mediumMultiple ChoiceObjective-mapped
CV0-004 Practice Question: A cloud administrator notices that an IAM role in…
A cloud administrator notices that an IAM role in a public cloud environment has permissions to perform all actions on all resources. The principle of least privilege should be applied. What is the best first step to reduce the security risk?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Review the role's attached policies and identify unused or unnecessary permissions.
The best first step is to review the role's attached policies and identify unused or unnecessary permissions (Option C). This aligns with the principle of least privilege by allowing the administrator to understand which permissions are actually needed before making changes, minimizing the risk of disrupting legitimate access. Deleting the role immediately (Option A) could cause service disruptions. Creating a new role and asking users to switch (Option B) is time-consuming and may not address the root issue. Modifying the trust policy (Option D) restricts who can assume the role but does not reduce the permissions granted.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Delete the role and create a new one with minimal permissions immediately.
Why it's wrong here
This may cause service disruption if the role is in use and does not guarantee a smooth transition.
- ✗
Create a new role with fewer permissions and ask users to switch roles.
Why it's wrong here
This is disruptive and may lead to downtime; reviewing first is preferred.
- ✓
Review the role's attached policies and identify unused or unnecessary permissions.
Why this is correct
This allows targeted removal of excessive permissions while maintaining functionality.
- ✗
Modify the role's trust policy to restrict which users can assume it.
Why it's wrong here
This does not limit the role's permissions, only who can assume it.
Go deeper
Related to this question
About these practice questions
This CV0-004 question is part of Courseiva's 977-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.