I85PREP
⌘ K
CloudSec-Pro study materials
CloudSec-Pro study resources

CloudSec-Pro practice questions

One question at a time. Build your CloudSec-Pro understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cloud Governance, Risk, and Compliance

In a cloud shared responsibility model, which compliance activity remains the customer's obligation even when using a provider-managed platform service?

  1. Classifying and labeling the customer data stored in the service Correct answer.
  2. Patching the physical hypervisor hosts running the workload
  3. Certifying the provider's underlying network infrastructure
  4. Maintaining the provider's data center access controls

Explanation

Providers typically own physical security, hypervisor patching, and infrastructure certifications, while customers remain accountable for their own data classification, access decisions, and configuration. Data classification is a customer governance duty regardless of service model.

Question 2Cloud Governance, Risk, and Compliance

A cloud governance board wants a single authoritative inventory of approved cloud services and their risk ratings. Which artifact best serves this purpose?

  1. An export of the vulnerability scanner findings
  2. A service catalog with risk tiers assigned per service Correct answer.
  3. A monthly screenshot of the billing dashboard
  4. A list of open support tickets by severity

Explanation

A cloud service catalog records which services are approved for use and attaches governance metadata such as risk tier, owner, and control requirements. It becomes the reference point for policy enforcement and exception handling.

Question 3Cloud Governance, Risk, and Compliance

Which control type is a preventive cloud governance control?

  1. A quarterly reconciliation of cloud spend against budget
  2. An annual tabletop exercise simulating a data breach
  3. A weekly review of audit logs for anomalous API calls
  4. An organization policy constraint that blocks creation of public storage buckets Correct answer.

Explanation

Preventive controls stop an undesired action before it occurs, such as a policy constraint that denies public bucket creation. Detective controls identify events after the fact, and corrective controls restore state.

Question 4Cloud Governance, Risk, and Compliance

A regulated firm must prove to auditors that cloud resource configurations matched policy throughout the year. Which evidence approach is most defensible?

  1. A verbal attestation from the cloud platform team lead
  2. A one-time screenshot taken during the audit week
  3. Continuous configuration compliance scans retained with timestamps Correct answer.
  4. The provider's marketing security whitepaper

Explanation

Auditors need evidence that controls operated over the whole period, not at a single point. Continuous compliance scanning with retained, timestamped results demonstrates ongoing operation and supports trend analysis.

Question 5Cloud Governance, Risk, and Compliance

Which document should a cloud customer request to obtain an independent auditor's opinion on a provider's control environment?

  1. The provider's SOC 2 Type II report Correct answer.
  2. The provider's acceptable use policy
  3. The provider's public status page
  4. The provider's service level agreement

Explanation

A SOC 2 Type II report contains an independent auditor's opinion on the design and operating effectiveness of controls over a period. Status pages, SLAs, and acceptable use policies are operational or contractual documents, not assurance reports.

Question 6Cloud Governance, Risk, and Compliance

What is the primary purpose of a cloud risk register?

  1. To list the names of all cloud engineers on call
  2. To track identified cloud risks with owners, ratings, and treatment decisions Correct answer.
  3. To store encryption keys used by cloud workloads
  4. To record every API call made in production accounts

Explanation

A risk register is the governance record of identified risks, their likelihood and impact ratings, accountable owners, and chosen treatment such as mitigate, accept, transfer, or avoid. It supports prioritization and reporting to leadership.

Question 7Cloud Governance, Risk, and Compliance

Which practice best supports data residency compliance for workloads operating in multiple regions?

  1. Granting all engineers write access to every regional bucket
  2. Disabling resource tagging to simplify deployments
  3. Enabling cross-region replication by default for resilience
  4. Restricting data replication to approved geographic regions through policy Correct answer.

Explanation

Data residency obligations require that data remains within permitted jurisdictions, which is enforced by constraining replication and storage locations through policy. Default cross-region replication can silently move data outside approved boundaries.

Question 8Cloud Governance, Risk, and Compliance

In cloud GRC, what does a control mapping matrix primarily provide?

  1. A diagram of the network topology for each cloud region
  2. A cross-reference linking each control to the frameworks and requirements it satisfies Correct answer.
  3. A list of employee security training completions
  4. A schedule of planned maintenance windows

Explanation

Control mapping shows how a single implemented control satisfies requirements across multiple frameworks, reducing duplicated effort and supporting audit reuse. It is the basis for compliance crosswalks and gap analysis.

