data in a public cloud and must prove to auditors that data is encrypted at rest. Which control most directly satisfies this requirement?

  1. Enabling provider-managed encryption at rest on the storage service Correct answer.
  2. Enabling verbose access logging on the storage bucket
  3. Restricting the storage bucket to a single region
  4. Configuring a web application firewall in front of the application

Explanation

Encryption at rest protects stored data and can be evidenced through provider settings or customer-managed keys. Auditors typically look for documented encryption configuration on the storage service itself.

Question 6Cloud Security Fundamentals and Architecture

Why is network segmentation important in a cloud virtual network architecture?

  1. It eliminates the need for identity-based controls
  2. It encrypts all traffic automatically between subnets
  3. It guarantees that workloads cannot be reached from the internet
  4. It limits lateral movement by restricting traffic between workloads Correct answer.

Explanation

Segmenting networks into subnets with restrictive routing and security rules limits how far an attacker can move after compromising one workload. Segmentation is a containment control, not an encryption or identity substitute.

Question 7Cloud Security Fundamentals and Architecture

In a cloud environment, what distinguishes a control plane from a data plane?

  1. The control plane is always on-premises, while the data plane is always in the cloud
  2. The control plane stores backups, while the data plane stores logs
  3. The control plane handles management and configuration APIs, while the data plane carries workload traffic Correct answer.
  4. The control plane carries user traffic, while the data plane manages configuration

Explanation

The control plane exposes management APIs for provisioning and configuration, and the data plane processes the actual workload or user traffic. Attacks on the control plane can reconfigure or disable protections, so both planes need monitoring.

Question 8Cloud Security Fundamentals and Architecture

A security team wants to detect threats across containerized workloads in a cloud-native architecture. Which approach best aligns with CrowdStrike's cloud workload protection philosophy?

  1. Deploying runtime sensors that observe process and network behavior in workloads Correct answer.
  2. Reviewing cloud provider billing reports for anomalies
  3. Disabling container networking to reduce exposure
  4. Relying solely on periodic vulnerability scans of container images

Explanation

Runtime protection observes actual behavior such as process execution and network connections, catching threats that static image scanning may miss. Combining runtime telemetry with image scanning gives defense in depth for containers.

Question 9Cloud Security Fundamentals and Architecture

Which cloud identity feature most directly reduces the risk of long-lived static access keys being stolen?

  1. Sharing a single access key across all developers
  2. Using short-lived credentials issued through role assumption Correct answer.
  3. Rotating access keys once every two years
  4. Storing access keys in source code repositories

Explanation

Short-lived credentials obtained by assuming roles expire quickly, so stolen credentials have a limited window of use. This reduces the value of credential theft compared with long-lived static keys.

Question 10Cloud Security Fundamentals and Architecture

A cloud architect must ensure that audit logs cannot be altered or deleted by an attacker who compromises an administrator account. Which design choice best achieves this?

  1. Granting all administrators full delete rights on the log store
  2. Disabling log retention to reduce storage costs
  3. Sending logs to a separate, append-only logging account with restricted write access Correct answer.
  4. Storing logs only on the same host that generates them

Explanation

Centralizing logs in a separate account with append-only permissions isolates them from the accounts being monitored. Even a compromised administrator in a workload account then cannot tamper with the audit trail.

Question 11Cloud Security Fundamentals and Architecture

What is the security benefit of infrastructure as code (IaC) in cloud architecture?

  1. It guarantees that workloads are patched automatically
  2. It encrypts all data by default
  3. It removes the need for any access controls
  4. It enables repeatable, reviewable configurations that reduce drift and misconfiguration Correct answer.

Explanation

IaC makes infrastructure changes version-controlled and peer-reviewable, which reduces configuration drift and accidental exposure. Security policies can be checked in code before deployment.

Question 12Cloud Security Fundamentals and Architecture

A team deploys a web application in a public cloud and wants to protect it from common web exploits while keeping the origin servers private. Which architecture best meets both goals?

  1. Using a single monolithic server with no network controls
  2. Exposing origin servers directly with public IP addresses
  3. Placing a web application firewall and load balancer in front of private origin servers Correct answer.
  4. Relying on security groups alone with public origin addresses

Explanation

A web application firewall filters malicious web traffic, and keeping origins private behind a load balancer prevents direct access that bypasses protections. This layered edge design is a common cloud pattern.

