CCSP Practice Question: A cloud application uses an IAM role with the…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Defense in depth

  Why it's wrong here

  Defense in depth layers multiple independent controls; the flaw here is one over-permissive policy granting every S3 action on every resource, which violates least privilege. It is tempting because layered security is sound practice, and defense in depth would be correct where a single control failure must be caught by another safeguard.

• ✗

  Fail secure

  Why it's wrong here

  Fail secure keeps systems in a safe state when they fail; the policy itself is the problem, granting s3:* on all resources rather than least privilege. It is tempting because fail-secure design matters for availability, and would be correct where a component failure must deny access rather than permit it.

• ✗

  Separation of duties

  Why it's wrong here

  Separation of duties divides conflicting tasks among different identities; a single role holding s3:* across all resources breaches least privilege instead. It is tempting because broad permissions do concentrate power, and separation of duties would be correct where one person could both authorise and execute a sensitive transaction.

• ✓

  Least privilege

  Why this is correct

  Granting `s3:*` on `*` lets the role perform every S3 operation against every bucket, including deletion and policy changes. Least privilege requires permissions scoped to only the actions and resources the application genuinely needs, so this wildcard policy directly violates that constraint.

Go deeper

Related to this question