Which of the following scenarios would indicate a risky Azure Service Principal as identified by a Cloud Infrastructure Entitlement Manager (CIEM)?

Question

Options

• AA Service Principal with "Contributor" role used exclusively for deploying infrastructure.
• BA Service Principal with an expired credential and no associated roles.
• CA Service Principal with "Reader" role assigned to an isolated development environment.
• DA Service Principal with "Owner" role and no restrictions on its scope, accessible by an unused

• A
  13% (2)
• B
  6% (1)
• C
  25% (4)
• D
  56% (9)

Explanation

Option A: The "Contributor" role has elevated permissions, but if the Service Principal is actively used for its intended purpose and scoped appropriately, it is not inherently risky. Option B: An expired credential and no roles assigned effectively nullify any risk associated with the Service Principal. It would not be flagged as risky by CIEM. Option C: The "Reader" role is read-only and does not allow modification of resources, making it a low-risk assignment. It is scoped to an isolated environment, further reducing risk. Option D: An unused application with "Owner" role poses significant risk because it has unrestricted permissions across the subscription. If compromised, this Service Principal could enable attackers to gain full control over the environment.

No community discussion yet for this question.