Question 13Cloud Security Fundamentals and Architecture

In cloud security, what does the term 'blast radius' refer to?

  1. The scope of impact a compromised identity or workload can cause Correct answer.
  2. The geographic distance between data centers
  3. The number of firewall rules in a security group
  4. The total cost of cloud resources in an account

Explanation

Blast radius describes how much damage a single compromise can inflict, which depends on permissions, network reach, and data access. Architects reduce blast radius through segmentation, least privilege, and account isolation.

Question 14Cloud Security Fundamentals and Architecture

Which practice best supports secure use of third-party cloud SaaS applications in an enterprise?

  1. Using single sign-on with centralized identity and access review Correct answer.
  2. Allowing any employee to approve new SaaS integrations
  3. Disabling multi-factor authentication to simplify logins
  4. Storing SaaS credentials in shared spreadsheets

Explanation

Single sign-on through a central identity provider gives visibility and control over SaaS access, and periodic access reviews remove stale entitlements. This reduces shadow IT and orphaned accounts.

Question 15Cloud Security Fundamentals and Architecture

A cloud team wants to detect when a storage bucket is made publicly readable. Which control provides the most timely detection?

  1. Reviewing the bucket policy only during audits
  2. A quarterly manual configuration review
  3. Continuous cloud security posture monitoring with alerting on public access Correct answer.
  4. Annual penetration testing of the application

Explanation

Continuous posture monitoring evaluates configuration changes as they happen and can alert on public access within minutes. Manual or periodic reviews leave long windows during which data may be exposed.

Question 16Cloud Security Fundamentals and Architecture

What role does a cloud access security broker (CASB) play in cloud architecture?

  1. It enforces policy and visibility between users and cloud services Correct answer.
  2. It replaces the need for encryption at rest
  3. It provides physical security for data centers
  4. It manages the hypervisor layer in IaaS

Explanation

A CASB sits between users and cloud services to enforce data loss prevention, access policy, and visibility into sanctioned and unsanctioned apps. It complements identity and endpoint controls rather than replacing them.

Question 17Cloud Security Fundamentals and Architecture

Why should production and development cloud environments be separated into distinct accounts or projects?

  1. To contain risk so development mistakes cannot affect production data Correct answer.
  2. To reduce the cost of compute resources
  3. To allow developers to bypass all security controls
  4. To eliminate the need for logging in development

Explanation

Separate accounts create a hard boundary so a misconfiguration or compromised credential in development cannot reach production resources. This isolation is a core blast-radius reduction technique.

Question 18Cloud Security Fundamentals and Architecture

An organization wants to enforce that no cloud storage bucket can be created without encryption enabled. Which mechanism enforces this at provisioning time?

  1. A detective alert after the bucket is created
  2. An email reminder to engineers
  3. A monthly compliance report
  4. A preventive policy that denies noncompliant create requests Correct answer.

Explanation

Preventive policy evaluated at the API layer blocks noncompliant resources before they exist. Detective controls find issues after the fact, which is weaker than preventing the misconfiguration.

Question 19Cloud Security Fundamentals and Architecture

In a cloud-native architecture, why is identity often described as the new security perimeter?

  1. Because identities are always stored on-premises
  2. Because network firewalls are no longer used in cloud environments
  3. Because encryption is no longer required once identity is verified
  4. Because access decisions increasingly depend on authenticated identity rather than fixed network location Correct answer.

Explanation

Workloads and users are distributed and often reach services over shared networks, so authentication and authorization become the primary control point. Network controls remain useful but are no longer sufficient on their own.

Question 20Cloud Security Fundamentals and Architecture

A security architect is evaluating a serverless function that processes untrusted input. Which threat is most specific to this architecture?

  1. Event injection through untrusted event sources that trigger the function Correct answer.
  2. Physical theft of the server hosting the function
  3. Manual patching of the underlying host operating system by the customer
  4. Hypervisor escape by the customer's own virtual machines

Explanation

Serverless functions are triggered by events, so untrusted event data can carry injection payloads into the function logic. Validating and sanitizing event input is a key control in this model.

Question 21Cloud Security Fundamentals and Architecture

What is the primary security concern with overly permissive wildcard permissions in cloud IAM policies?

