AWS AWS Identity & Access Management 2 — Questions and Answers
Question 1: Which AWS Security Token Service feature issues temporary security credentials to users authenticated by an external identity provider?
- AssumeRole
- AssumeRoleWithWebIdentity (Correct answer)
- GetSessionToken
- AssumeRoleWithSAML
Correct answer: AssumeRoleWithWebIdentity
AssumeRoleWithWebIdentity allows users authenticated by web identity providers like Amazon, Google, or Facebook to receive temporary AWS credentials.
Question 2: Which AWS service provides a hierarchical structure to centrally manage multiple AWS accounts, apply governance policies, and consolidate billing?
- AWS Control Tower
- AWS Organizations (Correct answer)
- AWS IAM Identity Center
- AWS Config
Correct answer: AWS Organizations
AWS Organizations lets you group accounts into organizational units (OUs) and apply Service Control Policies for centralized governance.
Question 3: What is the maximum session duration that can be configured when assuming an IAM role?
- 1 hour
- 4 hours
- 8 hours
- 12 hours (Correct answer)
Correct answer: 12 hours
IAM role session durations can be set up to 12 hours (43,200 seconds) when the role's maximum session duration is configured accordingly.
Question 4: Which AWS service issues and manages SSL/TLS certificates for use with AWS services and provides automatic renewal?
- AWS KMS
- AWS Secrets Manager
- AWS Certificate Manager (Correct answer)
- AWS Private CA
Correct answer: AWS Certificate Manager
AWS Certificate Manager (ACM) provisions, manages, and auto-renews public and private SSL/TLS certificates for use with AWS services.
Question 5: What IAM Condition key can enforce MFA authentication before allowing access to sensitive API operations?
- aws:MultiFactorAuth
- aws:SecureTransport
- aws:MFAPresent (Correct answer)
- iam:RequireMFA
Correct answer: aws:MFAPresent
The condition key `aws:MultiFactorAuthPresent` (commonly shortened as MFAPresent) can be used in IAM policies to require MFA for sensitive operations.
Question 6: Which type of IAM policy is embedded directly within a single IAM user, group, or role and is not reusable?
- AWS Managed Policy
- Customer Managed Policy
- Inline Policy (Correct answer)
- Resource-based Policy
Correct answer: Inline Policy
Inline policies are created and embedded directly in an IAM identity; they are deleted when that identity is deleted and cannot be attached to other identities.
AWS AWS Identity & Access Management 2
Which AWS Security Token Service feature issues temporary security credentials to users authenticated by an external identity provider?