4.1 - Cloud identity and access management
Cloud+ CV0-004 objective 4.1 covers identity and access management in the cloud. The principle of least privilege grants each user only the permissions required for their job, limiting the damage from a compromised account. MFA requires a password plus a second factor, such as a one-time code from an app, before granting access, defeating stolen passwords. Role-based access control (RBAC) assigns permissions to a group or role and adds users to it, which is easier to manage than per-user grants. A security token service issues short-lived, temporary credentials when a role is assumed, so nothing long-lived is stored on the client. You should also know federation, SSO, service accounts and key rotation. Expect scenario questions that describe scoping permissions, adding a second factor, grouping access by role, or issuing temporary credentials, and ask which IAM concept applies.
Only the permissions the job needs = least privilege. Password + one-time code = MFA. Permissions to a role/group, add users = RBAC. Short-lived temporary credentials on role assume = security token service.
Practice questions
1. Granting each user only the permissions required for their job follows which principle?
- Zero trust
- Least privilege (correct answer)
- Defense in depth
- Separation of duties
Least privilege limits each identity to the minimum access needed, shrinking the blast radius. Separation of duties splits a sensitive task among people.
2. Requiring a password plus a one-time code from an app before granting access is:
- SSO
- MFA (correct answer)
- RBAC
- PKI
MFA (multi-factor) combines two or more factor types (know/have/are), stopping most credential-theft attacks. SSO logs into many apps with one identity.
3. An IAM identity meant to be assumed temporarily by services or users, granting a set of permissions, is a:
- User
- Role (correct answer)
- Group
- Policy
An IAM role is assumed temporarily to gain permissions without long-lived credentials, ideal for services and cross-account access. A user is a permanent identity.
4. Logging into many independent applications with one set of credentials is provided by:
- MFA
- RBAC
- SSO (correct answer)
- DLP
SSO (single sign-on) authenticates once and grants access to many apps via a trusted identity provider using SAML or OIDC. MFA adds factors; RBAC governs what a role may do.
5. An access model that grants permissions from attributes like department, location and time is:
- MAC
- DAC
- ABAC (correct answer)
- RBAC
ABAC (attribute-based access control) decides access from attributes of the user, resource and context, giving fine, dynamic policies. RBAC grants access purely by assigned role.
6. Granting permissions to a user only through the roles they are assigned describes:
- ABAC
- RBAC (correct answer)
- MAC
- PKI
RBAC (role-based access control) assigns permissions to roles and users inherit them via role membership, simplifying administration. ABAC instead evaluates attributes and context.