  1. They prevent the use of multi-factor authentication
  2. They slow down API response times
  3. They increase the blast radius if an identity is compromised Correct answer.
  4. They automatically disable logging

Explanation

Wildcard permissions grant broad access, so a compromised identity can act across many resources. Scoping permissions to specific actions and resources limits the damage an attacker can do.

Question 22Cloud Security Fundamentals and Architecture

Which cloud architecture decision best supports data residency requirements for regulated data?

  1. Replicating data to every available region by default
  2. Disabling encryption to simplify regional replication
  3. Restricting storage and processing to approved regions with policy controls Correct answer.
  4. Storing data only in the provider's default region without review

Explanation

Data residency requires that data be stored and processed only in approved jurisdictions, enforced through region restrictions and policy. Default replication across regions can violate those obligations.

Question 23Cloud Security Fundamentals and Architecture

What distinguishes a cloud security posture management tool from a cloud workload protection platform?

  1. Posture management encrypts data, while workload protection manages identities
  2. Posture management is only for on-premises systems, while workload protection is only for cloud systems
  3. Posture management assesses configuration against benchmarks, while workload protection detects runtime threats on running assets Correct answer.
  4. Posture management replaces logging, while workload protection replaces firewalls

Explanation

Posture management continuously checks configurations for misconfigurations and policy violations, while workload protection focuses on runtime behavior and threat detection. Together they cover both preventive configuration and active defense.

Question 24Cloud Security Fundamentals and Architecture

Why is centralized identity federation valuable in a multi-cloud architecture?

  1. It stores all data in a single cloud region
  2. It removes the need to define any authorization policies
  3. It lets users authenticate once against a central identity provider and access multiple clouds Correct answer.
  4. It eliminates the need for encryption in transit

Explanation

Federation uses a trusted identity provider to issue assertions that multiple cloud platforms accept, simplifying access management. Authorization policies are still required in each cloud to define what federated identities may do.

Question 25Cloud Security Fundamentals and Architecture

A company discovers that a developer's cloud credentials were used from an unusual country. Which combination of controls best limits damage and enables investigation?

  1. Shared team credentials plus no alerting
  2. Long-lived access keys plus disabled logging
  3. Short-lived role credentials plus centralized audit logging of API activity Correct answer.
  4. Static keys stored in code plus periodic manual review

Explanation

Short-lived credentials limit how long stolen access remains useful, and centralized audit logs record which API calls were made. Together they reduce impact and support forensic reconstruction of the incident.

Question 26Cloud Security Fundamentals and Architecture

In a shared responsibility model for infrastructure as a service (IaaS), which security responsibility remains with the customer?

  1. Securing the hypervisor that isolates tenant virtual machines
  2. Patching the guest operating system and configuring its security groups Correct answer.
  3. Maintaining the physical security of the data center hosting the workloads
  4. Managing the lifecycle and firmware of the underlying compute hardware

Explanation

Under IaaS, the provider secures the physical facility, hardware, and virtualization layer, while the customer owns everything from the guest operating system upward, including patching, identity, and network controls inside the tenant boundary. This division is the core of the shared responsibility model and drives which controls the customer must implement.

Question 27Cloud Security Fundamentals and Architecture

A company moves a legacy application to a public cloud with no code changes and keeps the same operating system, database engine, and network design. Which cloud migration strategy does this describe?

  1. Lift and shift rehosting Correct answer.
  2. Retiring and replacing with SaaS
  3. Refactoring into managed services
  4. Rebuilding as cloud-native microservices

Explanation

Rehosting, often called lift and shift, moves workloads to cloud infrastructure with minimal changes, so the original operating systems and architecture persist. Because the workload keeps its legacy design, security teams must still patch and harden it manually rather than relying on provider-managed controls.

Question 28Cloud Security Fundamentals and Architecture

Which cloud deployment model places workloads on infrastructure shared by multiple unrelated organizations while logical isolation is enforced by the provider?

  1. Community cloud
  2. Public cloud Correct answer.
  3. Private cloud
  4. Hybrid cloud

Explanation

A public cloud is owned and operated by a provider and serves many tenants, with isolation enforced through virtualization, identity, and network boundaries. Security in this model depends heavily on correct tenant configuration, since the provider controls the shared underlying platform.

Question 29Cloud Security Fundamentals and Architecture

A regulated firm must keep certain data inside a specific country. Which architectural pattern most directly enforces this requirement?

