CloudSec-Pro IAM And Access Governance IN Cloud Practice Test 4 — 15 Questions

Question 1

Which TWO settings can be managed within the Prisma Cloud 'Access Control' menu?

Accepted Answer

SSO and Identity Provider configuration. Option A (SSO and Identity Provider configuration) is correct because the Access Control menu in Prisma Cloud is where administrators configure authentication, including SAML-based single sign-on and identity provider (IdP) integration for the tenant. Option D (User and Access Group management) is correct because the same Access Control menu is used to create and manage users, roles, and access groups that determine RBAC permissions across the Prisma Cloud environment. Option B is incorrect because cloud account billing details are managed under account/tenant settings or the cloud account onboarding area, not Access Control. Option C is incorrect because Defender deployment scripts are found under the Defenders/Compute management section, not Access Control. Option E is incorrect because vulnerability scan frequency is configured in the vulnerability or scan policy settings, not in the Access Control menu.

Answer

Cloud account billing details

Answer

Defender deployment scripts

Answer

Vulnerability scan frequency

Question 2

A security engineer at a healthcare company is configuring cross-account access in AWS. The company uses AWS Organizations and wants to grant a third-party auditing firm read-only access to a specific S3 bucket in the production account. The auditing firm has its own AWS account. The engineer creates an IAM role in the production account with a trust policy that allows the auditing firm's account to assume it, and attaches a policy granting s3:GetObject and s3:ListBucket on the specific bucket. The auditing firm reports that they cannot assume the role. What is the most likely cause?

Accepted Answer

The auditing firm's IAM principal lacks an identity-based policy allowing sts:AssumeRole on the role's ARN.. Cross-account role assumption requires both a trust policy in the target account and an identity-based policy in the source account allowing sts:AssumeRole. The trust policy alone is insufficient; the auditing firm's principal must also have permission to call AssumeRole. This is a common oversight when configuring cross-account access.

Answer

AWS Organizations service control policies (SCPs) are blocking the role assumption because the auditing firm is not in the same organization.

Answer

The S3 bucket policy must explicitly allow the auditing firm's account to access the bucket.

Answer

The IAM role's trust policy must specify the auditing firm's IAM user ARN, not the account ID.

Question 3

A CloudSec-Pro consultant is reviewing an AWS Organization where a member account has an IAM role with a trust policy that allows the `sts:AssumeRole` action from an external AWS account ID belonging to a former partner. The partner no longer works with the company. What is the MOST immediate risk, and which action best mitigates it while preserving legitimate cross-account access for current partners?

Accepted Answer

The external account can assume the role and access resources; add a condition to the trust policy that restricts `sts:ExternalId` to the current partners' unique IDs and remove the former partner's account ID.. The trust policy explicitly allows the former partner's AWS account to assume the role. The immediate risk is unauthorized access. The correct mitigation is to remove the former partner's account ID from the trust policy and add a condition requiring a unique `sts:ExternalId` for current partners, ensuring only authorized external accounts can assume the role.

Answer

The external account can assume the role and access resources; rotate the access keys of all IAM users in the trusting account to invalidate any sessions.

Answer

The external account can assume the role and access resources; enable AWS CloudTrail logging and monitor for any `AssumeRole` calls from the former partner's account.

Answer

The external account can assume the role and access resources; attach an inline policy to the role that denies all actions, then recreate the role with a new name.

Question 4

A cloud security architect is designing an access governance model for a multi-cloud environment using Azure AD as the identity provider. The company wants to enforce that all administrative access to cloud resources requires multi-factor authentication (MFA) and that access is reviewed quarterly. They also need to ensure that if an employee leaves, their access is revoked within 15 minutes. Which combination of Azure AD features should the architect implement to meet these requirements?

Accepted Answer

Conditional Access policies, Azure AD Access Reviews, and automated user provisioning with SCIM.. Conditional Access enforces MFA for administrative access. Microsoft Entra ID Access Reviews provide quarterly attestation of access rights. Automated user provisioning with SCIM ensures rapid deprovisioning when an employee leaves. Together, they meet the MFA, review, and revocation requirements in a multi-cloud environment.

