I85PREP
⌘ K
IBM Cloud Security Engineer study materials
IBM Cloud Security Engineer study resources

IBM Cloud Security Engineer practice questions

One question at a time. Build your IBM Cloud Security Engineer understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cloud Security Fundamentals and Governance

In IBM Cloud, which construct is the primary boundary for isolating and organizing resources, access policies, and billing within an enterprise account?

  1. API key
  2. Service ID
  3. Resource group Correct answer.
  4. Access group

Explanation

Resource groups are the fundamental containers in an IBM Cloud account for organizing resources so that access and usage can be managed and billed together. Access policies are commonly scoped to a resource group, making it the primary isolation boundary. Access groups, service IDs, and API keys are identity and authorization constructs rather than resource containers.

Question 2Cloud Security Fundamentals and Governance

Which IBM Cloud IAM policy attribute determines the specific actions a subject can perform on a resource, such as Viewer, Editor, or Manager?

  1. Service endpoint
  2. Role Correct answer.
  3. Resource group
  4. Region

Explanation

In IBM Cloud IAM, the role defines what actions an identity may take on a resource, with platform roles and service access roles expressing different levels of permission. Resource group and region scope where the policy applies, not what actions are allowed. Endpoints are network addresses, not authorization attributes.

Question 3Cloud Security Fundamentals and Governance

A security engineer needs to give an application running in IBM Cloud Kubernetes Service read-only access to a Cloud Object Storage bucket without embedding long-lived credentials. Which approach best follows least-privilege and credential-hygiene principles?

  1. Create a service ID with a Viewer policy on the bucket and generate a non-expiring API key stored in a ConfigMap.
  2. Assign a service ID with a narrowly scoped policy and let the pod obtain short-lived tokens through its trusted profile or service account binding. Correct answer.
  3. Use the account owner's API key in the pod environment so the application inherits full permissions.
  4. Create an access group containing all account users and grant it Editor on the resource group.

Explanation

Binding a workload to a narrowly scoped identity and issuing short-lived tokens avoids storing static secrets and limits blast radius. This reflects least privilege and reduces the risk of leaked long-lived credentials. Broad identities or account-wide access groups violate least privilege.

Question 4Cloud Security Fundamentals and Governance

Which IBM Cloud capability provides a consolidated, tamper-evident record of administrative and data-access events across services for compliance auditing?

  1. Flow Logs for VPC
  2. Cloud Internet Services
  3. Activity Tracker Correct answer.
  4. Key Protect

Explanation

Activity Tracker records account-level and service-level audit events such as logins, policy changes, and resource modifications, and can route them to storage for retention and analysis. VPC flow logs capture network traffic metadata rather than audit events. Cloud Internet Services provides edge security and DNS, and Key Protect manages encryption keys.

Question 5Cloud Security Fundamentals and Governance

An organization must prove that encryption keys protecting regulated data are stored in a hardware security module and that key use is logged separately from the data. Which IBM Cloud service best meets this requirement?

  1. Key Protect
  2. Secrets Manager
  3. Hyper Protect Crypto Services Correct answer.
  4. Context-Based Restrictions

Explanation

Hyper Protect Crypto Services provides dedicated, FIPS 140-2 Level 4 validated HSM-backed key management with keep-your-own-key capability, giving strong assurance for regulated workloads. Key Protect is a shared multi-tenant key management service with a lower assurance level. Secrets Manager stores secrets, and Context-Based Restrictions enforces network-level access rules.

Question 6Cloud Security Fundamentals and Governance

Which IBM Cloud IAM feature lets an administrator restrict access to a service based on the network zone or IP range from which a request originates?

  1. Access groups
  2. Service credentials
  3. Trusted profiles
  4. Context-Based Restrictions Correct answer.

Explanation

Context-Based Restrictions define rules that evaluate the network context of a request, such as allowed IP ranges or VPC zones, in addition to IAM policies. Access groups and trusted profiles establish identity, and service credentials deliver credentials to applications. Only Context-Based Restrictions adds a network-context condition to authorization.

Question 7Cloud Security Fundamentals and Governance

A compliance team requires that all Cloud Object Storage buckets in an account deny public access unless an explicit exception is approved. Which IBM Cloud governance mechanism is designed to enforce such account-wide guardrails?

