Identity And Access Security practice questions

Azure Active Directory B2C

Why it fails: Azure AD B2C is a customer identity and access management solution for consumer-facing apps.

Azure Managed Identities for Azure Resources

Why it fails: Managed identities are for code running inside Azure to authenticate to other services, not external SaaS platforms.

Azure Enterprise Applications

Why it fails: Enterprise applications are shared instances of SaaS or enterprise apps, not the raw identity used for API integration.

GCP Cloud Billing Budgets

Why it fails: Billing budgets manage financial limits, not IAM role assignments.

GCP Cloud IAM Policy Simulator

Why it fails: The Policy Simulator tests policy changes but does not enforce restrictions preventatively.

GCP Cloud Audit Logs

Why it fails: Cloud Audit Logs record historical events, not preventative enforcement.

event from cloud.audit where service = 'iam' and action = 'CreateAccessKey'

Why it fails: This queries audit logs, not the current configuration state of users and their keys.

config from cloud.resource where resource.type = 'aws-s3' and json.rule = "public = true"

Why it fails: This queries S3 bucket public exposure, not IAM user credentials.

network from cloud.flow where source.ip = '0.0.0.0/0'

Why it fails: This queries network traffic flows, which is irrelevant to IAM credential attributes.

Container Runtime System Call Profiler

Why it fails: The System Call Profiler records container process behaviour for runtime threat detection, not cloud configuration posture. It cannot evaluate IAM role metadata such as missing descriptions or trust relationships. Prisma Cloud's Config Query and alert rules serve that purpose, which is why this option fails the stated requirement.

Cloud Network Flow Log aggregator

Why it fails: Cloud Network Flow Log aggregator collects and correlates network traffic metadata, not resource configuration state, so it cannot evaluate IAM role attributes. It is tempting because it surfaces cloud activity, but it suits traffic anomaly detection, whereas configuration-based alerting requires a posture or config query engine.

AWS Trusted Advisor automated script runner

Why it fails: AWS Trusted Advisor runs predefined best-practise checks and cannot express custom configuration criteria such as an IAM role missing a description. It is tempting because it flags cloud misconfigurations, but it suits broad account health reviews, not bespoke attribute-level alert rules across providers.

'aws:SecureTransport' condition requiring HTTPS

Why it fails: SecureTransport applies to data-in-transit (like S3/API calls), not STS role assumption trust conditions.

'ec2:InstanceType' condition restricting EC2 instance sizes in trust policies

Why it fails: Instance type conditions apply to EC2 instance creation APIs, not IAM trust policies.

Requiring passwords to be shared publicly on an internal wiki for transparency

Why it fails: Sharing passwords publicly is a severe security violation.

Allowing users to disable MFA if they choose a strong password

Why it fails: MFA should never be optional, regardless of password strength.

Governance > Compliance > Standard Reports

Why it fails: Compliance reports cover frameworks like CIS and PCI, not specific interactive cross-account identity graphs.

Compute > Vulnerabilities > Images

Why it fails: This section is dedicated to vulnerability scanning for container images.

Runtime Security > Defend > Containers

Why it fails: This path is for container runtime protection and threat defense rules.

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-iam-get-user' and accessKey1LastUsed < 90

Why it fails: Config RQL queries resource configuration metadata, but access key usage timestamps are evaluated via identity telemetry or specific IAM entity attributes.

config from cloud.resource where cloud.type = 'aws' AND resource.type = 'AWS IAM User' AND credential.age.days > 90

Why it fails: Credential age refers to creation date, not last used activity.

event from cloud.audit where cloud.type = 'aws' AND operation = 'ListUsers' and time > 90d

Why it fails: Event RQL queries runtime audit logs for actions taken, whereas dormant identity discovery requires config state inspection.

PodSecurityPolicy

Why it fails: PodSecurityPolicy is a cluster-level resource that controls pod security context settings such as privileged mode, host networking, and volume types. It does not govern which service account a pod uses or flag usage of the default service account. While useful for hardening, it cannot enforce the requirement to avoid the default service account, making it the wrong choice for this scenario.

NetworkPolicy

Why it fails: NetworkPolicy defines allowed ingress and egress traffic for pods based on labels and ports. It operates at the network layer and has no visibility into service account assignments. It cannot detect or prevent a workload from using the default service account. Thus, it does not meet the requirement to flag or block default service account usage, and is incorrect here.

RoleBinding

Why it fails: RoleBinding grants permissions to a subject (user, group, or service account) within a namespace. It does not control which service account a pod uses; it only defines what that account can do. A pod can still default to the default service account, and RoleBinding alone would not flag that. Therefore, it does not enforce the requirement and is not the correct answer.

Config policies in Prisma Cloud

Why it fails: Config policies evaluate the configuration state of cloud resources, such as whether an S3 bucket is public or an IAM policy is overly permissive. They do not analyze API activity or user behavior over time. They cannot detect a sudden role assumption by an inactive user because that requires event-based monitoring, not configuration assessment. Thus, config policies are not suitable for this scenario.