Question 9Cloud Governance, Risk, and Compliance

An organization wants to enforce that all new cloud storage buckets are encrypted with customer-managed keys. Which mechanism most directly enforces this at provisioning time?

  1. A monthly manual review of bucket encryption settings
  2. A training course on encryption best practices
  3. An organization policy constraint that denies bucket creation without the required key Correct answer.
  4. A dashboard showing encryption status across accounts

Explanation

Enforcement at provisioning time requires a guardrail that evaluates the request and denies noncompliant resources. Organization policy constraints apply uniformly across projects or accounts and prevent drift before it occurs.

Question 10Cloud Governance, Risk, and Compliance

A team needs to demonstrate that access to a production cloud account is reviewed regularly. Which control design best satisfies this requirement?

  1. Annual penetration testing of the production application
  2. Encryption of data at rest using provider-managed keys
  3. Quarterly access reviews with documented approver sign-off Correct answer.
  4. Real-time alerting on failed login attempts

Explanation

Periodic access reviews verify that only authorized identities retain entitlements and produce documented evidence of approval. Penetration tests, login alerting, and encryption address different risk areas and do not demonstrate entitlement recertification.

Question 11Cloud Governance, Risk, and Compliance

A cloud team discovers that a workload stores regulated data in a region not approved by the data protection office. What is the most appropriate immediate governance action?

  1. Delete all logs to avoid retaining evidence of the issue
  2. Disable all monitoring to prevent further findings
  3. Ignore the issue because the provider's region is certified
  4. Record the finding in the risk register and remediate by relocating data to an approved region Correct answer.

Explanation

A residency violation is a compliance finding that must be documented, assessed, and remediated through a controlled change such as migration to an approved region. Destroying evidence or suppressing monitoring would compound the violation.

Question 12Cloud Governance, Risk, and Compliance

Which metric best indicates whether a cloud compliance program is keeping configuration drift under control?

  1. Average number of deployments per engineer
  2. Percentage of resources compliant with policy at each scan Correct answer.
  3. Total number of cloud accounts provisioned
  4. Count of support cases closed last quarter

Explanation

Drift is measured by comparing actual configuration against policy baselines over time, so the compliant-resource percentage per scan directly reflects drift levels. Account counts, deployment frequency, and case closure measure other operational dimensions.

Question 13Cloud Governance, Risk, and Compliance

A company uses a provider's compliance certification to reduce its own audit scope. What limitation must the governance team document?

  1. The certification guarantees application-level security
  2. The certification is valid only during business hours
  3. The certification removes the need for any customer controls
  4. The certification covers the provider's infrastructure, not the customer's configurations Correct answer.

Explanation

Provider certifications address the provider's side of the shared responsibility model. Customer-managed configurations, identities, and data handling remain the customer's responsibility and must be evidenced separately.

Question 14Cloud Governance, Risk, and Compliance

An organization wants to formalize acceptable use of cloud services by staff and contractors. Which document is most appropriate?

  1. A network diagram of the corporate office
  2. A disaster recovery runbook for the payroll system
  3. A vendor invoice reconciliation report
  4. A cloud acceptable use policy acknowledged by each user Correct answer.

Explanation

An acceptable use policy defines permitted and prohibited behavior for users of cloud services and is enforced through acknowledgment and training. Runbooks, diagrams, and invoices serve operational or financial purposes rather than user conduct rules.

Question 15Cloud Governance, Risk, and Compliance

Which approach best aligns cloud governance with an existing enterprise risk management framework?

  1. Map cloud-specific risks into the enterprise risk taxonomy and report through existing risk committees Correct answer.
  2. Create a separate parallel risk process that never reports to leadership
  3. Rely solely on provider security bulletins for risk identification
  4. Delegate all cloud risk decisions to individual engineering teams

Explanation

Integrating cloud risks into the enterprise taxonomy and reporting chain ensures consistent scoring, ownership, and escalation. Standalone processes fragment accountability and often escape executive visibility.

Question 16Cloud Governance, Risk, and Compliance

A governance team must ensure cloud resources carry mandatory owner and data-classification tags. Which control combination is most effective?

  1. An email reminder sent to engineers each year
  2. A wiki page describing the tagging convention
  3. A one-time bulk tagging script run at project inception
  4. A policy requiring tags at creation plus periodic reporting on untagged resources Correct answer.

