hardMultiple ChoiceObjective-mapped

Least Privilege Principle — Overly Permissive IAM Policy Example

Exhibit

Refer to the exhibit.

```json
{
  "PolicyName": "IAM-AdminAccess",
  "PolicyDocument": {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": "*",
        "Resource": "*"
      }
    ]
  }
}
```

An auditor reviews this IAM policy attached to a user group. What is the primary compliance concern?

Quick Answer

The correct answer is that the policy violates the principle of least privilege. This is because the IAM policy grants wildcard actions (Action: '*') on all resources (Resource: '*'), which directly contradicts the core security concept of granting only the minimum permissions necessary for a user to perform their job functions. Such an overly permissive IAM policy creates an excessive attack surface, allowing any user in the group to perform any operation on any resource, which is a primary compliance concern under frameworks like NIST SP 800-53 and PCI DSS. On the CompTIA SecurityX CAS-004 exam, this scenario tests your ability to identify violations of least privilege in IAM configurations, often appearing as a trap where test-takers overlook the wildcard entries. A common memory tip is to remember the mnemonic "W.A.R." — Wildcard Actions on all Resources equals a violation of least privilege.

⚠ Common exam trap

The CAS-004 exam often tests the principle of least privilege by presenting a policy that appears functional (allows actions) but is overly permissive, tricking candidates into focusing on whether the policy 'works' rather than whether it complies with security best practices.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The policy violates the principle of least privilege

The IAM policy grants wildcard actions (Action: '*') on all resources (Resource: '*'), which violates the principle of least privilege by allowing any user in the group to perform any operation on any resource. This broad permission set creates an excessive attack surface and is a primary compliance concern under frameworks like NIST SP 800-53 or PCI DSS, which require restricting access to only what is necessary for job functions.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The policy restricts access to specific resources
Why it's wrong here
The policy allows all resources (Resource: *).
✗
The policy does not enable logging
Why it's wrong here
Logging is not covered by this policy document.
✓
The policy violates the principle of least privilege
Why this is correct
Granting all actions on all resources is excessive and violates least privilege.
✗
The policy does not allow any actions
Why it's wrong here
The policy allows all actions (Action: *).

Go deeper

2 more ways this is tested on CAS-005

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. Based on the exhibit, which security issue does this IAM policy represent?

hard

A.No versioning configured
✓ B.Overly permissive resource access
C.Missing server-side encryption
D.Insufficient logging and monitoring

Why B: The IAM policy in the exhibit uses a wildcard (`*`) in the `Resource` element, granting access to all resources within the account. This violates the principle of least privilege by allowing overly permissive resource access, which could lead to unauthorized data exposure or modification. The correct answer is B because the policy does not restrict actions to specific resources, making it a classic example of excessive permissions.

Variation 2. Based on the exhibit, what vulnerability is present in the firewall rule?

medium

✓ A.Overly permissive service specification
B.Source IP range is too broad
C.No logging is enabled
D.Missing application ID control

Why A: The firewall rule permits 'any' as the service, meaning all TCP/UDP ports and protocols are allowed through. This is overly permissive because it bypasses the principle of least privilege, exposing the internal network to unnecessary traffic and potential attacks. A proper rule should specify only required services (e.g., TCP/443 for HTTPS) to minimize the attack surface.

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.

Least Privilege Principle — Overly Permissive IAM Policy Example

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question

2 more ways this is tested on CAS-005