A company wants to implement a 'Least Privilege' model for its cloud storage buckets. What does this entail?

Answer options:

Giving all developers admin access to ensure they are not blocked.

Making all buckets public read-only.

Granting users only the minimum permissions necessary to perform their job functions.

Rotating keys every 90 days.

How to approach this question

Least Privilege = Minimum necessary.

Full Answer

C.Granting users only the minimum permissions necessary to perform their job functions.✓ Correct

The Principle of Least Privilege states that a subject should be given only those privileges needed for it to complete its task. If a user only needs to read a file, they should not have write or delete permissions.

Common mistakes

Confusing Least Privilege with Separation of Duties.

Question 57 All questions Question 59

Practice the full CPA ISC Practice Exam 3

82 questions · hints · full answers · grading

More questions from this exam

Q01A CPA is advising a client who is migrating their legacy on-premise ERP system to a cloud-based s...Medium Q02During a review of a client's cloud governance structure, an auditor notes that the client uses a...Medium Q03An auditor is evaluating the 'Processing Integrity' principle for a financial institution's loan ...Hard Q04A company uses a batch processing system to update inventory records overnight. The 'Grandfather-...Hard Q05During a walkthrough of the change management process, an auditor observes that the 'Developer' r...Medium

View all 82 questions →