CCNA Identity And Access Security Questions

The External ID is a value the trusting account requires in the AssumeRole call, binding the session to the specific third party and blocking the confused deputy problem. Prisma Cloud mandates it so its cross-account access cannot be replayed by another customer.

Prisma Cloud ingests GCP Cloud Audit Logs, mapping each invoked API call to its underlying IAM permission. Aggregating these calls across the chosen lookback window yields the exact permission set the service account actually exercised, forming the least-privilege custom role.

Cloud Account ID scopes alerts to a specific onboarded account, while Cloud Type (AWS, Azure, GCP) narrows findings to a provider. Together they let administrators target IAM alert rules precisely, satisfying the requirement to filter effectively across multi-cloud estates.

SecurityAudit is an AWS managed policy granting read-only access to configuration and metadata across services, satisfying the least-privilege discovery requirement without permitting resource modification. Prisma Cloud's resource discovery needs only describe, list and get permissions, which this policy supplies, unlike broader administrative or write-capable alternatives.

MFA blocks credential-only attacks such as password spraying and credential stuffing, directly satisfying the requirement to secure cloud IAM identities. Requiring a second factor means a compromised password alone cannot authenticate, which is why enforcing it for all human users is a core identity best practice.

Cloud Entitlement Management correlates granted IAM permissions against permissions actually exercised, surfacing unused entitlements so they can be removed. This directly satisfies the least-privilege constraint by identifying over-provisioned AWS identities, unlike static policy scanning or compliance posture checks.

Prisma Cloud's identity monitoring detects dormant credentials by analysing access-key last-used timestamps and credential age across connected cloud accounts. This directly satisfies the stem's requirement for identity and access monitoring, surfacing inactive keys and stale credentials that represent unmanaged, long-lived secrets requiring rotation or revocation.

Wildcard permissions, such as action '*' on resource '*', indicate an IAM role granting unrestricted access, which materially raises its risk score. Prisma Cloud flags this over-permissive scope as a key indicator when assessing role risk.

Prisma Cloud's default posture is periodic ingestion, typically hourly, supplemented by event-driven cloud hooks for faster detection. This satisfies the stem's question about default scan frequency, distinguishing it from continuous real-time streaming or purely manual on-demand scans.

Prisma Cloud assumes a cross-account IAM role to read IAM configuration and inventory resources without long-lived credentials. The CloudFormation or Terraform template provisions that role with the required external ID and permissions, which is the prerequisite for IAM posture management and discovery.

Least privilege grants identities only the permissions required for their tasks, removing excess rights. Fewer permissions mean compromised credentials can reach fewer resources, directly shrinking the attack surface and limiting blast radius, which is the stated purpose.

Active access keys with no console password indicate the identity authenticates programmatically via signed API calls rather than interactive login. This is expected for service accounts and scripts, so the finding is usually benign rather than evidence of compromise.

Granting `roles/iam.securityAdmin` lets an identity modify IAM policies, including granting itself or others any role — a direct privilege-escalation path. This satisfies the stem's high-risk criterion because the permission set (`setIamPolicy`) bypasses least privilege entirely, allowing silent escalation to owner-level access across the project.

Microsoft.Authorization/*/write permits creating role assignments and custom role definitions, so any identity holding it can grant itself or others elevated permissions. Prisma Cloud's Azure RBAC analysis maps this wildcard to privilege escalation and raises a high-risk policy violation.

RQL allows security teams to write custom queries against cloud resource configurations, including IAM policies. A query can search for roles with policy statements where the Resource element is '*' and the Action includes sensitive services like iam:* or s3:*. This directly identifies the roles in question. Thus, RQL is the appropriate feature to enforce least privilege by finding overly permissive roles.

A service-linked role is predefined by and linked to a specific AWS service, which assumes it to create and manage resources in your account on your behalf, removing the need to manually configure permissions for that service's operations.

Compliance Mapping and Standards Framework links Prisma Cloud policies to recognised requirements such as CIS Benchmarks, showing which controls satisfy each clause. This directly answers the auditor's demand for demonstrable evidence that IAM policies adhere to those standards.

The Identity and Access Security dashboard consolidates identity posture findings, surfacing inactive users, overly permissive roles and missing MFA in one view. This matches the stem's requirement for a single summary of identity risks rather than separate compliance or compute views.

Owner grants full control including access management, far exceeding read-only monitoring. Replacing it with the built-in Reader role, or a custom role scoped to monitoring actions, removes unnecessary privilege while preserving function, satisfying the least-privilege requirement in the stem.

