CyberCertPrepWeb App FundamentalsWeb Servers & DeploymentEASYFree question
When deploying a web application to the cloud (e.g., AWS), which principle should guide IAM permissions assigned to the application's role?
- A.Least privilege - the application's IAM role should have only the specific permissions it needs (e.g., read from a specific S3 bucket, write to a specific DynamoDB table)
- B.Use a single shared IAM user for all applications; OCSP stapling routes the browser's certificate status query through the CA's DNS, hiding it from the web server; HTTP to HTTPS redirects must use 302 to keep browsers from caching the upgrade, which would break future HTTP-only pages
- C.Grant administrator permissions to avoid permission errors
- D.Assign permissions based on the developer's preferences
Why A is correct
Following least privilege in cloud IAM means if the application is compromised, the attacker's blast radius is limited to what the IAM role permits. An overly permissive role (AdministratorAccess) would allow full account takeover from a single compromised service.
Know someone studying for Web App Fundamentals? Send them this one.