Security, Identity, and Compliance
What the exam tests
This domain tests least-privilege access, secret handling, encryption, auditing, and compliance evidence in IBM Cloud. Expect IAM identities and policies, service IDs, API keys, trusted profiles, Secrets Manager, Key Protect, Certificate Manager, Activity Tracker, Security and Compliance Center, and VPC security controls.
Core rules
- IAM policies grant roles to identities on resources, resource groups, or the account. Scope narrowly; account-wide Administrator is rarely appropriate for workloads.
- Service IDs represent applications. Create an API key for a service ID, store it securely, and rotate it. Trusted profiles can reduce long-lived credentials for supported compute.
- Use Secrets Manager for application credentials and certificates; use Key Protect for encryption key management. They solve different problems.
- Enable Activity Tracker event routing to retain audit evidence. Route events to a destination such as Cloud Object Storage or Event Streams and protect that destination.
- Encrypt data at rest and in transit. Use private endpoints where available. Apply security groups and network ACLs defensively.
- Security and Compliance Center helps assess posture against controls; it does not replace actual configuration and evidence review.
- Review access regularly and separate duties between deployment, audit, and key administration.
Worked example. An application needs to read one Cloud Object Storage bucket. Create a service ID, grant the Reader role on that bucket only rather than at account scope, create an API key, store it in Secrets Manager, and configure rotation. Run the workload as the service ID. Reasoning: resource-scoped permission limits blast radius; Secrets Manager avoids credentials in configuration files; Activity Tracker records key and policy activity for audit.
Traps that cost marks
Granting account-wide Administrator to a workload; sharing one API key across teams; committing keys to Git; ignoring resource-group scope in policies; disabling audit logging; confusing Key Protect with Secrets Manager; treating a compliance dashboard as proof that controls operate.
Key points
- Grant IAM roles at the narrowest practical scope.
- Service IDs and rotated API keys represent applications.
- Secrets Manager stores credentials; Key Protect manages encryption keys.
- Activity Tracker provides audit evidence and must be routed and retained.
- Review access and separate duties regularly.