ACA ACA Identity and Access Management 2 — Questions and Answers
Question 1: What is the recommended way to organize RAM users that share the same job function in Alibaba Cloud?
- Create a separate Alibaba Cloud account for each user
- Add all users to a RAM Group and attach policies to the group (Correct answer)
- Assign identical custom policies individually to each user
- Use a single shared AccessKey for all users
Correct answer: Add all users to a RAM Group and attach policies to the group
RAM Groups let you manage permissions for multiple users with the same role by attaching policies once to the group rather than to each individual user.
Question 2: Which of the following is true about the Alibaba Cloud account root user (primary account)?
- It should be used for all day-to-day operations
- It has the same permission level as a RAM administrator user
- It has unrestricted access to all resources and should be protected carefully (Correct answer)
- It can be deleted and replaced by a RAM user for security
Correct answer: It has unrestricted access to all resources and should be protected carefully
The root account has full, unrestricted access to all Alibaba Cloud services and billing, so best practice is to use RAM users for daily tasks and secure the root account with MFA.
Question 3: What is a trust policy in the context of a RAM Role?
- A policy defining what actions the role can perform
- A policy specifying which entities are allowed to assume the role (Correct answer)
- An Alibaba Cloud-managed policy granting full access
- A billing rule applied to role usage
Correct answer: A policy specifying which entities are allowed to assume the role
The trust policy (principal definition) on a RAM role specifies which Alibaba Cloud accounts, services, or users are permitted to assume that role.
Question 4: A developer needs to access OSS from a mobile app without exposing long-term credentials. Which approach should be used?
- Embed the root account AccessKey directly in the app
- Use a RAM user AccessKey hardcoded in the app code
- Use STS to issue short-lived tokens for the mobile app (Correct answer)
- Grant the mobile app RAM administrator permissions
Correct answer: Use STS to issue short-lived tokens for the mobile app
STS temporary credentials are the secure approach for mobile and untrusted environments because they expire and limit exposure if compromised.
Question 5: Which RAM policy element is used to specify the Alibaba Cloud resource an action applies to?
- Effect
- Action
- Resource (Correct answer)
- Condition
Correct answer: Resource
The Resource element in a RAM policy uses an ARN (Alibaba Cloud Resource Name) format to identify the specific resource the policy statement applies to.
Question 6: What happens when a RAM user has no policies attached?
- The user inherits the permissions of the root account
- The user has access to all free-tier services
- The user has no permissions and cannot perform any actions (Correct answer)
- The user automatically receives read-only access to all services
Correct answer: The user has no permissions and cannot perform any actions
Alibaba Cloud RAM follows a default-deny model, meaning RAM users with no attached policies have zero permissions by default.
ACA ACA Identity and Access Management 2
What is the recommended way to organize RAM users that share the same job function in Alibaba Cloud?