  1. Account-level settings and enforced policies in the IBM Cloud console governance area Correct answer.
  2. Resource groups
  3. IAM access policies
  4. VPC security groups

Explanation

IBM Cloud provides account-level governance controls, including enforced policies, that administrators can use to prevent configuration changes that violate organizational standards across the account. Resource groups and IAM policies grant access but do not enforce configuration guardrails. Security groups filter network traffic rather than storage configuration.

Question 8Cloud Security Fundamentals and Governance

In IBM Cloud IAM, what is the purpose of a trusted profile?

  1. To aggregate billing across multiple enterprise accounts
  2. To define the geographic regions where a service can be provisioned
  3. To establish a trust relationship that lets federated or compute identities assume an IAM identity without static credentials Correct answer.
  4. To store encrypted application secrets for retrieval at runtime

Explanation

A trusted profile creates a trust relationship between an external identity source, such as a compute resource or an identity provider, and an IBM Cloud IAM identity. Workloads can then obtain short-lived tokens without static API keys. It does not store secrets, constrain regions, or handle billing.

Question 9Cloud Security Fundamentals and Governance

Which statement correctly describes the IBM Cloud shared responsibility model for a managed platform service such as IBM Cloud Databases?

  1. IBM is responsible for all security controls, including customer IAM policies and data content.
  2. IBM is responsible for the physical infrastructure and the managed service software, while the customer remains responsible for identity, access, data classification, and configuration choices. Correct answer.
  3. The customer is responsible for patching the underlying database engine and host operating system.
  4. The customer is responsible for physical data center security because they own the account.

Explanation

Under the shared responsibility model, IBM secures the physical infrastructure and operates the managed service, while the customer retains responsibility for identity and access management, data protection decisions, and secure configuration. Customers never patch the provider-managed host for a fully managed service. Neither party is solely responsible for every control.

Question 10Cloud Security Fundamentals and Governance

Which IBM Cloud service is used to centrally store, rotate, and control access to application secrets such as database passwords and TLS private keys?

  1. Secrets Manager Correct answer.
  2. App ID
  3. Activity Tracker
  4. Certificate Manager

Explanation

Secrets Manager stores arbitrary secrets, supports rotation and access control, and can integrate with IAM so applications retrieve secrets at runtime. App ID handles authentication for applications, Certificate Manager manages public TLS certificates, and Activity Tracker records audit events.

Question 11Cloud Security Fundamentals and Governance

A security team wants every new VPC to be created with a default security group that blocks all inbound traffic except from an approved bastion. Which IBM Cloud approach best enforces this consistently across teams?

  1. Use account-level enforced policies or a provisioning pipeline with a hardened Terraform template that applies the approved security group rules. Correct answer.
  2. Rely on each team to configure security groups manually and audit quarterly.
  3. Enable Activity Tracker and review logs after an incident.
  4. Grant all developers Manager role on the VPC service so they can fix misconfigurations themselves.

Explanation

Consistent guardrails require preventive controls, such as enforced account policies or infrastructure-as-code pipelines that apply approved configurations by default. Manual configuration and after-the-fact log review are detective, not preventive. Broad Manager roles increase risk rather than enforce standards.

Question 12Cloud Security Fundamentals and Governance

Which IBM Cloud IAM identity type is intended for applications and automated workloads rather than individual users?

  1. Service ID Correct answer.
  2. Trusted profile
  3. Access group
  4. User

Explanation

A service ID represents an application or service rather than a human user and can be assigned policies and API keys. Access groups are collections of identities, users represent humans, and trusted profiles establish trust relationships rather than serving as the workload identity itself.

Question 13Cloud Security Fundamentals and Governance

What is the main security benefit of assigning IAM policies to access groups rather than to individual users?

  1. It encrypts all resources owned by group members.
  2. It centralizes permission management so membership changes automatically grant or revoke the group's permissions. Correct answer.
  3. It bypasses Context-Based Restrictions for group members.
  4. It eliminates the need for multi-factor authentication.

Explanation

Access groups let administrators manage permissions once at the group level; adding or removing a user changes their effective access immediately. This reduces policy sprawl and orphaned permissions. Access groups do not affect MFA, encryption, or network-context restrictions.

Question 14Cloud Security Fundamentals and Governance

An auditor asks how to demonstrate that no one has modified a Cloud Object Storage bucket's IAM policy in the past 90 days. Which IBM Cloud evidence source is most appropriate?

