IAM And Access Governance IN Cloud practice questions

Alert Rule Configuration

Why it fails: Alert rules trigger based on policy violations.

Compute Identity Mapping

Why it fails: This relates to container identities, not cloud IAM.

Compliance Reporting

Why it fails: Reporting generates documents, it does not perform mapping.

Apply a global block policy in the Cloud Account settings

Why it fails: Global policies apply everywhere and cannot target resource groups.

Use the default 'System Admin' role

Why it fails: System Admin provides global permissions.

Disable the user's access via the Azure portal only

Why it fails: This does not utilize Prisma Cloud's governance capabilities.

Inventory > IAM

Why it fails: This lists resources but does not provide posture summary.

Monitor > Alerts

Why it fails: Alerts show specific violations, not aggregate posture.

Settings > Access Control

Why it fails: This is for user management, not infrastructure posture.

Network monitoring

Why it fails: Unrelated to IAM permissions.

Policy compliance dashboard

Why it fails: This shows configuration state, not usage patterns.

Compute vulnerability scanning

Why it fails: Unrelated to IAM permissions.

The number of emails sent by the user

Why it fails: Email volume is not a relevant IAM security metric.

The user's favorite programming language

Why it fails: This is irrelevant to security risk.

Account Group Read Only

Why it fails: Account Group Read Only limits visibility to a specific account group but still grants the ability to view and potentially export configuration data beyond what auditors require; it does not enforce a strict read-only posture across all cloud resources. In this scenario, the auditors need console read-only access without any configuration change capability, so this role is too broad and not the correct least-privilege choice.

System Admin

Why it fails: System Admin provides full administrative control over Prisma Cloud settings, users, and integrations. Granting this to auditors would violate least privilege because they could modify policies, users, and cloud account configurations. The requirement explicitly forbids any configuration change, so a highly privileged administrative role is inappropriate and unsafe for this use case.

Account and Cloud Provisioning

Why it fails: Account and Cloud Provisioning is intended for onboarding and managing cloud accounts, which involves creating and modifying cloud account connections. This role would allow the auditors to change account configuration, directly contradicting the requirement that they must not modify any cloud resource or Prisma Cloud configuration. It is therefore unsuitable for a read-only auditor group.

Generate a temporary security token using AWS STS GetSessionToken in Account A and pass it to the application via environment variables.

Why it fails: GetSessionToken returns credentials for an IAM user, not for an EC2 instance role, and still requires long-term credentials to call. It does not provide the cross-account trust needed for the instance to access Account B's S3 bucket. This method also introduces operational overhead for token rotation and does not align with instance profile usage.

Configure the S3 bucket policy in Account B to allow the EC2 instance's public IP address and attach an IAM policy to the instance role in Account A granting s3:GetObject.

Why it fails: Bucket policies based on public IP addresses are fragile because instance IPs change, and they do not authenticate the instance's identity. Attaching an IAM policy in Account A alone does not grant access to a bucket in Account B; cross-account access requires a trust relationship and often a bucket policy. This approach also ignores the need for temporary credentials via role assumption.

Create an IAM user in Account B with programmatic access and embed the access key and secret key in the EC2 instance's user data.

Why it fails: Embedding long-term credentials in user data violates the requirement to avoid stored credentials and is a serious security risk. User data is accessible to anyone with instance metadata access, and rotating keys becomes operationally difficult. This approach also fails to leverage IAM roles, which are the recommended mechanism for granting AWS permissions to EC2 instances.

Manually review IAM users and roles in each cloud provider weekly and disable accounts of terminated employees.

Why it fails: Manual weekly reviews cannot meet a 24-hour revocation requirement and are error-prone. This approach relies on human diligence and does not scale. It also fails to address federated identities where users may not have local accounts, leaving access active until the next review.

Implement a script that runs daily to query Microsoft Entra ID for terminated users and then calls AWS and Google Cloud APIs to remove their permissions.

Why it fails: A daily script might run within 24 hours but introduces delay and potential failure points. It also requires custom development and maintenance, and may not handle all federated access scenarios. SCIM is a standardized, real-time solution that is more reliable and immediate.

Require employees to use personal email addresses for cloud accounts so that HR can notify cloud providers directly upon termination.

Why it fails: Using personal email addresses for corporate cloud accounts is a security anti-pattern; it bypasses corporate identity governance and lacks centralized control. Notifying providers directly is not a scalable or reliable process and does not ensure timely revocation across all services.

AWS Security Hub

Why it fails: Security Hub aggregates security findings from various services and can alert on IAM issues, but it does not directly analyze policies for least privilege or detect policy changes on its own. It relies on other services like Access Analyzer and Config to generate findings. It is a central dashboard, not a primary detection or analysis tool.

