Separating cloud console permissions | LinuC Level 1 102 Exam original practice question

1.10.4Basic

Allow an operations worker to view logs but prevent network deletion and billing-setting changes.

Which design is appropriate?

Hint 1: Focus on the responsibility boundary

Separate account, network, storage, audit, and recovery controls before comparing the choices.

Hint 2: Key terms

Review the short definitions of cloud security boundaries, authentication factors, permissions, and recovery controls involved.

Least privilege: Granting only the actions and resources required for a task.
Administrator role: A role with broad permissions to change or remove resources and settings.
Authentication and authorization: Separating identity verification from the decision about which operations are allowed.
Audit log: A record of administrative actions, actors, times, and affected resources.

Detailed explanation

Correct職務に必要な操作だけを許可する最小権限のロールを割り当てる。

Correct. A role limited to required operations reduces accidental and compromised-account impact.

Incorrect全員を管理者ロールにする。

Incorrect. Giving everyone administrator access violates least privilege.

Incorrectパスワードを短くする。

Incorrect. Shortening passwords weakens authentication and does not separate permissions.

Incorrect監査ログを無効にする。

Incorrect. Disabling audit logs removes accountability.

An example you can run in a temporary verification environment.

printf '%s\n' 'read-only operations must not grant destructive permissions'

read-only operations must not grant destructive permissions

Foundation review

Split operations, development, and billing permissions between appropriate roles.

Remove or update roles when people change jobs or leave the organization.

Question IDKL-102-1172

EnvironmentクラウドIAM設計の概念確認

Last technical review2026-08-20

More practice in this area