Answer

Conditional Access, Azure AD Identity Protection, and password hash synchronization.

Answer

Azure AD Privileged Identity Management (PIM), Conditional Access, and Azure AD Connect sync.

Answer

Azure AD B2C, Conditional Access, and manual access revocation via PowerShell scripts.

Question 5

A CloudSec-Pro consultant is reviewing a multi-account AWS Organization. The security team wants every new member account to automatically inherit a baseline set of IAM password policy controls (minimum length 14, no reuse of last 24 passwords, 90-day rotation) without any manual work in each account. Which capability should the consultant recommend?

Accepted Answer

An AWS CloudFormation StackSet with service-managed permissions deployed to the organization, containing an AWS::IAM::AccountPasswordPolicy resource.. The requirement is automatic, organization-wide configuration of each member account's IAM password policy. AWS CloudFormation StackSets with service-managed permissions push a template to all current and future accounts in the organization, so an AWS::IAM::AccountPasswordPolicy resource establishes the baseline without manual intervention. SCPs only gate actions, permissions boundaries only cap permissions, and IdP password rules govern federated users rather than each account's native password policy.

Answer

AWS IAM Identity Center with an external identity provider, relying on the IdP's own password complexity rules for all AWS console access.

Answer

An IAM permissions boundary attached to every IAM user in each member account, with a policy condition enforcing PasswordPolicyLength.

Answer

AWS Organizations service control policies (SCPs) attached to the root, which deny iam:UpdateAccountPasswordPolicy calls that do not match the baseline values.

Question 6

A CloudSec-Pro auditor finds that a workload running on an Amazon EC2 instance uses long-lived access keys stored in a configuration file to read from an Amazon S3 bucket. The team wants to eliminate static credentials while keeping the same permissions. Which change accomplishes this with the least operational overhead?

Accepted Answer

Attach an IAM role to the instance profile granting the S3 permissions, and let the AWS SDK retrieve temporary credentials from the instance metadata service.. Moving the workload to an IAM role attached through an instance profile removes static credentials because the SDK obtains short-lived credentials from the instance metadata service and refreshes them automatically. The role can carry exactly the same S3 permissions, so behavior is preserved. Rotating keys, storing keys in Parameter Store, or filtering by IP all leave long-lived secrets in play and add maintenance burden.

Answer

Create a new IAM user with the same S3 permissions, rotate its keys every 30 days with AWS Secrets Manager, and update the instance configuration on each rotation.

Answer

Enable AWS IAM Access Analyzer on the account and use its findings to restrict the S3 bucket policy to the instance's public IP address.

Answer

Store the access keys in AWS Systems Manager Parameter Store as SecureString parameters and have the application fetch them at startup.

Question 7

A CloudSec-Pro practitioner is onboarding a new engineer who needs read-only visibility into Amazon S3 inventory across all accounts in an AWS Organization, but must not be able to read object contents. Which IAM action set best matches this requirement?

Accepted Answer

s3:ListAllMyBuckets, s3:ListBucket, and s3:GetBucketLocation. Inventory visibility without object access maps to S3 listing and location actions. s3:ListAllMyBuckets, s3:ListBucket, and s3:GetBucketLocation expose bucket names, object keys, and regions while never returning object bytes. Object retrieval actions, inventory configuration actions, and broad wildcards either expose data or grant unnecessary configuration and write capabilities.

Answer

s3:GetObject and s3:GetObjectVersion on all buckets

Answer

s3:* scoped by a condition of s3:prefix equal to inventory/

Answer

s3:PutBucketInventoryConfiguration and s3:GetInventoryConfiguration on all buckets

Question 8

A cloud administrator is setting up access for a new team of developers in Google Cloud. The developers need to deploy and manage resources in a specific project. The administrator wants to follow Google's recommended practice for assigning permissions. What should the administrator do?