  1. VPC flow logs filtered to the storage endpoint
  2. Activity Tracker events for IAM policy changes routed to a retained logging destination Correct answer.
  3. The bucket's public access setting in the console
  4. Cloud Internet Services analytics

Explanation

IAM policy changes generate Activity Tracker events that record who made the change and when; routing them to a retained destination preserves the evidence for audit. Flow logs show network traffic, console settings show current state only, and edge analytics are unrelated to IAM changes.

Question 15Cloud Security Fundamentals and Governance

Which IBM Cloud feature helps an organization classify and protect data by discovering where sensitive information resides across supported data stores?

  1. Context-Based Restrictions
  2. Virtual Private Endpoints
  3. IBM Cloud Data Shield
  4. Data Security Broker Correct answer.

Explanation

IBM Cloud data security offerings include discovery and classification capabilities that scan supported data stores to locate sensitive data so it can be protected appropriately. Data Shield provides runtime encryption of data in use. Context-Based Restrictions and Virtual Private Endpoints are access and network controls, not data discovery tools.

Question 16Cloud Security Fundamentals and Governance

A team wants traffic to a Cloud Object Storage instance to stay on the private IBM Cloud network and never traverse the public internet. Which IBM Cloud capability should they use?

  1. Public service endpoint with TLS
  2. Virtual Private Endpoint (VPE) gateway Correct answer.
  3. Floating IP
  4. Public gateway

Explanation

A Virtual Private Endpoint creates a private IP address inside a VPC that routes service traffic over the IBM Cloud private backbone. Public endpoints, floating IPs, and public gateways all involve public network paths and do not meet the private-only requirement.

Question 17Cloud Security Fundamentals and Governance

Which IBM Cloud IAM concept allows a policy to be scoped so that it applies only to a specific instance of a service rather than to all instances in the account?

  1. API key scope
  2. Service endpoint type
  3. Account type
  4. Resource attribute in the policy Correct answer.

Explanation

IAM policies can include resource attributes, such as a specific service instance or resource ID, to narrow the scope of the permission. API keys inherit the permissions of their identity, endpoints are network addresses, and account type describes billing structure, not policy scope.

Question 18Cloud Security Fundamentals and Governance

Which practice best supports the principle of separation of duties in an IBM Cloud enterprise account?

  1. Using a single shared API key for all automation
  2. Assigning the account owner role to every administrator for convenience
  3. Dividing responsibilities so that the team that deploys workloads cannot also approve or modify the audit and key management controls protecting them Correct answer.
  4. Granting all developers the Manager role on Key Protect

Explanation

Separation of duties prevents one person or team from both performing an action and controlling the safeguards that detect or restrict it. Keeping deployment and audit or key management responsibilities distinct reduces the risk of undetected misuse. Shared credentials and broad key management roles undermine this control.

Question 19Cloud Security Fundamentals and Governance

What is the role of the IBM Cloud IAM policy condition that references a resource group?

  1. It determines the billing currency for the account.
  2. It selects the geographic region where the resource is deployed.
  3. It limits the policy's effect to resources that belong to the specified resource group. Correct answer.
  4. It defines which users may log in with multi-factor authentication.

Explanation

Including a resource group in an IAM policy restricts the granted permissions to resources contained in that group. It does not govern authentication factors, region selection, or billing currency. This scoping is a core mechanism for organizing and isolating access.

Question 20Cloud Security Fundamentals and Governance

A company must ensure that encryption keys for a regulated workload can be immediately revoked if a compromise is suspected, while retaining the ability to recover data after an accidental deletion. Which key management practice supports both goals?

  1. Share the root key with all application teams so they can decrypt data independently.
  2. Store the only copy of the key in a developer laptop for fast access.
  3. Disable all audit logging on the key management service to reduce noise.
  4. Use a managed key management service with key versioning, controlled destroy permissions, and a documented rotation and recovery procedure. Correct answer.

Explanation

A managed key management service with versioning, tightly controlled destroy permissions, and a documented procedure allows rapid revocation while preserving recoverability through rotation and retained versions. Storing keys locally, disabling audit, or broadly sharing root keys increases risk and undermines both goals.

Question 21Cloud Security Fundamentals and Governance

Which IBM Cloud tool provides a centralized view of security and compliance posture across an account by aggregating findings from multiple services?

