IAM users created by an administrator do not have default permissions.

Option A is incorrect because it confuses full-access permissions with a read-only role. In Huawei Cloud IAM, a permission whose name contains FullAccess normally represents full or administrator-level permissions for the corresponding service. For example, IAMFullAccess provides full permissions for IAM operations rather than read-only access.

Huawei Cloud separately defines Tenant Guest as providing read-only permissions for cloud services other than IAM. This distinction is important in HCIA IAM authorization concepts: FullAccess and ReadOnlyAccess represent materially different privilege levels.

The remaining statements correctly describe Huawei Cloud authorization. IAM supports roles and policies as authorization mechanisms, with policies providing more fine-grained control. User groups provide an efficient way to authorize multiple IAM users: an administrator assigns permissions to a group and then places users in that group, after which the users inherit the group's permissions. Finally, an IAM user can perform only the cloud-service operations allowed by the permissions granted to that identity.

Thus, option A incorrectly assigns the behavior of a read-only permission model to FullAccess and is the required answer.

Reference topics: IAM Permissions; Roles and Policies; User Groups; FullAccess; Tenant Guest.

===============