Explanation

Effective tagging governance pairs prevention, requiring tags at creation, with detection, reporting resources that lack required tags. Documentation alone leaves enforcement to individual discretion.

Question 17Cloud Governance, Risk, and Compliance

What is the primary role of a cloud center of excellence in governance?

  1. Negotiating employee compensation packages
  2. Defining standards and reusable patterns that business teams adopt Correct answer.
  3. Approving every individual deployment request manually
  4. Operating the provider's physical infrastructure

Explanation

A cloud center of excellence sets standards, guardrails, and reference architectures that enable teams to move quickly within compliant boundaries. It scales governance through reusable patterns rather than becoming a manual approval bottleneck.

Question 18Cloud Governance, Risk, and Compliance

A cloud contract clause states the provider will notify customers of material security incidents within a set period. Which governance activity validates this commitment?

  1. Relying on public news coverage to learn of incidents
  2. Removing incident response from the customer's own procedures
  3. Assuming notification occurs because it is written in the contract
  4. Reviewing incident notification records during vendor performance reviews Correct answer.

Explanation

Contractual commitments require monitoring to confirm they are honored. Reviewing notification timeliness and completeness during vendor reviews provides evidence and surfaces gaps for remediation.

Question 19Cloud Governance, Risk, and Compliance

Which scenario best illustrates residual risk in a cloud environment?

  1. Risk eliminated by moving workloads to a new region
  2. Risk remaining after encryption and access controls have been applied to a storage service Correct answer.
  3. Risk identified before any controls are designed
  4. Risk transferred entirely to the cloud provider by contract

Explanation

Residual risk is what remains after controls are implemented, and leadership must decide whether to accept it. Inherent risk exists before controls, and risk is rarely transferred entirely by contract.

Question 20Cloud Governance, Risk, and Compliance

An auditor asks how the organization ensures that encryption keys for regulated data are rotated. Which evidence is most persuasive?

  1. Key management configuration showing automatic rotation plus rotation event logs Correct answer.
  2. A list of employees who know the key custodian
  3. A screenshot of the key management console home page
  4. A statement in the security policy that keys should be rotated

Explanation

Persuasive evidence shows both the configured rotation mechanism and records proving rotations occurred. A policy statement expresses intent, and console screenshots do not demonstrate actual rotation events.

Question 21Cloud Governance, Risk, and Compliance

A multinational must satisfy both GDPR-style transfer restrictions and a local law requiring certain records to remain in country. Which governance design is most appropriate?

  1. Encryption of records without controlling their storage location
  2. Global replication of all records for maximum availability
  3. Region-pinned storage with policy-enforced restrictions and documented legal assessment Correct answer.
  4. Single-region storage with no legal review of transfer mechanisms

Explanation

Conflicting or overlapping residency obligations require location-pinned storage, technical enforcement, and a documented legal assessment of permitted transfers. Encryption alone does not satisfy location requirements.

Question 22Cloud Governance, Risk, and Compliance

A cloud governance team wants to reduce false positives in its policy-as-code pipeline without weakening enforcement. Which approach is most sound?

  1. Tier policies by risk, test them in a dry-run mode, then promote high-confidence rules to enforce Correct answer.
  2. Disable all deny rules to eliminate false positives
  3. Move all policy checks to an annual manual audit
  4. Grant engineers exemption rights to bypass any policy

Explanation

Risk-tiered policies with dry-run validation let teams observe impact and tune rules before enforcement, preserving protection for high-risk actions. Disabling deny rules or broad exemptions removes the control entirely.

Question 23Cloud Governance, Risk, and Compliance

During a regulatory examination, an examiner questions whether third-party cloud subprocessors were disclosed and approved. Which governance evidence is most directly responsive?

  1. The customer's internal network firewall rules
  2. The provider's uptime statistics for the past year
  3. A list of open feature requests submitted to the provider
  4. A maintained subprocessor register with approval dates and notification records Correct answer.

Explanation

Subprocessor obligations require tracking which downstream parties process data, when they were disclosed, and when approval or objection occurred. A maintained register with dates and notifications directly answers the examiner's question.

Question 24Cloud Governance, Risk, and Compliance

An organization operates under a model where business units own their cloud risk while a central team sets guardrails. Which failure mode most threatens this federated governance model?