  1. Security and Compliance Center Correct answer.
  2. Flow Logs for VPC
  3. Activity Tracker
  4. App ID

Explanation

Security and Compliance Center aggregates posture and compliance results, evaluates resources against controls, and helps track remediation across the account. Activity Tracker records events, flow logs capture network metadata, and App ID handles application authentication.

Question 22Cloud Security Fundamentals and Governance

In IBM Cloud, what does enabling multi-factor authentication at the account level accomplish?

  1. It requires users to present a second factor in addition to a password when authenticating, reducing risk from stolen passwords. Correct answer.
  2. It replaces the need for IAM policies.
  3. It blocks all API traffic that does not use private endpoints.
  4. It encrypts all data at rest in the account automatically.

Explanation

Account-level MFA enforcement requires an additional verification factor during login, which mitigates credential theft. It does not provide data-at-rest encryption, substitute for authorization policies, or restrict API traffic to private endpoints. Those goals require separate controls.

Question 23Cloud Security Fundamentals and Governance

A security engineer is designing a landing zone for multiple business units in one IBM Cloud account. Which combination best supports isolation and governance?

  1. A single resource group shared by all units with a single shared service ID
  2. One access group containing every user with Manager role on all services
  3. No resource groups, relying on naming conventions to distinguish resources
  4. Separate resource groups per unit with scoped IAM policies, enforced account guardrails, and centralized Activity Tracker routing Correct answer.

Explanation

Separate resource groups with scoped policies provide isolation, account guardrails prevent noncompliant configuration, and centralized audit routing preserves oversight. Shared identities or a flat account without resource groups remove the boundaries needed for governance and least privilege.

Question 24Cloud Security Fundamentals and Governance

Which IBM Cloud IAM platform role is typically the minimum needed for a user to view resources and their configuration without making changes?

  1. Operator
  2. Administrator
  3. Editor
  4. Viewer Correct answer.

Explanation

The Viewer platform role grants read-only visibility into resources and their settings. Editor and Administrator allow modifications, and Operator permits lifecycle actions such as starting or stopping resources. Viewer is therefore the least-privilege choice for read-only access.

Question 25Cloud Security Fundamentals and Governance

An application currently uses a static API key stored in source control. Which remediation best aligns with IBM Cloud security best practices?

  1. Grant the key broader permissions so that fewer keys are needed.
  2. Move the key to an encrypted repository and continue using it indefinitely.
  3. Replace the static key with a trusted profile or service ID whose credentials are fetched at runtime from Secrets Manager and rotated automatically. Correct answer.
  4. Rotate the key monthly but keep it in source control for convenience.

Explanation

Removing secrets from source control and replacing static credentials with short-lived or automatically rotated credentials limits exposure and supports least privilege. Periodic rotation of a committed key still leaves it exposed, and broadening permissions increases the blast radius of any leak.

Question 26Cloud Security Fundamentals and Governance

An IBM Cloud account administrator wants to ensure that all users authenticate with a second factor when they log in through the IBM Cloud console. Which account-level setting should the administrator enable?

  1. A service ID with an API key
  2. A context-based restriction policy
  3. Account-level multi-factor authentication Correct answer.
  4. A trusted profile for each user

Explanation

Account-level multi-factor authentication (MFA) requires users to provide a second verification factor at login, strengthening identity assurance for console and CLI access. It is configured once for the account and applies to all users, making it the correct control for enforcing a second factor globally.

Question 27Cloud Security Fundamentals and Governance

A security engineer must ensure that a new IBM Cloud service instance can be accessed only from a specific VPC and not from the public internet. Which IBM Cloud capability directly enforces this network-level restriction?

  1. Context-based restrictions with a network zone Correct answer.
  2. A trusted profile attached to the VPC
  3. IAM access groups with the Viewer role
  4. Activity Tracker event routing

Explanation

Context-based restrictions evaluate rules that include network zones, allowing administrators to permit access only from specified VPCs or IP ranges. This directly enforces the requirement to block public internet access while allowing the designated VPC.

Question 28Cloud Security Fundamentals and Governance

An organization wants to grant a team of auditors read-only access to all resources in a specific resource group without managing each user individually. Which IBM Cloud IAM construct is designed for this purpose?

