CLF-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  All IAM users should have the same level of access to ensure consistency

  Why it's wrong here

  Uniform access assigns the same broad permission set to every user, which directly contradicts least privilege because it grants unnecessary rights to users whose roles require only a subset. This expands the blast radius if any single credential is compromised, since an attacker inherits all permissions. Access decisions should be driven by each user's job function, not by a one-size-fits-all policy.

• ✓

  Grant only the minimum permissions necessary to perform required tasks

  Why this is correct

  Least privilege means each IAM user, role, or resource gets exactly the permissions required to perform its intended task and nothing more. By starting with no access and adding only specific actions, resources, and conditions, you minimize the potential damage from accidental mistakes, malicious actions, or compromised credentials. This is the foundational principle for restricting blast radius and is the correct answer here.

• ✗

  Use AWS managed policies instead of customer-managed policies

  Why it's wrong here

  AWS managed policies are prebuilt by AWS and may grant broader permissions than an individual role actually needs, so choosing them does not inherently implement least privilege. The principle applies to the content and scope of a policy—whether it is managed or customer-managed—since both can be either narrowly scoped or overly permissive. Thus, the choice of policy type is a management decision, not a substitute for least privilege design.

• ✗

  Rotate IAM access keys every 90 days

  Why it's wrong here

  Rotating access keys is a credential hygiene practice that limits the window of exposure for a leaked key, but it does not change the level of permissions granted to an identity. Least privilege is about restricting what actions and resources an identity can access, not how often credentials are refreshed. Key rotation complements least privilege but is not the definition or the primary goal of that principle.