Examkin

Question

Difficulty: MediumIdentity and Access Management Operations

During a routine security audit, a security engineer discovers that an internal data-processing application uses static, long-lived API keys embedded directly within source code to query a backend customer database. Additionally, the service account assigned to this application currently holds full database administrator privileges. To mitigate credential exposure risks and align with identity operational best practices, which of the following actions should the engineer take? (Select TWO.)

  1. Deploy a centralized secrets management vault to dynamically issue and automatically rotate short-lived API credentials.Answer
  2. B
    Configure perimeter network firewall rules to implicitly trust all requests originating from the application server's internal IP subnet.
  3. Reconfigure account permissions using scoped Role-Based Access Control (RBAC) to restrict the service account to specific read and write operations.Answer
  4. D
    Enforce multi-factor authentication (MFA) on the service account to automatically restrict its database permission boundaries.

Answer

Deploying a centralized secrets management vault to issue and rotate short-lived API credentials, and reconfiguring account permissions using scoped Role-Based Access Control (RBAC) to enforce least privilege.
Deploying a centralized secrets management vault automates credential rotation and removes static secrets from source code, securing the identity lifecycle. Implementing scoped Role-Based Access Control (RBAC) ensures the service account retains only the minimum permissions necessary for data processing, satisfying the principle of least privilege.

Step-by-Step Solution

1
Analyze the identified operational IAM vulnerabilities in the scenario.
Identified two core deficiencies: hardcoded long-lived credentials in source code and excessive administrative privileges on a service account.
Resolving credential leakage and privilege creep requires distinct operational controls addressing credential lifecycle and access assignment.
2
Evaluate remediation strategies for the hardcoded long-lived credentials.
Integrating a centralized secrets vault allows applications to fetch short-lived tokens on demand without embedding static secrets into application repositories.
Automated rotation and dynamic issuance mitigate the impact of credential harvesting and unauthorized source code disclosure.
3
Evaluate authorization controls for the service account's excessive permissions.
Applying scoped Role-Based Access Control (RBAC) aligns account rights directly to the specific database operations required by the application.
Restricting database administrator privileges to minimum functional rights enforces the principle of least privilege.

Key Concept

Identity and Access Management Operations: Credential Lifecycle Management and Least Privilege Enforcement
Rate this question

Topics

Identity and Access Management Operations

More questions from this topic