  1. Enabling cross-region read replicas for analytics workloads
  2. Replicating all data to every available region for resilience
  3. Encrypting data with customer-managed keys stored in a central vault
  4. Restricting resource creation to approved regions through policy and organization constraints Correct answer.

Explanation

Data residency is enforced by constraining where resources and data can physically exist, typically through organization-level policy that denies creation outside approved regions. Encryption protects confidentiality but does not control the geographic location of the stored data.

Question 30Cloud Security Fundamentals and Architecture

An organization wants every new cloud account to inherit a baseline of logging, guardrails, and network controls automatically. Which architectural approach best achieves this?

  1. Granting administrators broad permissions so they can fix misconfigurations quickly
  2. Relying on each team to follow a documented hardening checklist
  3. Auditing accounts quarterly and remediating findings afterward
  4. Provisioning accounts through a landing zone with policy-driven guardrails Correct answer.

Explanation

A landing zone codifies baseline identity, logging, networking, and guardrails so every account is born compliant instead of depending on manual effort. This shifts enforcement to preventive, automated controls rather than detective checks performed after deployment.

Question 31Cloud Security Fundamentals and Architecture

Which control most directly limits lateral movement between workloads inside a single cloud virtual network?

  1. A web application firewall inspecting inbound HTTP traffic
  2. Multi-factor authentication for the cloud management console
  3. Centralized log aggregation with long retention
  4. Microsegmentation with least-privilege allow rules between workload groups Correct answer.

Explanation

Microsegmentation applies fine-grained allow rules so a compromised workload can reach only the peers it legitimately needs, which constrains east-west movement. Perimeter controls and console authentication do not govern traffic between internal workloads.

Question 32Cloud Security Fundamentals and Architecture

A team wants to reduce the risk that a compromised container image introduces malware into production. Which architecture practice addresses this most directly?

  1. Scanning images for vulnerabilities and enforcing signature verification before deployment Correct answer.
  2. Using the latest tag so images always receive upstream fixes
  3. Storing images in a registry that allows anonymous pulls
  4. Running containers with host networking to simplify connectivity

Explanation

Admission control that verifies image provenance and blocks unscanned or unsigned images prevents tampered artifacts from reaching production. Scanning alone detects known issues, while signature enforcement ensures only trusted builds are deployed.

Question 33Cloud Security Fundamentals and Architecture

What is the primary security purpose of isolating a cloud data plane from its management plane?

  1. To allow administrators to reach management endpoints from any network for convenience
  2. To ensure compromise of a workload does not directly grant control over the infrastructure managing it Correct answer.
  3. To reduce cloud costs by consolidating management traffic on the data network
  4. To eliminate the need for identity and access management on management APIs

Explanation

Separating planes limits how far an attacker can pivot: a compromised workload on the data plane should not be able to reach the APIs and networks that manage the platform. This containment is a core architectural principle for reducing blast radius.

Question 34Cloud Security Fundamentals and Architecture

An architect is designing a multi-tenant SaaS platform on shared cloud infrastructure. Which control is most important to prevent one tenant from reading another tenant's data?

  1. Adding rate limiting to public API endpoints
  2. Enforcing tenant context in every authorization decision and query at the application layer Correct answer.
  3. Encrypting all data with a single platform-wide key
  4. Relying on network segmentation between application tiers

Explanation

In multi-tenant systems, isolation depends on consistently binding each request to a tenant identity and enforcing that scope in authorization and data access. Without this, a single missing filter can expose cross-tenant records regardless of other controls.

Question 35Cloud Security Fundamentals and Architecture

Which practice best protects secrets such as database passwords used by cloud workloads?

  1. Sharing them in a configuration file readable by all workloads in the account
  2. Storing them in a managed secrets service and injecting them at runtime with short-lived credentials Correct answer.
  3. Committing them to a private repository so the team can audit changes
  4. Embedding them in container images so they are always available at runtime

Explanation

A managed secrets store centralizes access control, auditing, and rotation, and runtime injection avoids persisting credentials in artifacts. Short-lived credentials further reduce the value of any secret that leaks.

Question 36Cloud Security Fundamentals and Architecture

A security team wants cloud workloads to obtain credentials without storing long-term keys on disk. Which mechanism is designed for this?