Anomaly policies in Prisma Cloud Compute

Why it fails: Anomaly policies in Prisma Cloud Compute are designed for container and host runtime security, detecting unusual process execution, network connections, or file system activity. They do not monitor AWS IAM API calls or role assumptions. This feature operates at the workload level, not the cloud identity level, so it cannot detect the described IAM behavior. It is not the correct choice.

IAM Security dashboard

Why it fails: The IAM Security dashboard provides a consolidated view of identity risks, such as inactive users, overly permissive roles, and access keys. It is primarily for visibility and posture assessment, not for real-time behavioral alerting. While it may show anomalies, it does not generate alerts for specific events like role assumption. Therefore, it is not the appropriate feature for detecting this behavior.

The Prisma Cloud SSO configuration has the correct IdP metadata URL from Microsoft Entra ID.

Why it fails: The IdP metadata URL is used to import SAML settings into Prisma Cloud. If it were incorrect, the SAML integration would not work at all, and users would not be able to authenticate. Since authentication succeeds, the metadata URL is likely correct. The issue occurs after authentication, so this is not the most likely cause.

The Prisma Cloud tenant ID is correctly configured as the SAML audience URI in Microsoft Entra ID.

Why it fails: The audience URI in Microsoft Entra ID should be the Prisma Cloud SSO URL or entity ID, not the tenant ID. While the tenant ID is used in some configurations, it is not the audience URI. An incorrect audience URI would cause SAML validation to fail, but the error would typically be a SAML response validation error, not an Access Denied after successful authentication.

The SAML response is signed with a valid certificate that Prisma Cloud trusts.

Why it fails: While certificate trust is important for SAML validation, an untrusted certificate would cause the SAML response to be rejected outright, typically resulting in a different error message such as 'Invalid SAML response' rather than 'Access Denied' after successful authentication. Since users report successful authentication, the certificate is likely already trusted.

Compute > Defend > Vulnerabilities

Why it fails: Defend > Vulnerabilities sets scanning, policies and exceptions for images and hosts; it does not assign users to scopes, so per-repository visibility cannot be restricted there. It is tempting because Defend is the right place when the task is tuning which vulnerabilities are detected or ignored.

Compute > Radar > Containers

Why it fails: Radar > Containers displays container vulnerability findings; it holds no role or scope configuration, so repository-level visibility cannot be granted there. It is tempting because Radar is the right place when the task is reviewing which images and hosts carry vulnerabilities.

Compute > Manage > Collections

Why it fails: Manage > Collections defines logical groupings of resources, not the role bindings that grant a developer access to them; permissions are assigned separately. It is tempting because Collections is the right place when the task is grouping registries, namespaces or hosts for policy targeting.

Automatic revocation of TLS certificates

Why it fails: TLS certificate revocation is handled by certificate authorities and ACM, not by IAM trust policies, so this misconfiguration cannot trigger it. It tempts because certificate lifecycle issues are a recognised cloud security concern, and would be correct if the finding involved an expired or revoked certificate rather than role assumption.

Public exposure of S3 buckets via bucket policies

Why it fails: The trust policy governs role assumption, not S3 bucket policies, so bucket exposure is unrelated to this misconfiguration. It tempts because overly permissive resource policies are a familiar S3 risk, and would be correct if the finding concerned a public bucket policy rather than a cross-account role trust relationship.

Denial of Service on the IAM service endpoint

Why it fails: An over-broad trust relationship permits unauthorised role assumption, not flooding of the IAM endpoint, so availability of IAM is unaffected. It tempts because IAM is a shared control plane, and would be correct if the scenario described throttling or resource exhaustion against IAM APIs rather than a permissive trust policy.

Low

Why it fails: Low understates a wildcard action on a wildcard account-and-role ARN, which Prisma Cloud rates High given escalation potential. It is tempting because Low suits narrowly scoped or read-only permissions, and would be correct for a policy limited to a specific account, role name, and non-mutating action.

Informational

Why it fails: Prisma Cloud reserves Informational for low-risk observations such as unused permissions or missing tags, not wildcarded IAM actions on scoped role ARNs. A policy granting 'iam:*' across 'role/Developer-*' matches its high-severity overly permissive policy pattern, since it permits privilege escalation and role modification.

Medium

Why it fails: Prisma Cloud flags wildcard actions on wildcard-scoped role ARNs as High, not Medium, because the pattern permits privilege escalation across accounts. It is tempting because Medium fits broad-but-bounded grants, and would apply where the resource ARN is constrained to a single account or a non-privileged service.

Vulnerability Management

Why it fails: Vulnerability Management detects CVEs and missing patches in hosts, containers and images; unused access keys are an identity hygiene finding, not a software flaw. It is correct when prioritising remediation of vulnerable packages across workloads.

