CCNA IAM And Access Governance In Cloud Questions

IAM Identity Center enables federation with external IdPs using SAML 2.0, allowing users to sign in to the AWS Management Console with corporate credentials. It eliminates the need for IAM users and supports centralized permission management across multiple accounts.

SCIM provisioning synchronises Microsoft Entra ID deletions to Prisma Cloud, so the deprovisioning event removes the corresponding console account. Because access is federated and lifecycle-managed rather than locally held, the user cannot authenticate afterwards, satisfying the stem's requirement that deletion in Microsoft Entra ID revokes console access.

Break-glass access provides a controlled path for emergencies when the normal approval workflow is unavailable, while the ticket, alerting, and post-incident review preserve accountability. It complements just-in-time sessions by covering scenarios where waiting for approval is not viable. Because activation is logged and reviewed, the auditable-trail requirement is maintained rather than bypassed.

Cloud provider audit logs such as CloudTrail record the API calls principals make, giving Prisma Cloud the activity trail needed to detect anomalous or privileged actions. This satisfies the audit's requirement for runtime behavioural evidence, complementing configuration and entitlement data.

Settings > Access Control > Identity Provider is where Prisma Cloud binds SSO to named IdP tenants, satisfying the requirement to restrict authentication to specific providers. Configuring the integration here enforces the allow-list at the SAML trust level, so Microsoft Entra ID and other unlisted providers cannot initiate sign-in.

Prisma Cloud can trigger automated remediation workflows directly from an IAM alert, executing predefined actions such as disabling keys or revoking permissions. This satisfies the requirement to respond programmatically rather than only notifying, reducing the window of exposure after detection.

Access Governance continuously monitors identity and entitlement usage, so tracking IAM user activity across AWS, Azure and GCP surfaces dormant, excessive or risky permissions. This satisfies the stem's requirement by feeding cross-platform activity data into least-privilege remediation.

For cross-account role assumption, two permissions are required: the trust policy in the target account must allow the principal to assume the role, and the principal's identity-based policy in their own account must allow sts:AssumeRole on the role ARN. If the auditing firm's user or role does not have this permission, the AssumeRole call will be denied even if the trust policy is correct.

Access Groups in Prisma Cloud map identity-provider users and groups to granular role assignments scoped across individual cloud accounts, satisfying the requirement to organise users and assign specific roles per account. They federate with Microsoft Entra ID, enabling centralised, least-privilege role binding rather than account-wide permissions.

The Alert page exposes a category filter, and IAM alerts carry that category value. Selecting it narrows the list to IAM-related alerts in one action, avoiding manual review of unrelated entries and satisfying the requirement for the most efficient viewing method.

Google recommends managing access via groups rather than individual users. By creating a group and assigning roles to the group, the administrator simplifies access management and ensures consistent permissions. This approach aligns with least privilege and scalability, as group membership can be managed centrally.

Conditional Access can enforce MFA for administrative roles and cloud apps. Azure AD Access Reviews enable periodic attestation of access, satisfying quarterly reviews. Automated user provisioning with SCIM ensures that when an employee is disabled in the HR system, their account is disabled in Azure AD and downstream apps quickly, meeting the 15-minute revocation requirement. This combination directly addresses all three needs.

IAM Security policies in Prisma Cloud analyse permissions granted versus permissions actually used, surfacing over-privileged identities. This directly satisfies the requirement to detect excessive IAM privileges in GCP, as the policy type is purpose-built for permission analysis rather than network or workload misconfigurations.

Prisma Cloud applies a single policy framework across AWS, Azure and GCP, so IAM controls are authored once and enforced uniformly. This satisfies the benefit of consistent security policies across clouds, eliminating per-provider tooling and divergent rule sets.

Filtering Audit Logs by event type isolates sensitive actions such as IAM policy changes or user creation, revealing which IAM users performed them. This satisfies the requirement to identify users behind privileged activity rather than reviewing all log entries.

Prisma Cloud correlates access key creation dates with usage telemetry, flagging credentials unused beyond the 90-day threshold. This stale-credential detection satisfies the stem's IAM risk requirement, identifying dormant keys that expand the attack surface and should be rotated or removed.

IAM activity monitoring ingests CloudTrail events and surfaces identity-related API calls. This allows detection of events like CreateUser with console access enabled and policy attachment that escalates permissions. It provides the event-level visibility needed to identify both scenarios in near real time.

Associating a policy with an automated remediation action lets Prisma Cloud trigger the fix the moment the '*' S3 grant is detected, satisfying the automatic remediation constraint. The policy defines the misconfiguration; the remediation action executes the corrective API call, removing the wildcard without administrator intervention.

Prisma Cloud needs an assumable identity inside the target AWS account to call IAM APIs; creating a cross-account IAM role establishes that trust relationship, satisfying the requirement to govern IAM in a newly onboarded account.

StackSets with service-managed permissions automatically deploy a template to every existing account and to new accounts as they join the organization. Defining AWS::IAM::AccountPasswordPolicy in that template applies the exact baseline — length 14, 24-password reuse prevention, 90-day rotation — with no manual per-account work. This is the native, drift-resistant way to enforce identical account-level IAM settings across an AWS Organization.

An alert cannot fire unless the policy is enabled and its scope covers the affected accounts or resources. Verifying status and scope first satisfies the troubleshooting requirement, since a disabled or mis-scoped policy is the most common cause of silent non-triggering.