  1. Central teams that publish reference architectures
  2. Guardrails that are unenforced and risk ownership that is undocumented Correct answer.
  3. Automated policy checks applied at provisioning time
  4. Business units that monitor their own compliance dashboards

Explanation

Federated models depend on enforceable guardrails and clear, documented risk ownership. If either is missing, business units can drift into unmanaged risk while assuming central coverage exists.

Question 25Cloud Governance, Risk, and Compliance

A risk committee must decide whether to accept a documented cloud control gap that cannot be remediated before a product launch. Which input is most essential to that decision?

  1. A quantified assessment of likelihood, impact, and compensating controls Correct answer.
  2. The number of features included in the release
  3. The provider's stock price trend over the quarter
  4. A count of how many engineers requested the launch date

Explanation

Risk acceptance decisions require an informed view of exposure, including likelihood, potential impact, and any compensating controls that reduce severity. Launch pressure, market data, and feature counts do not characterize the risk itself.

Question 26Cloud Governance, Risk, and Compliance

A cloud governance team is defining who is accountable when a business unit deploys an unapproved service. Under a federated governance model, which arrangement correctly assigns that accountability?

  1. The cloud service provider is accountable because it supplies the service catalog used for the deployment.
  2. Accountability is shared equally between the business unit and the central team for every deployment decision.
  3. The business unit is accountable for the risk it creates, while the central team is responsible for defining and operating the guardrails. Correct answer.
  4. The central cloud platform team is accountable because it operates the landing zone and guardrails.

Explanation

Federated governance separates accountability from operational responsibility: the business unit owns the risk of its own workloads, while the central team provides and maintains the guardrails that constrain those workloads. Shared or provider-held accountability blurs escalation paths and weakens risk ownership. The provider is never accountable for the customer's choice to use an unapproved service.

Question 27Cloud Governance, Risk, and Compliance

An organization wants to adopt the cloud provider's shared responsibility model in its governance documentation. Which statement correctly describes the split for an IaaS virtual machine running a customer operating system?

  1. The customer is responsible for the physical data center security because it owns the data stored on the VM.
  2. The provider is responsible for patching the guest operating system because it controls the hypervisor layer.
  3. Responsibility for the guest operating system is shared equally, with the provider applying patches and the customer approving them.
  4. The provider is responsible for the physical infrastructure and hypervisor, while the customer is responsible for the guest OS, patching, and identity configuration inside the VM. Correct answer.

Explanation

In IaaS, the provider secures facilities, hardware, and virtualization, while the customer secures everything from the guest operating system upward, including patching and identity configuration. The hypervisor does not extend the provider's patch responsibility into the guest OS. Physical data center security always remains with the provider.

Question 28Cloud Governance, Risk, and Compliance

A governance analyst is building a control matrix for a multi-cloud environment and must map a provider-specific configuration check to a recognized framework. Which approach produces the most defensible mapping?

  1. Map the check to the framework control whose stated objective the check directly satisfies, and record the evidence the check produces. Correct answer.
  2. Map the check to the framework control with the closest name, since naming conventions are standardized across frameworks.
  3. Map every provider check to the highest-severity framework control so that no requirement is left uncovered.
  4. Map the check only to the provider's own certification report because that report is the authoritative source.

Explanation

A defensible mapping links a technical check to the framework control whose objective it actually satisfies and records the evidence it generates, so auditors can trace requirement to implementation to proof. Over-mapping to high-severity controls inflates coverage and hides real gaps. Provider certifications describe the provider's environment, not the customer's control implementation, and control names are not reliably consistent across frameworks.

Question 29Cloud Governance, Risk, and Compliance

A regulated firm must prove to an examiner that its cloud environment has continuously met a specific configuration baseline over the past year. Which evidence strategy best satisfies that requirement?

  1. A time-series record of automated configuration assessments retained with the baseline version and exception approvals. Correct answer.
  2. An attestation letter from the cloud provider confirming that its own infrastructure met the baseline.
  3. Point-in-time screenshots of the configuration taken on the day of the examination.
  4. A one-time penetration test report completed before the baseline was adopted.

Explanation

Continuous compliance requires evidence that spans the whole period, so a retained time series of automated assessments tied to the baseline version and approved exceptions demonstrates sustained adherence. Point-in-time screenshots show only the examination day, and a provider attestation addresses the provider's environment rather than the customer's configuration.

