CV0-002 · Question #575
During the cloud provisioning process, a misconfiguration results in the requester being granted privileges to the underlying IaaS infrastructure. Which of the following security principles has been v
The correct answer is B. Authorization. A misconfiguration during cloud provisioning led to excessive privileges being granted for IaaS infrastructure, which directly violates the security principle that defines what an authenticated entity is allowed to do.
Question
During the cloud provisioning process, a misconfiguration results in the requester being granted privileges to the underlying IaaS infrastructure. Which of the following security principles has been violated?
Options
- AAuthentication
- BAuthorization
- CPrivilege escalation
- DIdentification
How the community answered
(50 responses)- A2% (1)
- B92% (46)
- C4% (2)
- D2% (1)
Why each option
A misconfiguration during cloud provisioning led to excessive privileges being granted for IaaS infrastructure, which directly violates the security principle that defines what an authenticated entity is allowed to do.
Authentication is the process of verifying a user's identity, ensuring they are who they claim to be, which is distinct from what they are allowed to do after verification.
Authorization is the process of determining what an authenticated entity is permitted to do, based on assigned roles and policies. Granting excessive or incorrect privileges due to a misconfiguration directly implies a failure in the authorization system or its configuration.
Privilege escalation is the act of exploiting a vulnerability to gain higher privileges, whereas the question describes an initial misconfiguration granting privileges.
Identification is the initial step of claiming an identity, preceding the verification process of authentication and the permission assignment of authorization.
Concept tested: Security principles - Authorization and Least Privilege
Source: https://learn.microsoft.com/en-us/azure/security/fundamentals/identity-management-overview#authentication-vs-authorization
Topics
Community Discussion
No community discussion yet for this question.