Palo Alto Networks Certified Cloud Security Engineer (PCCSE)Cloud Infrastructure Entitlement Management (CIEM)Medium
A cloud security architect is designing a secure multi-cloud environment. They want to ensure that access to critical management plane APIs (e.g., creating/deleting VMs, modifying network configurations) is restricted not only by identity but also by the originating network, time of day, and device posture. Which advanced CIEM capability, integrated with other security controls, would best address these contextual access requirements?
- AContext-aware access control
- BStatic policy analysis
- CBaseline compliance checks
- DResource tagging enforcement
Show answer & explanationAnswer & explanation
Correct answer: A. Context-aware access control
Context-aware access control extends traditional identity-based access by incorporating additional contextual factors like network location, time, device health, and behavioral analytics. This directly addresses the requirement for granular access restrictions based on multiple dynamic attributes beyond just the identity itself.
Why the other options are wrong
- B. Static policy analysis reviews policies but doesn't enforce access based on dynamic context.
- C. Baseline compliance checks verify configurations against standards but don't enforce dynamic access control.
- D. Resource tagging enforcement ensures resources are labeled but doesn't control API access based on context.
Context-aware Access Control
An advanced security capability that evaluates multiple contextual attributes (e.g., identity, location, device, time, behavior) in real-time to make granular access decisions.
- Enhances Zero Trust principles
- Reduces unauthorized access risks
- Requires integration with various security data sources
Memory trick: Context is king: who, where, when, and how are you trying to access?