ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

The developer can launch EC2 instances because the IAM policies attached to the group are automatically applied to every member of that group. The user's effective permissions are therefore not the result of a direct assignment but of group membership, demonstrating the concept of inherited rights. Implicit deny is the default lack of permission until an explicit allow is granted. The need-to-know principle concerns limiting access to only what is necessary for a role, and separation of duties involves splitting responsibilities to prevent fraud or error. Neither of those explains how permissions were obtained; only inheritance from the group does.