Accepted Answer

Create a Google Group for the developers and grant the group the necessary IAM roles on the project.. Google Cloud best practice is to assign IAM roles to Google Groups rather than individual users. This simplifies management, ensures consistent permissions, and supports least privilege by allowing role assignments based on team function.

Answer

Create a service account for each developer and grant the service account the required roles.

Answer

Grant each developer the Owner role on the project.

Answer

Assign each developer the Editor role on the project.

Question 9

A cloud administrator is setting up federation between an enterprise identity provider (IdP) and AWS. The goal is to allow employees to access the AWS Management Console using their existing corporate credentials without creating IAM users. Which AWS service should the administrator configure to establish this federation?

Accepted Answer

AWS IAM Identity Center (successor to AWS Single Sign-On). AWS IAM Identity Center is the recommended service for federating corporate credentials with AWS. It supports SAML 2.0 integration with external IdPs, provides a user portal for console access, and manages permissions centrally. This eliminates the need for IAM users and simplifies access management across multiple AWS accounts.

Answer

AWS Security Token Service (STS) AssumeRoleWithSAML directly from the IdP

Answer

AWS Directory Service for Microsoft Active Directory

Answer

AWS Cognito User Pools

Question 10

A CloudSec-Pro architect is designing just-in-time privileged access for cloud administrators. The design must grant elevated permissions only after approval, limit the window of use, and leave an auditable trail. Which two controls should be included in the design? (Choose two.)

Accepted Answer

A break-glass process that records a ticket, then activates a pre-approved emergency role whose use triggers an alert and a mandatory post-incident review.. Just-in-time privileged access combines approval-gated, time-limited credential issuance with a documented emergency path. Short STS sessions behind an approval workflow deliver elevation only when authorized and record every assumption in CloudTrail, while a break-glass role with ticketing, alerting, and review covers emergencies without losing accountability. Standing admin users, vaulted shared keys, and permanent admin groups all leave persistent, poorly attributed privilege in place.

Answer

Permanent IAM user accounts with administrator policies attached, protected by a requirement to change the password at each login.

Answer

Long-lived access keys stored in a team password vault that any on-call engineer may retrieve during an incident.

Answer

An identity provider group whose membership grants administrator permissions permanently to all senior engineers.

Question 11

A security team is onboarding a new AWS account into Prisma Cloud. The requirement is that Prisma Cloud must be able to continuously evaluate IAM policies, detect overly permissive roles, and generate alerts when a user is granted privileges beyond a defined baseline. The team has already created a dedicated IAM role for Prisma Cloud with the necessary permissions. Which additional configuration is required to enable IAM policy evaluation and alerting in Prisma Cloud?

Accepted Answer

In Prisma Cloud, navigate to the account settings, enable the IAM security module, and ensure the onboarding role has permissions to read IAM policies and roles via the AWS API.. The correct answer is to enable the IAM security module in Prisma Cloud and ensure the onboarding role has read permissions for IAM resources. Prisma Cloud continuously evaluates IAM policies by querying AWS APIs, and no additional policy attachment or CloudTrail integration is required for this specific capability. The role must have sufficient read access to IAM policies, roles, and users to perform the assessment and generate alerts.

Answer

Enable the IAM policy evaluation feature by attaching the Prisma Cloud IAM policy evaluation policy to the role and configuring the account in Prisma Cloud with the role ARN.

Answer

Deploy the Prisma Cloud IAM evaluation Lambda function in the AWS account and grant it permissions to modify IAM policies.

Answer

Configure AWS CloudTrail to send IAM events to Prisma Cloud and enable the IAM policy evaluation setting in the Prisma Cloud compliance dashboard.

Question 12

A security team has onboarded an AWS account into Prisma Cloud and wants to detect IAM users whose access keys have never been rotated. They have already enabled the IAM permissions required for Prisma Cloud to read credential reports. Which Prisma Cloud feature should they use to generate an alert when an access key exceeds 90 days of age?