AWS Trusted Advisor

Why it fails: Trusted Advisor provides recommendations on security, cost, performance, and fault tolerance. Its security checks include IAM use, but it does not provide detailed policy analysis or real-time detection of policy changes. It is not designed for continuous monitoring of IAM policy modifications or least privilege validation.

AWS Config

Why it fails: AWS Config can track changes to IAM policies and evaluate compliance against rules, but it is not specifically designed for least privilege analysis. It can detect changes but lacks the policy validation capabilities of IAM Access Analyzer. While useful, it is not the primary tool for enforcing least privilege.

Create an IAM policy in each member account that denies console access without MFA and denies iam:CreateAccessKey, and attach it to all IAM users.

Why it fails: This approach requires manual policy creation and attachment in every member account, which is not centralized or scalable. It also does not prevent the creation of new IAM users who might not have the policy attached. While it enforces the requirements, it fails to minimize per-account configuration and is prone to drift.

Configure AWS IAM Identity Center (successor to AWS Single Sign-On) to require MFA and disable the creation of IAM users in all accounts.

Why it fails: IAM Identity Center can enforce MFA for federated users, but it does not automatically disable existing IAM users or prevent their creation. The requirement specifically targets IAM users, and Identity Center alone does not deny iam:CreateAccessKey for IAM principals. Additional SCPs or policies would still be needed to fully meet the requirements.

Implement a Lambda function triggered by AWS CloudTrail that detects iam:CreateAccessKey events and automatically deletes the created access key and disables the IAM user.

Why it fails: This is a reactive detective and corrective control, not a preventive one. It allows the action to occur before remediation, which may be too late if the key is used maliciously. It also does not enforce MFA for console access. The requirement asks for a preventive, centralized solution, which is better served by SCPs.

In the security account, create a role with a trust policy that lists all member account IDs as Principals; in each member account, grant the security account role sts:AssumeRole permission on a wildcard resource.

Why it fails: This reverses the trust direction. The security account role trusts the member accounts, meaning member accounts could assume a role in the security account, violating the one-way requirement. Additionally, granting sts:AssumeRole on a wildcard resource in member accounts does not establish a trust relationship; the member accounts would need a role that trusts the security account. This approach fails to meet the scenario's core constraint.

In each member account, create an IAM user with programmatic access and share the access keys with the security account's automation; restrict the user's permissions to read-only.

Why it fails: Sharing long-term IAM user access keys across accounts is a poor security practice and violates least privilege and credential management best practices. It also does not create a one-way trust relationship; the member account user credentials could be used from anywhere, and the security account would possess credentials that belong to the member account, effectively giving the security account access but not preventing member accounts from having their own access. This is not a recommended cross-account pattern.

Use AWS IAM Identity Center to create a permission set that grants sts:AssumeRole to all member accounts, and assign it to users in the security account.

Why it fails: IAM Identity Center permission sets are used to assign access to users and groups within an organization, typically for human access to accounts. While it can facilitate cross-account access, it does not inherently enforce a one-way trust model where member accounts cannot assume roles back. The requirement is about role trust policies, not user permission sets. This approach also introduces user-centric access rather than the automation role pattern needed.

Rotate the key by creating a new user-managed key and updating the application configuration to use it.

Why it fails: Creating a replacement key leaves the exposed key active and usable by anyone who copied it from the repository. Rotation only helps if the old key is deleted in the same operation, and the scenario asks to invalidate the leaked credential first. It also perpetuates the key-file anti-pattern that caused the incident.

Disable the service account with gcloud iam service-accounts disable, then re-enable it once the repository is cleaned.

Why it fails: Disabling the service account stops all authentication for it, including the GKE workloads that legitimately depend on it, causing an outage. It also does not selectively revoke the leaked key; the key material remains valid once the account is re-enabled. The goal is to kill the specific exposed credential while keeping the identity usable.

Add an IAM deny policy on the service account that blocks all principals except the GKE node service account.

Why it fails: Deny policies can restrict which principals may use the service account, but the leaked key still authenticates as the service account itself, so the deny would either block the legitimate workload too or fail to distinguish the attacker. The exposed key must be revoked at the credential level, not merely constrained by principal conditions.

Conditional Access, Microsoft Entra ID Protection, and password hash synchronization.

Why it fails: Identity Protection helps detect risky sign-ins but does not enforce quarterly access reviews. Password hash synchronization is a sign-in method, not a deprovisioning mechanism. This combination lacks the access review and rapid revocation capabilities required. It may improve security posture but does not meet the specific governance and timely revocation requirements.