Granting the service account permissions at the folder or organisation level lets Prisma Cloud inherit access down the entire resource hierarchy, covering every current and future project beneath it. Project-level grants would require per-project assignment and miss new projects, failing the stem's folder-hierarchy monitoring constraint.

Prisma Cloud needs to assume a role in each member account to read IAM configuration. The role's trust policy must allow the Prisma Cloud AWS account (or its role) to assume it, and the role must have permissions to list and get IAM details (e.g., iam:Get*, iam:List*). This is a standard cross-account access setup.

This Prisma Cloud policy flags IAM users with console passwords and requires federated SSO through an identity provider, directly enforcing the best practice that human access avoids native IAM credentials. It satisfies the stem's SSO enforcement constraint.

Without external ID verification, any principal in the organisation can assume the role, enabling the confused deputy problem where a service is tricked into acting on a caller's behalf, plus unauthorised cross-account assumption within the trusted organisation boundary.

The role grants create, list, and delete permissions over service account keys, so a compromised principal can mint a new key for a more privileged account and authenticate as it. That persistent credential bypasses MFA and token expiry, satisfying the stem's privilege-escalation risk.

Microsoft Entra ID service principals and app registrations are non-human identities that Prisma Cloud continuously inventories and monitors for excessive permissions, credential expiry and risky assignments. This satisfies the stem's requirement for regularly monitored cloud identity constructs, since these workload identities authenticate applications and automation rather than interactive users.

A CloudFormation template provisions an IAM cross-account role that Prisma Cloud assumes, granting scoped read and remediation permissions without long-lived access keys. This satisfies the least-privilege requirement and is the vendor-recommended onboarding method for IAM Security and CEM.

IAM Security / Identity Intelligence continuously analyses access-key age and usage telemetry, surfacing dormant credentials as findings. It directly satisfies the stem's constraint of identifying persistent keys unused for 180 days, which static configuration review alone cannot detect.

Wildcarded iam:* grants every IAM action, and the resource ARN spans all accounts with role/Developer-* prefixes, so the policy permits privilege escalation and full IAM control. Prisma Cloud's Identity and Access Security flags such unrestricted administrative permissions as High or Critical severity.

The Prisma Cloud IaC Scanner parses Terraform configuration and evaluates it against policy checks, flagging IAM misconfigurations such as wildcard permissions before deployment. This shifts detection left, catching issues pre-provisioning rather than in running cloud accounts.

Prisma Cloud alert rules evaluate findings against defined severity and policy criteria, then trigger integrations. Configuring a Slack integration with a webhook delivers notifications immediately to the security operations channel, satisfying the real-time requirement for high-risk IAM policy change alerts.

iam:PassRole lets a principal hand an IAM role to a service, and ec2:RunInstances launches instances. Combined without resource constraints, an attacker can start an EC2 instance assuming a highly privileged role, escalating privileges beyond their own permissions.

In a trust policy, aws:SourceIp is evaluated against the intermediate principal assuming the role, not the original end user, and service-based role assumption can bypass it entirely. This makes the condition unreliable as an access control, since the actual caller's IP is not what gets checked.

An SCP attached at the organisation or OU level sets the maximum available permissions for member accounts, so it can deny iam:DeleteRole or iam:UpdateAssumeRolePolicy on the Prisma Cloud role. This prevents tampering even by account administrators.

Modifying trust policies lets the role grant itself or others broader permissions, so the flagged combination enables privilege escalation to administrative access. Prisma Cloud identifies this toxic pairing of S3 read access with trust-policy modification as the primary risk, not mere data exposure.

RQL is Prisma Cloud's native query language, letting you search IAM configuration data such as policies, roles and permissions across connected cloud accounts. It satisfies the stem's requirement for a standard IAM query method, unlike ad-hoc scripting or manual console review.

Prisma Cloud uses role mapping from SAML attributes to assign permissions. Even if the user exists, without a role attribute mapping, the user has no assigned role and is denied access. The engineer must configure the SAML attribute (e.g., 'role') in Azure AD and map it to a Prisma Cloud role in the SSO settings. This is the most likely missing piece causing the access denied error.

Effective permissions calculation resolves the stem's need to expose actual granted access rather than isolated policy statements. CEM aggregates identity-based policies, resource policies, group memberships and role-assumption chains into a single evaluated view, surfacing privilege escalation paths and unused entitlements across AWS, Azure and Google Cloud. This satisfies the requirement for consolidated cloud identity entitlement visibility.

Organization-level `roles/owner` confers unrestricted control spanning every project, folder, billing account and IAM policy within the resource hierarchy, so the principal can grant itself or others any permission and disable audit logging. That breadth satisfies the stem's "extreme risk" framing: no least-privilege boundary constrains the identity anywhere in the organisation.

