ACA Identity and Access Management Flashcards

Which Alibaba Cloud feature enables single sign-on (SSO) for enterprise users to log in with their corporate identity?

Answer: Identity Provider (IdP) federation via RAM SSO

Alibaba Cloud RAM SSO lets enterprises configure an IdP (such as Microsoft AD) so employees can authenticate with their corporate credentials to access Alibaba Cloud.

What is the purpose of the Condition element in a RAM policy?

Answer: To add extra constraints such as IP address range or MFA requirement before an action is permitted

The Condition element lets you add context-based restrictions to a policy, such as allowing access only from a specific IP range or requiring MFA.

Which of the following is an example of a valid Alibaba Cloud resource ARN format used in RAM policies?

Answer: acs:ecs:cn-hangzhou:123456789:instance/i-abc123

Alibaba Cloud ARNs use the format acs::::/, with 'acs' as the prefix.

What is the maximum number of AccessKey pairs a single RAM user can have active simultaneously?

Answer: 2

Each RAM user can have a maximum of 2 AccessKey pairs at the same time, allowing key rotation without service interruption.

Which permission allows a RAM user to pass a RAM role to an Alibaba Cloud service (such as assigning a role to an ECS instance)?

Answer: ram:PassRole

The ram:PassRole permission is required for a user to assign a RAM role to a cloud service; without it, the user cannot grant the service role-based access.

In Alibaba Cloud RAM, what does the wildcard character '*' mean when used in the Action element of a policy?

Answer: It grants or denies all actions for the specified service

Using '*' in the Action element matches all actions for the targeted service or across all services, effectively granting or denying full access.