easyMultiple ChoiceObjective-mapped
CAS-004 Practice Question: Refer to the exhibit
Exhibit
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "iam:*",
"Resource": "*"
}
]
}Refer to the exhibit. A security administrator finds this IAM policy attached to a Lambda execution role. What is the most critical security risk?
⚠ Common exam trap
The CAS-004 exam often tests the distinction between specific resource-level permissions and wildcard actions; the trap here is that candidates see `lambda:*` and assume it applies broadly, but the resource restriction limits it to only that Lambda function, while the `iam:*` action is unrestricted and applies globally, which is the actual critical risk.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Lambda has full IAM management capabilities
The IAM policy grants the Lambda execution role the `iam:*` action, which includes all IAM operations such as creating, modifying, and deleting IAM users, roles, and policies. This effectively gives the Lambda full administrative control over IAM, allowing it to escalate privileges, create backdoor access, or disrupt the entire AWS account's identity and access management. Such broad permissions violate the principle of least privilege and represent a critical security risk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Lambda can invoke any other Lambda
Why it's wrong here
Invoking Lambda requires lambda:InvokeFunction, not iam actions.
- ✓
The Lambda has full IAM management capabilities
Why this is correct
iam:* on * allows any IAM action, including creating admin users.
- ✗
The Lambda can assume any role
Why it's wrong here
Assuming roles requires sts:AssumeRole, not iam actions.
- ✗
The Lambda can access any S3 bucket
Why it's wrong here
S3 access requires s3:* actions, not included here.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.