Accepted Answer

IAM security policy with a rule that checks access key age and triggers an alert when the key is older than 90 days.. IAM security policies in Prisma Cloud continuously evaluate identity configurations against conditions such as access key age. By defining a rule that checks whether a key's creation date is more than 90 days in the past, the team receives automated alerts for unrotated credentials. This provides the continuous, centralized detection the scenario requires without relying on manual log queries or external tools.

Answer

Prisma Cloud Compute's host vulnerability scanner, configured to flag credentials stored on EC2 instances.

Answer

Cloud Trail log analysis with a saved query that filters for CreateAccessKey events older than 90 days.

Answer

AWS Config managed rule 'access-keys-rotated' configured directly in the AWS console, with no integration to Prisma Cloud.

Question 13

A cloud security engineer is reviewing Prisma Cloud IAM findings for an AWS account. They observe that a role named 'DataPipelineRole' has permissions to read from an S3 bucket and write to a DynamoDB table, but the role's last used date is over 180 days ago. The engineer wants Prisma Cloud to flag this role as unnecessary so it can be removed. Which Prisma Cloud capability directly supports this?

Accepted Answer

IAM unused permissions and unused role detection, which identifies roles and permissions not exercised within a specified period.. Prisma Cloud's IAM unused permissions and unused role detection uses activity data to determine which roles and permissions have not been exercised within a configurable period. By comparing granted permissions to actual usage, it can flag the DataPipelineRole as a candidate for removal. This capability provides the usage-based evidence needed to safely decommission dormant identities.

Answer

Prisma Cloud's compliance standard report for CIS AWS Foundations Benchmark, which lists all IAM roles.

Answer

AWS IAM Access Analyzer external access findings, which identify resources shared outside the account.

Answer

Cloud infrastructure entitlement management (CIEM) dashboard that shows only the total number of roles in the account.

Question 14

A security administrator is configuring Prisma Cloud to monitor IAM activity across multiple AWS accounts in an organization. They want to ensure that Prisma Cloud can detect when a new IAM user is created with console access and when an existing user's permissions are escalated. Which two Prisma Cloud capabilities should they enable to meet these requirements? (Choose two.)

Accepted Answer

IAM activity monitoring that ingests CloudTrail events to track identity-related API calls such as CreateUser and AttachUserPolicy.. Detecting new IAM users with console access requires activity monitoring to capture CreateUser and related events, while detecting permission escalation requires both activity monitoring for policy attachment events and configuration-based policies that flag excessive privileges. Together, IAM activity monitoring and IAM security policies provide the event-driven and state-based detection needed for these scenarios.

Answer

Prisma Cloud Compute's runtime defense module, which monitors process execution on EC2 instances.

Answer

Prisma Cloud's data security posture management (DSPM) module, which classifies sensitive data in S3 buckets.

Answer

Cloud network firewall policies that restrict outbound traffic from VPCs to known IAM endpoints.

Question 15

A cloud operations team is onboarding a new AWS account into Prisma Cloud. The security architect wants Prisma Cloud to assume a role in the account to read IAM configuration and activity data. Which AWS entity must be created in the target account to allow Prisma Cloud to assume the necessary permissions?

Accepted Answer

An IAM role with a trust policy that allows Prisma Cloud's AWS account to assume it, and a permissions policy granting read-only access to IAM and CloudTrail.. Prisma Cloud onboards AWS accounts by assuming an IAM role in the target account. The role's trust policy allows Prisma Cloud's AWS account to assume it, and its permissions policy grants read-only access to IAM and CloudTrail. This avoids long-lived credentials and follows AWS best practices for cross-account access.

Answer

An IAM user with programmatic access and an access key pair that Prisma Cloud stores and uses for all API calls.

Answer

An AWS Organizations service control policy (SCP) that grants Prisma Cloud permissions across all accounts.

Answer

A resource-based policy on each S3 bucket that stores IAM data, granting Prisma Cloud read access.