Courseiva
easyMultiple ChoiceObjective-mapped

CAS-004 Practice Question: Refer to the exhibit

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "iam:*",
      "Resource": "*"
    }
  ]
}

Refer to the exhibit. A security administrator finds this IAM policy attached to a Lambda execution role. What is the most critical security risk?

⚠ Common exam trap

The CAS-004 exam often tests the distinction between specific resource-level permissions and wildcard actions; the trap here is that candidates see `lambda:*` and assume it applies broadly, but the resource restriction limits it to only that Lambda function, while the `iam:*` action is unrestricted and applies globally, which is the actual critical risk.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

The Lambda has full IAM management capabilities

The IAM policy grants the Lambda execution role the `iam:*` action, which includes all IAM operations such as creating, modifying, and deleting IAM users, roles, and policies. This effectively gives the Lambda full administrative control over IAM, allowing it to escalate privileges, create backdoor access, or disrupt the entire AWS account's identity and access management. Such broad permissions violate the principle of least privilege and represent a critical security risk.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • The Lambda can invoke any other Lambda

    Why it's wrong here

    Invoking Lambda requires lambda:InvokeFunction, not iam actions.

  • The Lambda has full IAM management capabilities

    Why this is correct

    iam:* on * allows any IAM action, including creating admin users.

  • The Lambda can assume any role

    Why it's wrong here

    Assuming roles requires sts:AssumeRole, not iam actions.

  • The Lambda can access any S3 bucket

    Why it's wrong here

    S3 access requires s3:* actions, not included here.

Quick reference

Cloud Service Model Comparison

ModelYou ManageProvider ManagesExamples
IaaSOS, runtime, apps, dataHardware, hypervisor, networkingEC2, Azure VMs, GCP Compute Engine
PaaSApps and dataOS, runtime, middleware, hardwareElastic Beanstalk, Azure App Service
SaaSData and settings onlyEverything elseMicrosoft 365, Salesforce, Workday
FaaS / ServerlessFunction code onlyInfra, scaling, runtimeLambda, Azure Functions, Cloud Run
CaaSContainers and appsKubernetes, OS, hardwareEKS, AKS, GKE

About these practice questions

This CAS-005 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.