Question 30Cloud Governance, Risk, and Compliance

A cloud risk committee is reviewing a vendor's SOC 2 Type II report and notices a bridge letter covering only part of the current period. What is the most appropriate governance conclusion?

  1. The report is sufficient because a Type II opinion covers controls over time and the bridge letter is optional.
  2. The committee can accept the report without further action if the provider's public trust page lists the same controls.
  3. The provider should be removed from the vendor inventory immediately because any gap invalidates the entire audit opinion.
  4. The uncovered gap must be treated as an evidence deficiency that increases residual risk until compensating evidence or a refreshed report is obtained. Correct answer.

Explanation

A SOC 2 Type II opinion covers a defined period, so any interval not addressed by the report or a bridge letter is an evidence gap that raises residual risk for the customer. Governance should seek compensating evidence, such as a refreshed report or additional attestations, rather than assuming coverage. A single gap does not automatically invalidate the entire opinion or require immediate removal.

Question 31Identity, Access, and Privilege Management in the Cloud

A cloud IAM policy uses an explicit Deny statement and an explicit Allow statement that both match the same API action for the same principal. How does a typical policy evaluation engine resolve this conflict?

  1. The explicit Deny wins over the Allow. Correct answer.
  2. The Allow statement wins because permissions are additive.
  3. The request fails with a syntax error until the conflict is removed.
  4. The statement with the most recent creation timestamp wins.

Explanation

Most cloud authorization engines evaluate every applicable policy and treat an explicit Deny as an override that cannot be outvoted by any Allow. This is why deny-based guardrails are a reliable way to enforce hard boundaries such as region restrictions. Implicit deny applies only when no statement matches at all.

Question 32Identity, Access, and Privilege Management in the Cloud

An organization wants a single identity that can sign in once and then access many separate SaaS and cloud applications without re-entering credentials. Which capability delivers this?

  1. Per-application local accounts synchronized by script
  2. Long-lived API access keys stored in each application
  3. A shared break-glass administrator credential
  4. Federated single sign-on using a central identity provider Correct answer.

Explanation

Federated SSO lets a central identity provider authenticate the user once and issue assertions or tokens that each relying application trusts. This centralizes authentication and deprovisions access in one place. Local per-app accounts and shared credentials multiply the attack surface instead.

Question 33Identity, Access, and Privilege Management in the Cloud

Which statement best describes the security purpose of role assumption in cloud IAM?

  1. It converts all permissions into a shared root credential.
  2. It permanently attaches a user's password to a service account.
  3. It disables logging so role actions cannot be audited.
  4. It issues temporary credentials scoped to a role's permissions. Correct answer.

Explanation

Role assumption returns short-lived credentials whose effective permissions are limited to the role's policy. Because the credentials expire, a leak has a bounded window of usefulness, and the assumption event can be logged. This contrasts with static long-lived keys.

Question 34Identity, Access, and Privilege Management in the Cloud

A security team wants to guarantee that no principal in the organization can disable audit logging, even if an administrator later attaches a broad Allow policy. What should they implement?

  1. A naming convention that discourages logging changes
  2. A service control policy or permission boundary with an explicit Deny on logging actions Correct answer.
  3. A longer password rotation interval for administrators
  4. A tag on the logging bucket marking it as sensitive

Explanation

Guardrails such as service control policies or permission boundaries cap the maximum permissions a principal can ever receive. An explicit Deny on logging-management actions inside such a guardrail survives later Allow grants. Naming conventions and tags are metadata and enforce nothing.

Question 35Identity, Access, and Privilege Management in the Cloud

A developer needs a workload running on a cloud virtual machine to call a storage API. Which approach best avoids embedding long-lived secrets in the instance?

  1. Email the key to the developer's personal mailbox for manual entry.
  2. Attach an instance or workload identity role that issues short-lived credentials. Correct answer.
  3. Store a static access key in a file on the instance's root volume.
  4. Hard-code the key in the application source repository.

Explanation

Workload identity mechanisms let the platform issue temporary credentials to the instance or service through a trusted metadata channel. No static secret is stored on disk or in source, and credentials rotate automatically. This limits the blast radius if the host is compromised.

Question 36Identity, Access, and Privilege Management in the Cloud

Which principle should guide the assignment of permissions to a newly created automation service account?