Configuring IP address allowlists in Prisma Cloud restricts console access to trusted network ranges, satisfying the requirement to limit where administrators can authenticate from. This operates at the network perimeter, blocking sessions originating outside approved addresses before authentication, unlike role-based controls that govern what an authenticated user may do.

A cross-account IAM role with a trust policy lets Prisma Cloud assume permissions in the target account without long-lived access keys, satisfying the standard onboarding requirement for IAM monitoring. The trust relationship defines exactly which Prisma Cloud principal may assume the role, enabling secure, auditable read access.

The IAM dashboard aggregates identities, roles and their associated risk findings into one consolidated view, satisfying the stem's requirement for a high-level overview. It surfaces misconfigurations such as over-privileged roles and unused credentials across connected cloud accounts, rather than exposing raw policy documents or per-resource permission details.

A Limited role in Prisma Cloud scopes permissions to designated cloud accounts or feature sets, satisfying the least-privilege constraint by denying administrative control over the whole tenant. Unlike Admin, which grants unrestricted configuration rights, Limited confines the user's reach to explicitly assigned resources, reducing blast radius.

The Compute role grants permissions covering Defender and host security management, letting administrators protect workloads and hosts. It satisfies the scenario's need to understand which IAM role governs host-based protection within Prisma Cloud's role model.

The System Admin role grants unrestricted access across the Prisma Cloud console, including tenant settings, user management and all policy configuration. This satisfies the stem's requirement for the primary administrative function, distinguishing it from scoped roles such as Account Group Admin or Auditor, which restrict permissions to specific accounts or read-only views.

The External ID is a shared secret condition in the role trust policy, ensuring Prisma Cloud assumes the role only on behalf of your account. This satisfies the confused deputy requirement by preventing another customer from tricking the role into granting access.

This is correct because adding a condition on `sts:ExternalId` ensures only requests including the correct external ID are allowed, and removing the former partner's account ID revokes their access. It preserves legitimate cross-account access for current partners while eliminating the risk from the defunct relationship.

This is correct because Prisma Cloud's IAM security module continuously scans IAM configurations using the permissions of the onboarding role. The role must have read access to IAM policies, roles, and users. Enabling the module in the console activates the evaluation and alerting. No additional policy attachment is needed beyond what is already granted to the role for Prisma Cloud to function.

Effective permissions analysis calculates the union of all permissions granted to an identity, whether directly attached or inherited through groups. It can trace each permission back to its source, showing whether AdministratorAccess comes from a direct attachment or a group membership. This directly answers the analyst's question.

Prisma Cloud requires a valid email address because it serves as the unique user identifier and the destination for the invitation link the new user must accept to activate the account. This satisfies the mandatory identity constraint when creating a console user.

The Policy page displays each policy's status, showing whether it is enabled and actively evaluated against your cloud accounts. Checking there confirms enforcement state, satisfying the need to verify that a given IAM policy is currently being applied rather than merely defined.

RQL queries the IAM user metadata that Prisma Cloud ingests, including access key creation dates, so a saved query filtering key age greater than 90 days directly satisfies the requirement to detect permanent keys exceeding that threshold.

Read-only access to IAM metadata lets the connector poll policy definitions and audit logs without modifying them, so Prisma Cloud detects and records every IAM change. This satisfies the stem's tracking requirement, since write permissions are unnecessary and would violate least privilege.

Prisma Cloud uses cross-account role assumption to access customer AWS accounts. The target account must have an IAM role whose trust policy permits Prisma Cloud's account to assume it, and whose permissions policy grants the read access needed for IAM and activity data. This is the standard onboarding method.

Least privilege grants identities only the permissions required for their task, scoped to specific resources and time-bound where possible, minimising blast radius from compromised credentials or misconfiguration. This directly satisfies the recommended IAM best-practice constraint by removing standing excessive access.

IAM User Activity analyses CloudTrail logs to map which granted AWS IAM permissions were actually exercised, flagging unused actions for removal. This directly satisfies the least-privilege requirement by identifying dormant permissions, rather than merely listing policies or detecting misconfigurations.

Listing actions reveal bucket names, object keys, and bucket regions without returning object bytes, which is precisely inventory-level visibility. s3:ListAllMyBuckets enumerates buckets in the account, s3:ListBucket lists keys within a bucket, and s3:GetBucketLocation reports the region. None of these allows reading object contents, so the engineer can audit what exists without accessing sensitive data.

Prisma Cloud analyzes IAM activity and compares granted permissions against actual usage. It can identify roles that have not been used within a defined lookback window, such as 180 days. This directly supports flagging the DataPipelineRole as unnecessary and provides evidence for remediation.

An instance profile role lets the EC2 instance obtain rotating temporary credentials automatically through the instance metadata service, which the AWS SDK and CLI consume without code changes beyond removing the static keys. Permissions are identical because the role carries the same S3 policy. There is no key file to store or rotate, so operational overhead drops and credential lifetime is short by design.

The Access Control menu governs authentication entry points, letting administrators configure SSO and identity provider settings so users authenticate through the organisation's chosen IdP. This matches the stem's question about settings managed within that menu.

Prisma Cloud IAM security policies are designed to evaluate identity configurations against defined conditions. A policy can inspect the CreateDate of an access key and raise an alert when the calculated age exceeds the 90-day threshold. This directly satisfies the requirement to detect unrotated keys without manual scripting.