A county IT department places staff into security groups such as PublicWorks-Admins and Finance-Readers so every member inherits the same cloud permissions. Which approach scales access management for the municipality?
Select an answer to reveal the explanation.
Short Explanation
Drop someone into the PublicWorks-Admins group and they automatically get the keys that group already holds—no rewriting fifty separate policies. Groups are how cities scale permissions without drowning in one-off accounts. Shared root passwords and owner-for-everyone guest accounts are the opposite of that discipline.
Full Explanation
Group-based access control assigns permissions to department security groups so every member inherits the same cloud permissions. Placing staff into groups such as PublicWorks-Admins and Finance-Readers scales municipal access management: grant once to the group, and membership changes flow to cloud entitlements without rewriting unique IAM documents per employee.
Creating a unique IAM policy document for each employee with no shared group membership does not scale and drifts quickly. Sharing one root account password across an entire department destroys accountability. Disabling identity federation so every contractor uses local guest accounts with owner rights increases standing privilege risk.
Exam caveat: groups are often the bridge between IdP directories and cloud roles; group-based management complements RBAC. Avoid nesting that becomes unintelligible.
Operational check: map department groups to cloud roles, add a test user to Finance-Readers and confirm read-only access, remove membership and confirm access ends, and reconcile group membership to HR org data monthly. Document group ownership for PublicWorks and Finance IAM stewards.
When contractors support PublicWorks or Finance, place them in time-limited nested groups rather than permanent department admin groups, preserving scalable group-based management without accidental standing privilege.