  1. Grant administrator rights so future needs are covered.
  2. Grant no permissions and rely on implicit defaults.
  3. Grant permissions equal to the most privileged human operator.
  4. Grant only the actions required for its defined tasks, reviewed periodically. Correct answer.

Explanation

Least privilege means granting the minimum permissions needed for the workload's actual function, then reviewing them as requirements change. This limits the impact of a compromised service account. Overbroad grants turn a small compromise into a large one.

Question 37Identity, Access, and Privilege Management in the Cloud

An organization wants to detect when a user account suddenly gains a highly privileged role outside the normal change process. Which control is most directly suited to this?

  1. Anomaly alerting on privileged role-assignment events in the audit log Correct answer.
  2. Increasing the session timeout for the administrative console
  3. Encrypting the identity provider's configuration database
  4. Rotating the TLS certificate on the identity provider

Explanation

Privilege escalation detection relies on monitoring audit events for role or policy assignments that deviate from the approved baseline. Alerting on these events surfaces both malicious escalation and process drift. Encryption, session timeouts, and certificates address different risks.

Question 38Identity, Access, and Privilege Management in the Cloud

What is the primary security benefit of enforcing multi-factor authentication for all human access to the cloud management console?

  1. It encrypts data at rest in storage services.
  2. It ensures audit logs are immutable.
  3. It removes the need for any authorization policies.
  4. It reduces the risk that a stolen password alone grants account access. Correct answer.

Explanation

MFA adds a second factor so that possession of a password by itself is insufficient to authenticate. This directly mitigates credential phishing and password reuse attacks. It does not replace authorization, logging integrity, or storage encryption.

Question 39Identity, Access, and Privilege Management in the Cloud

A company wants external partners to access specific internal resources using their own corporate identities rather than accounts created inside the company's cloud tenant. Which mechanism fits best?

  1. Creating local guest accounts with shared passwords for each partner
  2. Issuing the partners long-lived API keys for the internal resources
  3. Federating with the partners' identity providers through a trust relationship Correct answer.
  4. Publishing the internal resources to the public internet

Explanation

Federation establishes a trust between the company's resource provider and the partner's identity provider, so partners authenticate with their own credentials. Access is expressed through role mappings rather than duplicated local accounts. This keeps lifecycle management with the partner.

Question 40Identity, Access, and Privilege Management in the Cloud

In an OAuth 2.0 authorization code flow with PKCE for a public client, why is PKCE important?

  1. It eliminates the need for the authorization server to authenticate the resource owner.
  2. It encrypts the access token so intermediaries cannot read it.
  3. It replaces the need for scopes in the access token.
  4. It binds the token request to the original client using a code verifier, mitigating code interception. Correct answer.

Explanation

PKCE has the client send a derived challenge with the authorization request and the original verifier with the token request. An attacker who intercepts the authorization code cannot redeem it without the verifier. This protects public clients that cannot keep a client secret.

Question 41Identity, Access, and Privilege Management in the Cloud

A cloud policy is written with a wildcard action such as "storage:*" on all resources. What is the main risk of this pattern?

  1. It prevents the principal from reading any object.
  2. It causes the policy to be rejected by the parser.
  3. It automatically expires after one hour.
  4. It grants far more actions than needed, including destructive ones. Correct answer.

Explanation

Wildcard actions expand to every operation in that service, which usually includes delete and permission-changing actions. This violates least privilege and enlarges the impact of a compromised principal. Narrow action lists keep the grant aligned with actual need.

Question 42Identity, Access, and Privilege Management in the Cloud

Which practice best protects against the risk of a compromised privileged account being used from an unexpected location?

  1. Sharing the privileged account among the operations team
  2. Storing the privileged password in a shared spreadsheet
  3. Conditional access policies that evaluate device, location, and risk signals Correct answer.
  4. Disabling audit logging for privileged users to reduce noise

Explanation

Conditional access evaluates contextual signals such as device compliance, network location, and sign-in risk before granting a session. Suspicious contexts can be blocked or require step-up authentication. This limits the usefulness of stolen credentials from unfamiliar environments.

Question 43Identity, Access, and Privilege Management in the Cloud

A team wants to confirm that a service account's permissions have not drifted beyond its approved baseline after several months of changes. What is the most direct method?

  1. Review the account's effective permissions against the approved baseline and remove excess grants. Correct answer.
  2. Rename the account to reflect its current owner.
  3. Rotate the account's password on a fixed schedule.
  4. Increase the account's logging verbosity.

