mediumMultiple SelectObjective-mapped
CV0-004 Practice Question: A cloud administrator notices that an IAM user…
A cloud administrator notices that an IAM user has permissions that are not explicitly assigned. The administrator suspects that the user is inheriting permissions through group membership or role assignment. Which TWO methods can the administrator use to identify all effective permissions for this user? (Choose TWO.)
⚠ Common exam trap
CompTIA often tests the distinction between inherited permissions (from groups/roles) and explicit permissions, and the trap here is that candidates may confuse reviewing access logs (which show past actions) with evaluating effective permissions (which shows potential actions).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
List the user's group memberships and examine the policies attached to those groups and any roles the user can assume.
Group memberships and assumable roles are common sources of inherited permissions. By listing the user's groups and examining the policies attached to those groups, as well as any roles the user can assume, the administrator can trace the origin of the unexpected permissions. This method directly identifies the inheritance chain that grants permissions not explicitly assigned to the user.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
List the user's group memberships and examine the policies attached to those groups and any roles the user can assume.
Why this is correct
This helps in understanding the inherited permissions.
- ✗
Review the user's recent access logs to see which actions were allowed.
Why it's wrong here
Access logs show historical actions, not all effective permissions.
- ✗
Check the resource-based policies on each resource the user might access.
Why it's wrong here
Resource-based policies control access from a resource perspective, not the user's effective permissions.
- ✓
Use a 'simulate principal policy' API call to evaluate the user's effective permissions.
Why this is correct
This API evaluates all policies attached to the user, groups, and roles to determine effective permissions.
- ✗
Log in as the root user and run a permissions report.
Why it's wrong here
The root user has full access and cannot be used to simulate another user's permissions.
Go deeper
Related to this question
About these practice questions
One of 977 original CV0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.