Root credentials bypass permission boundaries, so hardware-based MFA (such as a FIDO2 key) protects the account even if the password leaks. Reserving root for a few account-level tasks and using least-privilege identities daily limits exposure.

The sts:ExternalId condition in the trust policy must exactly match the external ID that Prisma Cloud uses when assuming the role. If they differ, AWS denies the AssumeRole request. This is the most common misconfiguration when the principal is correct but assumption still fails, making it the most likely cause here.

Replacing the wildcard resource with specific bucket ARNs removes the '*' resource that violates policy while retaining required S3 actions. Narrowing the resource scope enforces least privilege, directly resolving the flagged combination of administrative actions and unrestricted resources.

Prisma Cloud provides pre-built IAM Security policies that specifically identify privilege escalation risks, such as policies allowing iam:CreateUser, iam:AttachUserPolicy, or iam:PutRolePolicy. These policies assess IAM configurations and flag roles or users with such permissions, generating alerts. This directly addresses the requirement to monitor for privilege escalation permissions, making it a correct choice.

Prisma Cloud Config supports custom RQL queries that can inspect IAM role attributes, including trust policy and permissions boundary. By writing an RQL query that filters roles with an EC2 trust relationship and checks for the absence of a permissions boundary, the engineer can create a custom policy that alerts on non-compliant roles. This is the intended method for enforcing custom configuration requirements in Prisma Cloud.

Wildcard actions such as '*' grant identities far more privilege than any task requires, so an attacker who compromises one identity inherits broad control across cloud accounts. Prisma Cloud's CIEM continuously audits effective permissions and flags these overly permissive policies, directly mitigating the identity-based attack vectors named in the stem.

Prisma Cloud UEBA baselines identity behaviour and flags deviations such as logins from unusual geographies, directly satisfying the requirement to review anomalous IAM alerts. Unlike static rule-based policies, it correlates activity across users and entities over time, surfacing the geographic anomaly described in the stem.

Permission sets in AWS IAM Identity Center bundle policies assigned to users or groups across accounts. An overly permissive one grants administrative or wildcard actions, violating least privilege and exposing broad cross-account access that Prisma Cloud flags as identity risk.

aws_iam_role defines the IAM role that Prisma Cloud assumes via sts:AssumeRole, establishing the cross-account trust relationship. The trust policy names Prisma Cloud's account as principal, which is the mechanism enabling secure access without long-lived keys.

The Identity Details page in Prisma Cloud's IAM Security dashboard provides a comprehensive view of an identity's effective permissions. It aggregates permissions from inline policies, attached managed policies, and group memberships, and displays them in an interactive graph. This allows analysts to quickly understand the full scope of access for an IAM user, which is essential for investigating suspicious permissions.

The trust policy's Condition element enforces the sts:ExternalId value that Prisma Cloud supplies, preventing the confused deputy problem where another party could assume the role. Validating this unique identifier satisfies the cross-account security requirement by restricting assumption to the legitimate Prisma Cloud service.

Prisma Cloud's identity posture engine flags dormant credentials because unused active access keys widen the attack surface without operational need. The 90-day inactivity threshold directly satisfies the stem's high-risk indicator criterion, surfacing stale AWS IAM credentials that attackers could exploit if leaked, and which should be rotated or deactivated.

Unused IAM access keys remain valid credentials; if leaked or discovered, they grant programmatic access without triggering normal user activity monitoring. Disabling them removes that dormant attack path, shrinking the credential surface an attacker could exploit to reach cloud resources.

iam:AttachUserPolicy lets a principal attach any managed policy, including AdministratorAccess, directly to its own IAM user. Because the identity controls its own permissions, it can grant itself full administrative rights without any other principal's involvement.

The trust policy's Principal element names the external account, so the engineer must edit that role's trust relationship to delete the unauthorised AWS account ID, immediately revoking its ability to assume the role via STS.

Roles under Compute > System > Access Control define collections and permissions, scoping which repositories and images a user can view. This satisfies the requirement to restrict developers to vulnerability data for repositories they own.

Replacing the broad policy with a least-privilege custom or managed policy directly removes the excessive permissions Prisma Cloud flagged, satisfying the least-privilege constraint. This is the primary remediation: scoping actions and resources to only what the workload requires, rather than granting wildcard access that violates the policy baseline.

The config RQL object queries cloud resource configuration state, which is where AWS IAM policy documents and their wildcard action statements are evaluated. Starting with config satisfies the constraint of finding IAM policies permitting wildcard actions on sensitive services.

AWS is fully supported for IAM posture and resource discovery.