Explanation

Permission drift is found by comparing currently effective permissions with the documented baseline and remediating differences. This is the core of a periodic access review. Credential rotation and renaming do not change the granted permissions.

Question 44Identity, Access, and Privilege Management in the Cloud

Which scenario most clearly indicates a need for just-in-time privileged access rather than standing access?

  1. A public website serving anonymous visitors
  2. A read-only dashboard user who views reports daily
  3. A batch job that reads a single object once per day
  4. An on-call engineer who needs administrator rights only during incidents Correct answer.

Explanation

Just-in-time access suits roles that are privileged but rarely needed, granting rights for a bounded window and then removing them. An on-call engineer needing admin only during incidents fits this pattern well. Standing admin rights would leave excessive privilege idle most of the time.

Question 45Identity, Access, and Privilege Management in the Cloud

A security architect wants to prevent any principal from creating a public storage bucket, regardless of the permissions later granted to that principal. Which control achieves this?

  1. An organization-level policy with an explicit Deny on public bucket settings Correct answer.
  2. A user training module on bucket configuration
  3. A weekly report listing existing public buckets
  4. A tag policy that labels buckets as internal

Explanation

An organization-level guardrail with an explicit Deny applies to all principals in scope and overrides any Allow. This prevents the action even if an administrator later grants broad permissions. Detection reports and training reduce but do not prevent the action.

Question 46Identity, Access, and Privilege Management in the Cloud

What is the key difference between authentication and authorization in cloud identity management?

  1. Authorization happens only at account creation time.
  2. Authentication determines permissions; authorization verifies identity.
  3. Both terms describe the same token-validation step.
  4. Authentication verifies identity; authorization determines what that identity may do. Correct answer.

Explanation

Authentication establishes who the principal is, typically through credentials or federation. Authorization then evaluates policies to decide which actions that principal may perform. Keeping these concepts distinct helps design controls at the right layer.

Question 47Identity, Access, and Privilege Management in the Cloud

A workload uses a service account key stored in a CI/CD secret store. Which improvement most reduces the risk if the CI/CD system is breached?

  1. Adding more characters to the static key
  2. Replacing the static key with short-lived federated credentials from the CI/CD platform Correct answer.
  3. Storing the key in a second secret store as a backup
  4. Granting the key broader permissions so it works for all pipelines

Explanation

Workload federation lets the CI/CD platform present a verifiable identity and receive short-lived credentials instead of a stored secret. A breach of the pipeline then yields credentials that expire quickly and are bound to that workload. Static keys remain valid until rotated.

Question 48Identity, Access, and Privilege Management in the Cloud

An auditor asks why the organization uses separate roles for deployment automation and for human operators, even though both need similar permissions. Which rationale is strongest?

  1. Separate roles eliminate the need for audit logging.
  2. Separate roles guarantee that neither identity can ever be compromised.
  3. Separate roles provide distinct identities for accountability and allow independent revocation and scoping. Correct answer.
  4. Separate roles reduce the number of policies that must be written.

Explanation

Distinct role identities make audit trails attributable and let each identity be scoped and revoked without affecting the other. If automation is compromised, human access is unaffected and vice versa. This supports least privilege and incident containment.

Question 49Identity, Access, and Privilege Management in the Cloud

Which action best addresses the risk of orphaned identities left behind after employees leave an organization?

  1. Automating deprovisioning from the authoritative HR identity source Correct answer.
  2. Disabling only the account's password while leaving its access keys active
  3. Keeping accounts active for one year in case of rehire
  4. Relying on the departing employee to delete their own account

Explanation

Automated deprovisioning driven by the authoritative HR system promptly removes or disables all access when employment ends. Manual or delayed processes leave a window for misuse. Orphaned identities are a common path for unauthorized access.

Question 50Identity, Access, and Privilege Management in the Cloud

A cloud environment uses attribute-based access control. Which statement correctly describes how a decision is reached?

  1. Access depends only on the principal's group membership list.
  2. Access depends on the principal's attributes, resource attributes, and context matching a policy. Correct answer.
  3. Access depends on the order in which users signed in that day.
  4. Access depends on the physical location of the data center only.

Explanation

ABAC evaluates attributes of the principal, the resource, the action, and the environment against policy conditions. This allows fine-grained rules such as matching a project tag on both the user and the resource. It is more expressive than static group-only grants.