To mitigate IAM misconfigurations in cloud environments, which strategy should be prioritized?

• A. Regularly audit IAM policies and permissions to ensure they align with the principle of least privilege.
• B. Grant all users administrator access to simplify operations.
• C. Disable MFA to streamline access.
• D. Apply random permission changes to confuse potential attackers.

Answer: (A)

Regularly auditing IAM policies and permissions keeps access aligned with the principle of least privilege. In cloud environments, permissions tend to drift as teams evolve and resources change, creating over‑privileged accounts or stale access. An ongoing audit process—ideally automated and treated as code—helps detect excessive permissions, unused roles, and misconfigurations, so you can tighten access to what is actually needed. This reduces the blast radius if credentials are compromised and supports faster, safer operations.

Why not the other ideas? Granting administrator access to everyone erodes the very protection least privilege provides and amplifies risk. Disabling MFA weakens the first line of defense and makes unauthorized access easier. Random permission changes introduce chaos and unpredictability, undermining security rather than improving it.