  1. Instance or workload identity that issues short-lived tokens through a metadata service Correct answer.
  2. API keys embedded in environment variables
  3. Static access keys rotated every ninety days
  4. Shared service accounts with passwords stored in a vault

Explanation

Workload identity lets a compute instance or service assume a role and receive short-lived tokens from the platform, removing long-term secrets from the host. This limits the impact of host compromise because tokens expire quickly.

Question 37Cloud Security Fundamentals and Architecture

Which design most effectively protects a cloud account's root or superuser identity?

  1. Sharing it among the operations team to ensure availability
  2. Removing its long-lived credentials and reserving it for rare break-glass tasks with strong MFA Correct answer.
  3. Using it for daily administrative tasks so activity is easy to track
  4. Storing its credentials in the team wiki for quick access

Explanation

The root identity has unrestricted power, so best practice is to eliminate routine use, remove persistent credentials where possible, and require strong MFA for exceptional recovery tasks. Everyday administration should use federated roles with least privilege instead.

Question 38Cloud Security Fundamentals and Architecture

A company wants to guarantee that a workload cannot communicate with the public internet while still reaching required internal services. Which architecture achieves this?

  1. Attaching a public IP address but relying on host firewall rules to block outbound traffic
  2. Enabling verbose flow logging on the workload's network interface
  3. Deploying the workload in a private subnet with no internet gateway route and using private endpoints for required services Correct answer.
  4. Placing the workload behind a load balancer that terminates TLS

Explanation

Egress control is achieved at the routing layer: without a route to an internet gateway or NAT, traffic cannot leave the private network, and private endpoints satisfy dependencies without public exposure. Host firewalls and logging are weaker because they depend on correct local configuration or only observe traffic.

Question 39Cloud Security Fundamentals and Architecture

An organization operates workloads across two cloud providers and needs consistent identity, logging, and policy enforcement. Which architectural choice best supports this?

  1. Federating a central identity provider and normalizing logs and policy into a shared control layer Correct answer.
  2. Standardizing on one provider's native tools and applying them only where supported
  3. Managing each provider independently with separate identities and per-provider tooling
  4. Granting each provider's administrators cross-cloud credentials for convenience

Explanation

A multi-cloud control layer built on federated identity and normalized telemetry gives one consistent policy and visibility model across providers. Independent per-provider silos create gaps and inconsistent enforcement that attackers can exploit.

Question 40Cloud Security Fundamentals and Architecture

A company wants to prevent a compromised application from using its cloud role to delete backups in another account. Which combination of controls addresses this most directly?

  1. Scoping the role to only the actions and resources it needs and requiring a separate approval path for destructive operations Correct answer.
  2. Increasing the application's role permissions so failures are resolved faster
  3. Encrypting the backups with a key the application can access
  4. Enabling detailed billing reports and reviewing spend anomalies weekly

Explanation

Least-privilege scoping removes the destructive permissions from the application's reachable role, and an approval or break-glass path ensures sensitive operations require separate authorization. Together they contain the impact of a compromised workload even within the same cloud estate.

Question 41Cloud Identity and Access Management

In CrowdStrike Falcon Cloud Security, which capability is designed to detect identity-based threats such as anomalous privilege escalation and suspicious role assumption across cloud accounts?

  1. File integrity monitoring on cloud virtual machines
  2. Network flow analysis of east-west traffic between subnets
  3. Container image scanning for vulnerable base layers
  4. Cloud identity entitlement analysis with behavioral detection of identity risk Correct answer.

Explanation

Falcon Cloud Security includes cloud identity and entitlement visibility that maps permissions and detects risky or anomalous identity behavior such as privilege escalation and suspicious role assumption. The other capabilities address workload, host, and network risks rather than identity behavior.

Question 42Cloud Identity and Access Management

Which principle most directly reduces the blast radius of a compromised cloud workload identity?

  1. Granting the identity only the permissions its workload actually requires Correct answer.
  2. Attaching the identity to multiple accounts for redundancy
  3. Enabling verbose logging on the identity's API calls
  4. Rotating the identity's credentials on a fixed 90-day schedule

Explanation

Least privilege limits what a stolen or misused workload identity can do, shrinking the blast radius. Credential rotation, logging, and multi-account attachment manage or observe risk but do not bound the permissions the identity holds.

Question 43Cloud Identity and Access Management

A security team wants to detect when an IAM role in a cloud account is assumed from an unusual geographic location. Which data source is most directly relevant?

