Examkin

Question

Difficulty: MediumIdentity and Access Management Operations

During a routine security review of cloud identity operations, a security analyst discovers that an automated data synchronization process uses a legacy service account configured with a long-lived static API key. The key was inadvertently committed to an internal repository, allowing an unauthorized external entity to request access tokens and enumerate cloud resources. Which of the following operational controls should the security team implement to remediate this vulnerability and secure the service identity lifecycle? (Select TWO.)

  1. Migrate the automated service identity to use workload identity federation with short-lived, ephemeral tokens instead of hardcoded credentials.Answer
  2. B
    Enforce strict network perimeter firewall rules at the local datacenter border to drop all external authentication requests.
  3. Configure risk-based conditional access policies to evaluate request context and block token issuance from unexpected locations or anomalous sources.Answer
  4. D
    Reassign the service account to a restricted role group while retaining the static key authentication mechanism.

Answer

The security team should migrate the service account to workload identity federation with short-lived tokens and implement contextual conditional access policies.
Migrating to workload identity federation eliminates static long-lived credentials by issuing short-lived tokens based on trusted identity relationships. Combining this with risk-based conditional access ensures token requests from untrusted origins or anomalous locations are blocked automatically.

Step-by-Step Solution

1
Identify the primary operational vulnerability.
The vulnerability stems from using long-lived static credentials (API keys) that can be leaked and abused externally.
Static credentials present a continuous risk of exposure and lack dynamic identity verification.
2
Select credential lifecycle remediation controls.
Replace long-lived keys with workload identity federation to issue short-lived, ephemeral access tokens.
Ephemeral tokens drastically reduce the window of opportunity for compromise.
3
Select adaptive access controls for identity operations.
Apply conditional access policies to inspect request context and block suspicious token requests.
Risk-based conditional access enforces Zero Trust principles for service account token requests.

Key Concept

Workload Identity Federation and Conditional Access Control in IAM Operations
Rate this question

Topics

Identity and Access Management Operations

More questions from this topic