ACA Identity and Access Management Flashcards

What is the recommended way to organize RAM users that share the same job function in Alibaba Cloud?

Answer: Add all users to a RAM Group and attach policies to the group

RAM Groups let you manage permissions for multiple users with the same role by attaching policies once to the group rather than to each individual user.

Which of the following is true about the Alibaba Cloud account root user (primary account)?

Answer: It has unrestricted access to all resources and should be protected carefully

The root account has full, unrestricted access to all Alibaba Cloud services and billing, so best practice is to use RAM users for daily tasks and secure the root account with MFA.

What is a trust policy in the context of a RAM Role?

Answer: A policy specifying which entities are allowed to assume the role

The trust policy (principal definition) on a RAM role specifies which Alibaba Cloud accounts, services, or users are permitted to assume that role.

A developer needs to access OSS from a mobile app without exposing long-term credentials. Which approach should be used?

Answer: Use STS to issue short-lived tokens for the mobile app

STS temporary credentials are the secure approach for mobile and untrusted environments because they expire and limit exposure if compromised.

Which RAM policy element is used to specify the Alibaba Cloud resource an action applies to?

Answer: Resource

The Resource element in a RAM policy uses an ARN (Alibaba Cloud Resource Name) format to identify the specific resource the policy statement applies to.

What happens when a RAM user has no policies attached?

Answer: The user has no permissions and cannot perform any actions

Alibaba Cloud RAM follows a default-deny model, meaning RAM users with no attached policies have zero permissions by default.