AWS AWS Identity & Access Management 4 — Questions and Answers
Question 1: Which IAM feature allows you to set the maximum permissions that identity-based policies can grant to an IAM entity?
- Permission boundaries (Correct answer)
- Service control policies
- Resource-based policies
- Session policies
Correct answer: Permission boundaries
Permission boundaries are managed policies that define the maximum permissions an IAM entity can have, regardless of what identity-based policies grant.
Question 2: An IAM role has a trust policy and a permissions policy. What does the trust policy define?
- What actions the role can perform on AWS resources
- Which principals are allowed to assume the role (Correct answer)
- The maximum session duration for the role
- Which AWS services the role can access
Correct answer: Which principals are allowed to assume the role
A trust policy defines which principals (users, roles, services, or accounts) are permitted to assume the IAM role via sts:AssumeRole.
Question 3: What is the purpose of an IAM instance profile?
- To store SSH keys for EC2 instances
- To attach an IAM role to an EC2 instance so applications can obtain temporary credentials (Correct answer)
- To define security group rules for EC2 instances
- To configure the AMI permissions for launching instances
Correct answer: To attach an IAM role to an EC2 instance so applications can obtain temporary credentials
An instance profile is a container for an IAM role that allows EC2 instances to retrieve temporary credentials via the instance metadata service.
Question 4: A developer needs temporary credentials scoped to specific S3 objects for a third-party application. Which approach is most appropriate?
- Create a new IAM user and attach an S3 policy
- Use GetFederationToken with a scoped session policy (Correct answer)
- Share the root account access keys with reduced permissions
- Create a long-term access key with an S3 bucket policy
Correct answer: Use GetFederationToken with a scoped session policy
GetFederationToken issues temporary credentials and accepts a session policy to further restrict permissions for the federated session.
Question 5: Which condition key in IAM policies allows you to restrict access based on the presence of MFA authentication?
- aws:SecureTransport
- aws:MultiFactorAuthPresent (Correct answer)
- aws:TokenIssueTime
- iam:MFAAuthenticated
Correct answer: aws:MultiFactorAuthPresent
The aws:MultiFactorAuthPresent condition key returns true when the request was authenticated using MFA, allowing you to enforce MFA for sensitive actions.
Question 6: What happens when both an identity-based policy and a resource-based policy apply to a request within the same AWS account?
- The identity-based policy always takes precedence
- The resource-based policy always takes precedence
- An explicit allow in either policy grants access (Correct answer)
- Both policies must explicitly allow the action
Correct answer: An explicit allow in either policy grants access
Within the same account, if either the identity-based or resource-based policy grants the action and neither has an explicit deny, the action is allowed.
Question 7: Which IAM policy element specifies the AWS account, IAM user, IAM role, or federated user that a policy applies to in a resource-based policy?
- Action
- Resource
- Principal (Correct answer)
- Condition
Correct answer: Principal
The Principal element in a resource-based policy specifies who is allowed or denied access to the resource to which the policy is attached.
AWS AWS Identity & Access Management 4
Which IAM feature allows you to set the maximum permissions that identity-based policies can grant to an IAM entity?