AWS AWS Identity & Access Management 1 — Questions and Answers
Question 1: Which type of IAM policy is attached directly to an AWS resource, such as an S3 bucket, rather than to an IAM identity?
- Managed Policy
- Inline Policy
- Resource-based Policy (Correct answer)
- Permission Boundary
Correct answer: Resource-based Policy
Resource-based policies are attached to resources like S3 buckets or SQS queues and define who can perform actions on that resource.
Question 2: Which AWS service provides centralized single sign-on access to multiple AWS accounts and business applications?
- AWS IAM
- AWS IAM Identity Center (Correct answer)
- Amazon Cognito
- AWS Directory Service
Correct answer: AWS IAM Identity Center
AWS IAM Identity Center (formerly AWS SSO) enables users to sign in once and access multiple AWS accounts and SAML-enabled applications.
Question 3: What happens when an IAM policy evaluation encounters both an explicit Allow and an explicit Deny for the same action?
- Allow wins
- Deny wins (Correct answer)
- The most recent policy wins
- An error is returned
Correct answer: Deny wins
In IAM policy evaluation, an explicit Deny always overrides any Allow, regardless of which policy contains the Deny statement.
Question 4: Which IAM feature allows an EC2 instance to make AWS API calls without embedding long-term credentials in the instance?
- IAM User access keys
- Instance Profile (Correct answer)
- Service Control Policy
- Permission Boundary
Correct answer: Instance Profile
An instance profile is a container for an IAM role that can be attached to an EC2 instance, providing temporary credentials automatically via the metadata service.
Question 5: Which IAM policy type defines the maximum permissions available to IAM entities within an AWS Organizations member account?
- Permission Boundary
- Service Control Policy (Correct answer)
- Resource-based Policy
- Session Policy
Correct answer: Service Control Policy
Service Control Policies (SCPs) are applied at the Organizations level and set the outer boundary of what member accounts can do, even for the root user.
Question 6: What IAM feature restricts the maximum permissions an IAM entity can grant, even if more permissive policies are attached?
- Service Control Policy
- Permission Boundary (Correct answer)
- Inline Policy
- Trust Policy
Correct answer: Permission Boundary
A permissions boundary is an advanced IAM feature that sets the maximum permissions an identity-based policy can grant to an IAM entity.
AWS AWS Identity & Access Management 1
Which type of IAM policy is attached directly to an AWS resource, such as an S3 bucket, rather than to an IAM identity?