mediumMultiple ChoiceObjective-mapped
CCSP Practice Question: A software development company is migrating its…
A software development company is migrating its development and test environments to a public cloud. The security team has identified that many developers have assigned overly permissive IAM roles to the resources they create, such as giving full administrative access to databases and virtual machines. The company wants to enforce least privilege without impeding development agility. The cloud architect suggests using a combination of permission boundaries and service control policies. Which of the following approaches BEST enforces least privilege while maintaining development flexibility?
⚠ Common exam trap
ISC2 often tests the distinction between preventive controls (like permission boundaries) and detective/reactive controls (like privilege review), leading candidates to choose an option that sounds proactive but actually only audits after the fact.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Define permission boundaries that limit the maximum permissions a developer can grant to resources, and allow developers to create IAM roles within those boundaries.
Permission boundaries in AWS IAM (or similar constructs in other clouds) allow an administrator to set the maximum permissions that a developer can grant to any IAM role or resource. By defining a permission boundary, developers retain the flexibility to create and attach policies within that boundary, ensuring they cannot exceed the defined limits. This directly enforces least privilege because even if a developer attaches a permissive policy, the boundary caps the effective permissions, preventing full administrative access to databases or VMs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Define permission boundaries that limit the maximum permissions a developer can grant to resources, and allow developers to create IAM roles within those boundaries.
Why this is correct
Correct: Permission boundaries provide a preventative limit while allowing developers flexibility.
- ✗
Implement an automated system that reviews and removes any privileges not used within 60 days.
Why it's wrong here
Reactive, not preventative; does not prevent over-privileging initially.
- ✗
Attach a service control policy at the organizational level that denies all actions unless explicitly allowed, and have developers create their own IAM policies.
Why it's wrong here
Excessively restrictive and complex to manage.
- ✗
Create a permission boundary that restricts all users to read-only access and require subordinates to request access for specific privileges.
Why it's wrong here
Too restrictive; hinders development agility.
Go deeper
Related to this question
About these practice questions
One of 964 original CCSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.