Azure AD B2C, Conditional Access, and manual access revocation via PowerShell scripts.

Why it fails: Azure AD B2C is for customer identity and access management, not workforce identity. Manual revocation via PowerShell is error-prone and unlikely to meet a 15-minute SLA consistently. While Conditional Access enforces MFA, the absence of automated provisioning and access reviews means the solution is incomplete and does not scale for governance.

Microsoft Entra Privileged Identity Management (PIM), Conditional Access, and Microsoft Entra Connect sync.

Why it fails: PIM provides just-in-time privileged access and can require MFA, but it does not provide quarterly access reviews by itself; that is done via Access Reviews. Microsoft Entra Connect sync typically runs every 30 minutes, which may not meet the 15-minute revocation requirement. While these features are useful, they do not fully satisfy the need for automated, rapid deprovisioning.

The IAM policy is attached to the developers' group, but group tags are not supported for aws:PrincipalTag; only user tags are supported.

Why it fails: AWS does not support tags on IAM groups. aws:PrincipalTag uses tags on the principal making the request, which can be an IAM user or an assumed role session. Group tags are not a feature, so this statement is incorrect. The issue is not about group tags but about ensuring the principal has the necessary tags and that they are available in the request context. If developers are using roles, the role must have tags or session tags must be passed.

The policy must use the condition operator ForAllValues:StringEquals with aws:RequestTag/Project and aws:PrincipalTag/Project to ensure all tags match.

Why it fails: ForAllValues:StringEquals is used when the request can have multiple values for a condition key, and it checks that every request value matches at least one policy value. For a single tag key like Project, StringEquals is sufficient. Using ForAllValues does not fix the underlying issue of principal tags not being present or mismatched. It might even weaken the condition if not used carefully. The problem is likely missing session tags or incorrect principal tag source.

The condition keys aws:RequestTag and aws:PrincipalTag are not supported for the ec2:StartInstances and ec2:StopInstances actions.

Why it fails: AWS supports condition keys like aws:RequestTag and aws:PrincipalTag for many EC2 actions, including StartInstances and StopInstances. These keys are evaluated during authorization. While not all services support all condition keys, EC2 does support tag-based conditions for instance actions. Therefore, this is not the likely cause; the issue is more likely a policy misconfiguration such as using the wrong condition operator or key.

Enable Azure Defender for Storage to monitor and block listKeys operations.

Why it fails: Azure Defender for Storage provides threat detection and alerts but does not block specific API actions. It is a detective control, not a preventive one. It cannot enforce the removal of listKeys permissions from a custom role.

Assign the built-in Storage Account Contributor role to the service principal, which includes listKeys but also allows blob read.

Why it fails: The Storage Account Contributor role includes listKeys and other management permissions, which violates the requirement to prevent key listing. It grants more permissions than needed. Using a built-in role with excessive privileges is not aligned with least privilege.

Create a deny assignment on the storage account that denies the listKeys action for the service principal.

Why it fails: Deny assignments in Azure are typically managed by Azure Blueprints or managed applications and are not directly assignable by users. They are also not the standard way to restrict custom role permissions. Modifying the custom role is the direct and appropriate method.

Configure the Device state condition to include 'All device platforms' and exclude 'Domain joined' devices.

Why it fails: The Device state condition allows filtering by device compliance or Microsoft Entra ID join status. However, the requirement is about unmanaged devices, which can be addressed by device platform or device compliance. Excluding domain-joined devices would not necessarily cover all unmanaged devices; unmanaged devices could be non-domain-joined but also not compliant. Moreover, the option says include all device platforms and exclude domain joined, which is not a standard configuration. The correct approach would be to use the Device state condition to require compliant or hybrid Microsoft Entra ID joined devices, or use the Client apps condition.

Configure the Locations condition to include All trusted locations and mark 'Configure' to exclude them.

Why it fails: This configuration would exclude trusted locations from the policy, meaning the policy would not apply when users are inside the corporate network. However, the requirement is to require MFA only when outside the corporate network. Excluding trusted locations means the policy applies to all other locations, which is correct. But the option says 'include All trusted locations and mark Configure to exclude them' which is contradictory: you cannot include and exclude the same set. The correct approach is to include All locations and exclude trusted locations, or simply not include trusted locations. This option is incorrectly worded and would not achieve the goal.

Configure the Access controls grant to require multi-factor authentication.

Why it fails: The Access controls grant is where you specify the enforcement action, such as requiring MFA. While this is essential to actually require MFA, the question asks for conditions to configure to meet the requirements (outside corporate network and unmanaged devices). The grant control is not a condition but an action. The conditions are the Locations and Device state (or Client apps). Therefore, this option is not one of the two conditions requested.

