ExpertEasy1 markMultiple Choice
CPA · Question 58 · Area II: Security
A company wants to implement a 'Least Privilege' model for its cloud storage buckets. What does this entail?
A company wants to implement a 'Least Privilege' model for its cloud storage buckets. What does this entail?
Answer options:
A.
Giving all developers admin access to ensure they are not blocked.
B.
Making all buckets public read-only.
C.
Granting users only the minimum permissions necessary to perform their job functions.
D.
Rotating keys every 90 days.
How to approach this question
Least Privilege = Minimum necessary.
Full Answer
C.Granting users only the minimum permissions necessary to perform their job functions.✓ Correct
C
The Principle of Least Privilege states that a subject should be given only those privileges needed for it to complete its task. If a user only needs to read a file, they should not have write or delete permissions.
Common mistakes
Confusing Least Privilege with Separation of Duties.
Practice the full CPA ISC Practice Exam 3
82 questions · hints · full answers · grading
More questions from this exam
Q01A CPA is advising a client who is migrating their legacy on-premise ERP system to a cloud-based s...MediumQ02During a review of a client's cloud governance structure, an auditor notes that the client uses a...MediumQ03An auditor is evaluating the 'Processing Integrity' principle for a financial institution's loan ...HardQ04A company uses a batch processing system to update inventory records overnight. The 'Grandfather-...HardQ05During a walkthrough of the change management process, an auditor observes that the 'Developer' r...Medium