CLF-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Giving all users administrator access to simplify management

  Why it's wrong here

  Granting every user AdministratorAccess bypasses IAM's least-privilege model by automatically allowing all actions on all resources for any identity. This dramatically expands the attack surface and the scope of any single compromised credential, because a user with routine duties like reading metrics or viewing logs would also be able to delete DynamoDB tables, launch EC2 instances, or modify IAM policies. Least privilege instead requires scoping permissions to the specific services and actions each role actually performs, with broad administrative access reserved for only a dedicated break-glass role.

• ✓

  Granting users only the minimum permissions required to perform their tasks

  Why this is correct

  Least privilege in AWS means designing IAM policies so that each user or role receives only the specific permissions necessary to complete their assigned job function, nothing more. This is implemented through fine-grained policy statements that define precise Actions, Resources, and Conditions, rather than resorting to broad managed policies like AdministratorAccess or PowerUserAccess. The principle balances operational efficiency with security: users remain productive because they have exactly what they need, while the blast radius of accidental or malicious actions stays minimized.

• ✗

  Allowing users to request additional permissions as needed

  Why it's wrong here

  Allowing users to request additional permissions on demand describes a just-in-time access or workflow-driven escalation mechanism, such as using AWS IAM Identity Center temporary credentials, not the definition of least privilege itself. The principle of least privilege is about the initial design of permission policies to match job duties; a request-and-approve process is a complementary control that can help manage exceptions, but it does not establish that every user already has the minimum permissions required. Even with such a workflow, the baseline granted permissions still need to follow least privilege, otherwise users could request and accumulate overly broad access over time.

• ✗

  Restricting all access by default and never granting permissions

  Why it's wrong here

  While IAM's default behavior denies requests that are not explicitly allowed, 'never granting permissions' goes far beyond least privilege and makes work impossible—users would be unable to perform even routine, authorized tasks like reading an S3 object or listing an EC2 instance. Least privilege is not zero permission; it is the principle of granting sufficient access for a defined task and nothing else. A policy that allows 's3:GetObject' on a specific bucket is an example of least privilege, whereas a blanket deny-all approach would require administrator intervention for every action, destroying operational efficiency.

Go deeper

Related to this question