Cloud Identity, Access and Data Protection
This domain tests identity as the primary control plane in cloud environments, and the data-protection controls that follow from classification.
Identity is the new perimeter
Federation via SAML 2.0 or OIDC keeps the enterprise identity provider as the source of truth; SSO reduces credential sprawl, and MFA enrollment is mandatory for privileged roles. Authorization models differ: RBAC maps permissions to roles, ABAC evaluates attributes such as department or resource tag, and PBAC evaluates policy at request time. Least privilege is reached through scoped roles, permission boundaries, and just-in-time elevation rather than permanent admin. CIEM tooling analyzes effective permissions and flags unused or excessive grants. Workloads authenticate with short-lived credentials from instance roles, managed identities, or OIDC federation - never embedded static keys. Secrets belong in a managed vault with rotation, not in code or environment variables committed to a repository.
Data protection
Classify first, then encrypt by state: at rest through provider KMS or customer-managed keys, in transit with TLS 1.2 or later, in use with confidential computing where required. Know the key custody ladder: provider-managed, customer-managed (BYOK/CMEK), and hold-your-own-key (HYOK) where the customer retains the HSM. Envelope encryption wraps data keys with a root key, so revoking the root key - crypto-shredding - renders the data unreadable.
Worked example
A CI/CD pipeline must read from object storage. The analyst rejects an access key stored in pipeline variables and instead configures OIDC federation between the pipeline and the cloud, a role scoped to a single bucket prefix, and a trust policy limited to one repository and branch. Reasoning: no long-lived secret exists, the scope satisfies least privilege, and the trust condition stops a fork from assuming the role.
Traps
Confusing authentication with authorization. Assuming encryption at rest substitutes for access control. Mixing up BYOK with HYOK. Scheduling a KMS key deletion without realizing it is irreversible and destroys dependent data.