Prove an explicit deny beats an administrative allow

applied · 65 min · Objective 4.2

Task

Demonstrate the policy evaluation rules directly: build an identity with broad permissions, then stop it doing one specific thing with an explicit deny it cannot escape. This is the mechanism behind every organisational guardrail.

Steps

  1. Create an identity with a broad allow -- everything on a test resource group. Confirm it can create, modify and delete a resource, and record the evidence in lab/eval.md.
  2. Add a SEPARATE policy containing an explicit deny for one action, such as deleting a logging configuration. Attempt that action and capture the refusal.
  3. Attempt to remove the deny policy using the same identity, and record what happens. Then apply a boundary or organisational policy that prevents even that, and record the result.
  4. Add a CONDITION to one allow -- restrict it by tag, by region, or by requiring multifactor authentication. Show it succeeding when the condition is met and failing when it is not.
  5. Write the three-line summary: default deny, explicit allow permits, explicit deny always wins -- and the sentence about boundaries limiting rather than granting.

Verify

grep -Eci 'explicit deny' lab/eval.md
grep -Eci 'condition' lab/eval.md
grep -Eci 'boundary|organisation|organization|service control' lab/eval.md
grep -Eci 'limit(s)? rather than grant|does not grant' lab/eval.md

All four non-zero. The last check is the one people get wrong in exams: a boundary caps what an identity can have and never gives it anything.

This is an independent study companion for CompTIA Cloud+ CV0-004 and is not produced by or endorsed by CompTIA.