  1. Endpoint detection telemetry from developer laptops
  2. Web application firewall logs for inbound HTTP requests
  3. Cloud provider audit logs capturing AssumeRole and source IP events Correct answer.
  4. Container runtime logs from Kubernetes pods

Explanation

Role assumption events and the source IP or location are recorded in cloud audit logs such as CloudTrail-style trails, making them the primary source for this detection. Endpoint, WAF, and container logs do not record IAM role assumption context.

Question 44Cloud Identity and Access Management

Which practice best supports secure federation between an external identity provider and a cloud environment?

  1. Validating issuer, audience, and subject conditions in the trust policy Correct answer.
  2. Disabling token expiration to avoid re-authentication
  3. Sharing long-lived access keys with the identity provider
  4. Granting the federated role full administrative permissions

Explanation

Federated trust should be constrained by issuer, audience, and subject conditions so tokens from unintended sources cannot assume the role. Long-lived keys, non-expiring tokens, and administrative grants all weaken the federation model.

Question 45Cloud Identity and Access Management

What is the primary security purpose of analyzing cloud identity entitlements across multiple accounts?

  1. Measuring the cost of identity provider licensing
  2. Identifying excessive or unused permissions that expand attack surface Correct answer.
  3. Benchmarking CPU utilization of identity services
  4. Confirming that MFA hardware ships on schedule

Explanation

Entitlement analysis surfaces excessive, unused, or risky permissions that increase exposure if an identity is compromised. Licensing cost, compute utilization, and hardware logistics are operational concerns unrelated to entitlement risk.

Question 46Cloud Identity and Access Management

Which control most directly mitigates the risk of a stale, unused service account being exploited in a cloud environment?

  1. Increasing the account's password complexity requirements
  2. Disabling or removing the account after confirming it is no longer needed Correct answer.
  3. Enabling console access for the service account
  4. Adding the account to a second administrative group

Explanation

Unused identities are prime targets because no one notices their misuse; disabling or removing them eliminates the exposure. Adding privileges, changing password rules, or enabling console access increases rather than reduces risk.

Question 47Cloud Identity and Access Management

In a cloud environment, what does the term 'confused deputy' most closely describe in an identity context?

  1. A trusted service being tricked into acting on behalf of an unauthorized principal Correct answer.
  2. A user who forgets which account they are logged into
  3. A role that has two owners in the identity provider
  4. A token that expires earlier than its configured lifetime

Explanation

A confused deputy occurs when a privileged service is manipulated into performing actions for a principal that should not have that access. The other options describe user error or configuration details rather than the confused deputy pattern.

Question 48Cloud Identity and Access Management

Which statement best describes the role of conditional access policies in cloud identity security?

  1. They replace the need for identity provider authentication
  2. They scan container images for known vulnerabilities
  3. They evaluate context such as device posture and location before granting access Correct answer.
  4. They encrypt data at rest within cloud storage buckets

Explanation

Conditional access evaluates signals such as device compliance, location, and risk before allowing access, adding context-aware enforcement. It does not perform storage encryption, replace authentication, or scan images.

Question 49Cloud Identity and Access Management

A cloud team discovers that a CI/CD pipeline role can assume a production deployment role from any branch. Which change best reduces this risk?

  1. Restrict the trust policy to the specific repository and branch conditions required Correct answer.
  2. Enable verbose logging on the deployment role
  3. Rotate the pipeline role credentials every 24 hours
  4. Increase the deployment role's session duration

Explanation

Scoping the trust policy to specific repository and branch conditions prevents pipelines on other branches from assuming the role. Rotation, logging, and longer sessions do not stop unauthorized branch pipelines from assuming the role.

Question 50Cloud Identity and Access Management

An organization wants to enforce that all human access to production cloud accounts uses short-lived federated sessions rather than static access keys. Which combination best achieves this?

  1. A single service account used by all engineers
  2. Identity provider federation with session policies and denial of long-lived key creation Correct answer.
  3. Per-user access keys rotated manually each quarter
  4. Shared root account credentials stored in a vault

Explanation

Federation issues short-lived sessions, and session policies plus explicit denial of long-lived key creation enforce the requirement. Shared root credentials, manual key rotation, and shared service accounts all rely on static credentials and weaken accountability.