Data Security Module

Why it fails: The Data Security module scans storage and databases for sensitive data, classification and exposure; it does not track IAM credential last-used timestamps. It would be the correct choice when locating unencrypted PII in object stores or misconfigured buckets.

Cloud Network Graph

Why it fails: Cloud Network Graph maps network topology and traffic paths between resources; it holds no credential-usage telemetry, so it cannot flag dormant access keys. It is the right tool for visualising connectivity and reachability, such as tracing lateral-movement routes after a compromise.

aws_instance

Why it fails: aws_instance provisions an EC2 virtual machine, not an IAM role, so it cannot establish the cross-account trust Prisma Cloud assumes. It tempts because compute resources appear in many integrations, but the correct resource is aws_iam_role, which defines the assumable role and its trust policy.

aws_s3_bucket

Why it fails: aws_s3_bucket creates object storage, not an IAM role, so no cross-account trust relationship is established for Prisma Cloud. It tempts because S3 buckets commonly appear in AWS integrations, but the correct resource is aws_iam_role, which defines the assumable role and its trust policy.

aws_security_group

Why it fails: A security group is a stateful virtual firewall controlling inbound and outbound traffic to EC2 instances; it grants no cross-account permissions and cannot assume roles. It is tempting because Prisma Cloud onboarding does involve network access rules, but the cross-account trust itself requires an aws_iam_role with an assume-role policy.

network

Why it fails: The network object models VPC configurations such as security groups, subnets and route tables, so it cannot express IAM policy documents or their wildcard actions. It is the right starting point when hunting exposed ports or overly permissive ingress rules, not identity permissions.

event

Why it fails: The event object surfaces activity and audit records rather than the configuration of IAM policies, so wildcard actions already granted cannot be enumerated from it. It fits queries detecting suspicious API calls or anomalous behaviour in logs, not static policy posture checks.

audit

Why it fails: The audit object exposes compliance and configuration findings, not the raw IAM policy JSON needed to match wildcard action strings. It suits querying failed control checks or drift from benchmarks, whereas inspecting policy statements themselves requires the config object.

AmazonS3FullAccess

Why it fails: AmazonS3FullAccess permits only S3 actions, so Prisma Cloud cannot discover resources in other AWS services, and it grants write access rather than read-only. It is tempting because S3 is commonly inventoried, but full resource discovery requires a read-only policy such as SecurityAudit or ReadOnlyAccess.

PowerUserAccess

Why it fails: PowerUserAccess grants full access to all services except IAM user and group management, far exceeding the read-only discovery permissions Prisma Cloud needs. It is tempting as a broad non-administrative policy, but least privilege for resource discovery requires a read-only policy such as SecurityAudit or ReadOnlyAccess.

AdministratorAccess

Why it fails: AdministratorAccess grants full permissions across every AWS service, directly violating least privilege for a discovery role. It is tempting because it guarantees Prisma Cloud can enumerate all resources without permission errors, but read-only discovery requires a policy such as SecurityAudit or ReadOnlyAccess instead.

To reduce the monthly cloud provider billing costs

Why it fails: Least privilege restricts identities to the permissions their tasks require, shrinking the blast radius of compromised credentials; it does not alter consumption-based charges, which track provisioned or used resources. Cost control is the goal of budgeting, tagging and rightsizing, so this option would fit a question about optimising cloud spend rather than limiting access.

To eliminate the need for multi-factor authentication

Why it fails: Least privilege constrains permissions granted to an identity, whereas multi-factor authentication verifies the identity itself at sign-in; the two controls are complementary and neither replaces the other. Removing MFA is the objective of passwordless or risk-based conditional access designs, not of scoping IAM policy actions.

To increase cloud resource provisioning speed

Why it fails: Least privilege limits which actions an identity may perform; it neither accelerates nor governs resource creation, which depends on service quotas, API throughput and orchestration. Provisioning speed is addressed by infrastructure-as-code pipelines and autoscaling, making this the right answer for a question about deployment velocity rather than access restriction.

Network Security > Flow Log Viewer

Why it fails: The Flow Log Viewer displays network traffic records between workloads, containing no identity data on inactive users, role permissions or MFA enrolment. It is tempting for connectivity troubleshooting, and would be correct when investigating anomalous network flows or blocked traffic.

Runtime Security > Defend > Containers

Why it fails: Runtime Security > Defend > Containers covers container workload protection, not identity posture. It cannot surface inactive users, permissive roles or missing MFA, which belong to the Identity dashboard. It would be the right view when investigating container runtime threats such as process execution or drift.

Inventory > Compute > Virtual Machines

Why it fails: The Compute Virtual Machines inventory lists host instances and their configuration, not identity posture such as inactive users, permissive roles or missing MFA. It is tempting for asset visibility, and would be correct when auditing running workloads, images or VM vulnerabilities.