  1. An access group with a policy scoped to the resource group Correct answer.
  2. A trusted profile with a federated identity
  3. A service ID with an API key
  4. A context-based restriction rule

Explanation

Access groups let administrators assign a single IAM policy to many users, simplifying permission management. Scoping the policy to a resource group limits the auditors' read-only access to resources within that group, which meets the requirement without per-user policies.

Question 29Cloud Security Fundamentals and Governance

A compliance officer needs to prove that a privileged user's IBM Cloud IAM policy was not changed during a specific week. Which IBM Cloud service should be used to retrieve the relevant audit events?

  1. IBM Cloud Logs
  2. IBM Cloud Activity Tracker Correct answer.
  3. IBM Cloud Security and Compliance Center
  4. IBM Cloud Monitoring

Explanation

Activity Tracker captures and stores audit events for IBM Cloud account activity, including IAM policy changes. Querying Activity Tracker for the relevant time range provides the evidence needed to demonstrate that no unauthorized modification occurred.

Question 30Cloud Security Fundamentals and Governance

A developer needs to deploy an application that must authenticate to IBM Cloud services without storing long-term credentials in code. Which approach aligns with IBM Cloud security best practices?

  1. Create a user account for the application and share its password with the team
  2. Use a trusted profile to obtain short-lived credentials for the compute resource Correct answer.
  3. Embed a static API key in the application's environment variables
  4. Store a service ID API key in a public configuration file

Explanation

Trusted profiles allow compute resources such as virtual servers or Kubernetes workloads to obtain temporary, automatically rotated credentials, eliminating the need for long-term secrets in code. This reduces the risk of credential leakage and aligns with the principle of least privilege.

Question 31Cloud Security Fundamentals and Governance

Which IBM Cloud IAM platform role provides the minimum permissions necessary to view a service instance's configuration without allowing changes?

  1. Viewer Correct answer.
  2. Editor
  3. Administrator
  4. Operator

Explanation

The Viewer platform role grants read-only access to view resources and their configuration but does not permit modifications. It is the least-privileged platform role suitable for inspection tasks.

Question 32Cloud Security Fundamentals and Governance

A security team wants to ensure that a Cloud Object Storage bucket cannot be made public even if an administrator accidentally grants public access. Which IBM Cloud feature should be used to enforce this guardrail?

  1. An IAM access group with the Writer role
  2. A context-based restriction that denies public network access to the bucket Correct answer.
  3. A service ID with an API key
  4. Activity Tracker event routing

Explanation

Context-based restrictions can enforce network-level guardrails that deny access from public networks, preventing public exposure even if an IAM policy is misconfigured. This provides a defense-in-depth control against accidental public access.

Question 33Cloud Security Fundamentals and Governance

Which statement best describes the IBM Cloud shared responsibility model for a managed platform service such as IBM Cloud Kubernetes Service?

  1. IBM is responsible for the physical infrastructure and managed control plane, while the customer is responsible for securing workloads and configurations they deploy. Correct answer.
  2. Security responsibilities are shared equally for every component, with no distinction between provider and customer.
  3. The customer is responsible for the physical data center security and hypervisor patching.
  4. IBM is responsible for all aspects of security, including customer application code and data.

Explanation

In the shared responsibility model, IBM secures the underlying cloud infrastructure and managed services, while customers remain responsible for their own workloads, configurations, and data. This division means customers must secure what they deploy on top of the managed platform.

Question 34Cloud Security Fundamentals and Governance

An enterprise wants to centrally manage encryption keys for multiple IBM Cloud services and ensure that keys can be rotated and revoked quickly. Which IBM Cloud service should be used?

  1. IBM Cloud IAM
  2. IBM Cloud Object Storage
  3. IBM Cloud Key Protect Correct answer.
  4. IBM Cloud Activity Tracker

Explanation

IBM Cloud Key Protect is a key management service that provides centralized creation, rotation, and revocation of encryption keys for IBM Cloud services. It integrates with services such as Cloud Object Storage to manage data encryption keys.

Question 35Identity and Access Management in IBM Cloud

In IBM Cloud IAM, which construct is the primary unit that groups users and service IDs so that access policies can be assigned to many identities at once?

