A research team needs temporary access broader than normal.
Record purpose, expiry, compensating controls, and approval, then remove access when it expires.
Which governance approach is most appropriate?
Use an exception register with time-limited permissions, compensating monitoring, automatic expiry, and reapproval.
Detailed explanation
Access expiry and data retention are separate decisions.
Access expiry and data retention are separate decisions.
There is no durable audit or reapproval trail.
There is no durable audit or reapproval trail.
A valid purpose does not justify unlimited authority.
A valid purpose does not justify unlimited authority.
The exception is bounded, monitored, and automatically reviewed or revoked.
The exception is bounded, monitored, and automatically reviewed or revoked.
Check official documentation
Compare the following points with the official documentation.
AWS IAM policy conditions、temporary credentials、AWS Audit Managerの公式説明を確認する。
What to confirm
目的だけで無期限許可する運用と、期限・補完制御付き例外の違いを説明できる。
Key points
- Exception
- Time-limited access
- Approval
- Compensating control
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Risk acceptance
Record the remaining risk, data classification, monitoring, and accountable owner.
Automatic expiry
Combine session duration, schedules, tags, and an exception register to detect expiration.