CAS-004 Security Architecture Practice Question
Which of the following is a cloud-native security control provided by a cloud service provider to manage user permissions and access to resources?
⚠ Common exam trap
CAS-005 often tests service-purpose mapping; candidates confuse CloudTrail (audit logging) with IAM (access control), or pick KMS because it 'manages' something security-related.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Identity and Access Management (IAM)
IAM is the cloud-native service that manages identities, roles, and permissions, controlling who can do what on which resources. It is the foundational access control plane in every major cloud provider (AWS IAM, Azure Entra ID/RBAC, GCP IAM). The question asks specifically about managing user permissions and access, which is IAM's core purpose.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Virtual Private Cloud (VPC)
Why it's wrong here
A VPC provides network isolation through subnets, route tables and security groups, not identity-based permission management. It tempts because it is a foundational cloud-native security control, and would be correct when the requirement is network segmentation rather than user authorisation.
- ✗
CloudTrail
Why it's wrong here
CloudTrail records API activity for auditing and governance; it does not grant or manage permissions. It tempts because it is a native AWS security service, and would be the right answer for logging who performed actions, not for controlling access.
- ✗
Key Management Service (KMS)
Why it's wrong here
KMS manages encryption keys and cryptographic operations, not user permissions or access policies. It tempts because it is a native cloud security service, and would be the correct choice when the scenario requires creating, rotating or controlling encryption keys.
- ✓
Identity and Access Management (IAM)
Why this is correct
IAM is the cloud-native control plane through which a provider exposes permission management: it defines principals, roles and policies that grant or deny actions on resources. This directly satisfies the stem's requirement to manage user permissions and access, without customer-deployed tooling.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 973 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.