A transit DevSecOps group wants cloud emulation that exercises IAM privilege paths without deleting storage buckets. What scenario quality are they prioritizing?

Selecting non-destructive cloud adversary scenarios that probe IAM paths while preserving civic data stores is the quality transit DevSecOps should prioritize. Privilege-abuse learning comes from walking assume-role chains, policy evaluations, and over-permissioned identities—not from auditing S3 policies while preserving civic data stores, which reviews storage resource policies rather than dynamically exercising IAM privilege escalation. Non-destructive modules still exercise cloud detections and IR playbooks while leaving transit buckets, tickets, and fare data intact for public service continuity.

Selecting non-destructive cloud adversary scenarios that check CloudTrail logs while preserving civic data stores fails by concept because log review only inspects recorded API history rather than dynamically exercising assume-role chains and privilege abuse in emulation; preserving stores alone is not the same as privilege-path coverage.

Selecting non-destructive cloud adversary scenarios that review VPC rules while preserving civic data stores misses the goal because it emphasizes network rule and connectivity review rather than probing IAM privilege paths, so it preserves stores but does not exercise assume-role chains and privilege abuse.

Exam caveat: "non-destructive" still requires a written blast-radius review; read-heavy IAM probes can trigger rate limits or noisy alerts that need SOC coordination. Operational check: inspect the scenario catalog to distinguish IAM privilege-path probes from S3-policy audits that leave privilege abuse unexercised, confirm production bucket policies deny the emulation principal delete APIs, and run an abort drill that proves storage remains readable while IAM paths are exercised.