The IAM role trust policy does not include the SAML identity provider as a principal.

Why it fails: The IAM role trust policy must include the SAML identity provider as a principal for the role to be assumable via SAML. However, if this were missing, users would not be able to assume the role at all, and the error might be different. Since users can authenticate but get Access Denied on resources, it suggests the role assumption might be succeeding but the role lacks permissions. Alternatively, if the trust policy is misconfigured, the AssumeRoleWithSAML call would fail with an error, not necessarily Access Denied on resources. The more likely missing piece is the attribute mapping.

The AWS IAM identity provider is not configured with the correct metadata document from the IdP.

Why it fails: If the IAM identity provider metadata is incorrect, the SAML authentication would fail entirely, and users would not be able to authenticate. Since users can authenticate successfully, the metadata is likely correct. The issue is after authentication, when AWS tries to map the SAML assertion to an IAM role. Therefore, this is not the most likely cause.

The IAM role's permissions policy does not grant sts:AssumeRoleWithSAML.

Why it fails: sts:AssumeRoleWithSAML is an action that is called by AWS on behalf of the user after successful SAML authentication. The IAM role's permissions policy does not need to grant this action; it is granted via the trust policy. The trust policy must allow the SAML identity provider to assume the role. The permissions policy defines what the role can do after assumption. Since users get Access Denied on resources, the role might be assumed but lacks necessary permissions, or the attribute mapping is wrong. Missing sts:AssumeRoleWithSAML in the permissions policy is not the issue.

roles/bigquery.dataEditor

Why it fails: roles/bigquery.dataEditor includes all permissions of dataViewer plus permissions to modify data and metadata, such as bigquery.tables.updateData and bigquery.tables.delete. It also includes bigquery.tables.export? Actually, dataEditor does not include export permissions; export is part of bigquery.admin or custom roles. However, dataEditor grants more than needed, violating least privilege. It allows editing and deleting data, which is not required. The requirement is only to query, not modify. Therefore, dataEditor is too permissive and not the best choice.

roles/bigquery.admin

Why it fails: roles/bigquery.admin grants full control over BigQuery resources, including the ability to export data to Cloud Storage via bigquery.tables.export. This violates the requirement to prevent export. It also grants excessive permissions far beyond querying, such as managing datasets, tables, and jobs. Assigning this role would not meet the security objective and violates least privilege. Therefore, it is incorrect.

roles/bigquery.user

Why it fails: roles/bigquery.user includes permissions to run jobs, including query jobs, and to create datasets, but it also includes bigquery.tables.export? Actually, bigquery.user does not include export permission; export is in bigquery.admin or custom. However, bigquery.user grants broad permissions such as creating datasets and running jobs, which may allow the analyst to export data via query results? Exporting to Cloud Storage requires bigquery.tables.export, which is not in bigquery.user. But bigquery.user is still more permissive than needed, as it allows creating datasets and other actions. The least privilege role is dataViewer.

Network policy

Why it fails: Network policies inspect VPC traffic flows, firewall rules and exposure, so they cannot evaluate IAM role bindings or permission grants. They are tempting because Prisma Cloud uses them for misconfigured security groups and open ports, which would be the right choice when the scenario asks about network exposure rather than excessive identity permissions.

Compute policy

Why it fails: Compute policies assess host, container and serverless workload configuration, not GCP IAM role bindings. They would be correct for detecting insecure VM or image settings, but over-privileged users need an identity and access management policy.

Data security policy

Why it fails: Data security policies inspect and protect data stores such as buckets and databases, not IAM role bindings. They would be correct for detecting exposed sensitive data, but over-privileged GCP IAM users require an identity and access management policy.

Cloud Accounts > Onboarding > IAM Roles

Why it fails: Onboarding an AWS account with a cross-account IAM role merely grants Prisma Cloud read access to the account; it does not analyse permission usage. It is tempting because the workflow is IAM-centric, but it would be correct when first connecting an account so that other modules, such as Permissions, can subsequently collect data.

Compliance > Policy Analysis

Why it fails: Policy Analysis evaluates resources against configured compliance rules and benchmarks; it does not track which granted permissions were actually exercised. It is tempting because it reports on IAM policies, but it would be the correct choice when the goal is flagging policy violations against a standard, not identifying unused permissions.

Compute > Vulnerability Management

Why it fails: Vulnerability Management scans workloads and container images for CVEs; it holds no IAM policy data, so it cannot report unused permissions. It is tempting because it also lives under Compute and addresses cloud security posture, but it would be the right choice when the requirement is detecting vulnerable packages or misconfigured images rather than rightsizing roles.