mediumMultiple SelectObjective-mapped
CAS-004 Practice Question: Which TWO of the following are best practices for…
Which TWO of the following are best practices for securing a cloud-based identity and access management (IAM) system? (Select exactly 2.)
⚠ Common exam trap
CompTIA often tests the misconception that frequent password changes (A) are a security best practice, when in fact modern standards advise against them, and that SSO (B) alone is a security control, whereas it is primarily a convenience feature that requires additional safeguards like MFA.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement the principle of least privilege for all user roles.
The principle of least privilege (C) ensures that users and roles are granted only the permissions necessary to perform their job functions, reducing the attack surface and limiting potential damage from compromised accounts. Enabling multi-factor authentication (D) for administrative accounts adds a critical layer of security beyond passwords, mitigating risks from credential theft or brute-force attacks. Both are foundational controls in cloud IAM frameworks like AWS IAM, Azure AD, or GCP IAM.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Require users to change passwords every 30 days.
Why it's wrong here
Frequent password changes can lead to weak passwords; modern guidance recommends against arbitrary expiration.
- ✗
Use single sign-on (SSO) for all applications.
Why it's wrong here
SSO improves user experience but does not inherently secure IAM; it can create a single point of failure.
- ✓
Implement the principle of least privilege for all user roles.
Why this is correct
Limiting privileges reduces the attack surface and potential damage.
- ✓
Enable multi-factor authentication (MFA) for all administrative accounts.
Why this is correct
MFA adds an extra layer of security beyond passwords.
- ✗
Create default admin accounts for each department.
Why it's wrong here
Default admin accounts are a security risk; admin accounts should be unique and carefully managed.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.