  1. Resource group
  2. API key
  3. Trusted profile
  4. Access group Correct answer.

Explanation

Access groups are the IAM construct that aggregates users and service IDs so a single policy can grant access to all members, simplifying administration and audit. Resource groups organize resources for billing and access scoping, not identities. API keys are credentials, and trusted profiles are compute-identity mechanisms.

Question 36Identity and Access Management in IBM Cloud

An administrator wants a policy that grants a user the ability to view all resources in an account without allowing modification. Which IAM role should be assigned at the account level?

  1. Operator
  2. Viewer Correct answer.
  3. Editor
  4. Administrator

Explanation

The Viewer platform role grants read-only visibility to resources in scope and is the least-privileged choice for viewing. Editor and Administrator both permit changes, and Operator is a service-access role tied to resource operations rather than broad read visibility.

Question 37Identity and Access Management in IBM Cloud

Which statement correctly distinguishes platform roles from service-access roles in IBM Cloud IAM?

  1. Platform roles and service-access roles are interchangeable aliases for the same permission set.
  2. Platform roles apply only to service IDs, while service-access roles apply only to federated users.
  3. Platform roles govern data-plane operations inside a service, while service-access roles govern account-level billing visibility.
  4. Platform roles govern actions on the resource container such as creating or deleting instances, while service-access roles govern actions inside the service such as reading data. Correct answer.

Explanation

IBM Cloud separates control-plane permissions (platform roles like Viewer, Editor, Administrator, Operator) from data-plane permissions (service-access roles such as Reader, Writer, Manager). A policy can carry both role types, and each type applies to a different layer of the resource.

Question 38Identity and Access Management in IBM Cloud

A security engineer must give an application running in a compute resource short-lived credentials without storing a long-lived API key. Which IBM Cloud capability is designed for this?

  1. Account ownership transfer
  2. Trusted profiles Correct answer.
  3. Access groups
  4. Classic infrastructure API keys

Explanation

Trusted profiles use compute resource identity (for example, based on workload identity or instance metadata) to issue short-lived tokens, eliminating stored long-lived secrets. Access groups only aggregate identities, and classic API keys are long-lived credentials.

Question 39Identity and Access Management in IBM Cloud

What is the purpose of an IBM Cloud service ID?

  1. It is the identifier used to federate an external identity provider with the account.
  2. It is a temporary token issued to a user after multifactor authentication.
  3. It is the unique identifier for a resource group within an account.
  4. It represents an application or service rather than a human user so that policies and API keys can be bound to it. Correct answer.

Explanation

A service ID is a non-human identity used to bind access policies and API keys to applications or services. It is distinct from user identities, resource group IDs, and identity-provider federation configuration.

Question 40Identity and Access Management in IBM Cloud

A user needs to authenticate to the IBM Cloud CLI and obtain a short-lived IAM access token. Which command accomplishes this interactively?

  1. ibmcloud login Correct answer.
  2. ibmcloud account show
  3. ibmcloud iam api-key-create
  4. ibmcloud resource service-instance-create

Explanation

The `ibmcloud login` command authenticates the CLI session and caches a short-lived IAM token for subsequent commands. The other commands either create credentials or inspect account resources but do not establish an authenticated session.

Question 41Identity and Access Management in IBM Cloud

Which IBM Cloud IAM policy attribute most directly limits which resources a policy applies to when multiple services share an account?

  1. The CLI version in use
  2. The user's email domain
  3. Resource type and resource Correct answer.
  4. The account's billing country

Explanation

IAM policies can be scoped by service, resource type, and specific resource identifier so that permissions apply narrowly. Attributes such as email domain, billing country, and CLI version are not policy scoping attributes in IBM Cloud IAM.

Question 42Identity and Access Management in IBM Cloud

An auditor asks how to review which access policies are attached to a specific access group. Which approach is appropriate in IBM Cloud IAM?

  1. Read the account's billing invoice to infer effective permissions.
  2. Inspect the resource group's tags to derive policy assignments.
  3. List the access group's policies through the IAM API or CLI and inspect the associated roles and scopes. Correct answer.
  4. Query the activity tracker for the group's creation timestamp.

Explanation

Access group policies are first-class IAM objects retrievable through the IAM API and CLI, exposing role and scope details. Billing invoices, resource tags, and creation timestamps do not enumerate policy assignments.

Question 43Identity and Access Management in IBM Cloud

Which statement best describes how IBM Cloud IAM evaluates a user's effective access when the user belongs to multiple access groups?

  1. Only the policy from the most recently created group applies.
  2. The most restrictive policy across all groups determines effective access.
  3. Access is the union of permissions granted by all applicable policies, with no deny rules overriding grants. Correct answer.
  4. Access is determined by the group with the most members.

Explanation

IBM Cloud IAM is an additive, allow-based model: effective permissions are the union of all policies that apply to the identity. There are no explicit deny rules that subtract from granted access, and recency or group size is irrelevant.

Question 44Identity and Access Management in IBM Cloud

What is the recommended practice for managing API keys used by production automation in IBM Cloud?

  1. Use a single account-level key for every environment and never rotate it.
  2. Create the key for a human administrator and share it among all operators.
  3. Create the key for a service ID, store it in a secrets manager, and rotate it on a schedule. Correct answer.
  4. Embed the key in source code so it is version-controlled.

Explanation

Automation should use service ID API keys stored in a secrets manager and rotated regularly to limit blast radius. Sharing human keys, hardcoding secrets, and using non-rotated account-wide keys all increase exposure.

Question 45Identity and Access Management in IBM Cloud

Which IBM Cloud IAM feature allows authentication through an external identity provider such as SAML or OIDC?

  1. Activity Tracker routing
  2. Service endpoint gateways
  3. Resource group quotas
  4. Identity provider federation Correct answer.

Explanation

IBM Cloud IAM supports federating accounts with external identity providers using SAML or OIDC so users authenticate at the provider and receive IBM Cloud access. Quotas, endpoint gateways, and activity routing are unrelated to authentication federation.

Question 46Identity and Access Management in IBM Cloud

A team wants users to authenticate with their corporate credentials and be placed automatically into an IBM Cloud access group based on an assertion. Which mechanism supports this?

  1. Disabling multifactor authentication for federated users
  2. Identity provider federation combined with access group membership rules Correct answer.
  3. Manually adding each user to the access group after first login
  4. Assigning account-level Administrator to every federated user

Explanation

Federated identities can be mapped to access groups through membership rules driven by identity-provider assertions, automating least-privilege onboarding. Manual addition, blanket Administrator grants, and disabling MFA all undermine security or scalability.

Question 47Identity and Access Management in IBM Cloud

What does an IBM Cloud IAM access token primarily contain that authorizes API calls?

  1. A permanent copy of all account API keys
  2. The user's plaintext password for re-authentication
  3. The account's full resource inventory
  4. A signed assertion of the identity and its granted roles for the token lifetime Correct answer.

Explanation

IAM access tokens are time-limited signed assertions carrying identity and authorization context used by services to make access decisions. They never contain passwords, API keys, or resource inventories.

Question 48Identity and Access Management in IBM Cloud

Which practice best supports the principle of least privilege when onboarding a new engineer who needs to deploy to one resource group only?

  1. Assign account-wide Administrator so future needs are covered.
  2. Assign an Editor role scoped to that resource group rather than account-wide Administrator. Correct answer.
  3. Grant access through a shared service ID API key.
  4. Assign the Operator platform role at the account level.

Explanation

Scoping the Editor role to the specific resource group grants the deployment capability needed while limiting reach to other resources. Account-wide Administrator, broad Operator, and shared keys all exceed the requirement.

Question 49Identity and Access Management in IBM Cloud

How does IBM Cloud IAM treat the account owner identity?

  1. The owner has no access until an explicit policy is created.
  2. The owner has full access to the account and its resources by virtue of ownership. Correct answer.
  3. The owner is limited to the Viewer role by default.
  4. The owner can only access resources through a service ID.

Explanation

The account owner holds inherent full access to the account and cannot be locked out by policy changes. Other identities, including administrators, derive access from policies but the owner's access is intrinsic.

Question 50Identity and Access Management in IBM Cloud

Which IBM Cloud service provides centralized audit records of IAM events such as policy creation and login activity?

  1. IBM Cloud Object Storage
  2. IBM Cloud Activity Tracker Correct answer.
  3. IBM Cloud Kubernetes Service
  4. IBM Cloud Internet Services

Explanation

Activity Tracker captures and routes audit events, including IAM policy changes and authentication events, for compliance monitoring. Object Storage, Kubernetes Service, and Internet Services are workload services, not audit event platforms.