AWS AWS Identity & Access Management 4

Question 1

Which IAM feature allows you to set the maximum permissions that identity-based policies can grant to an IAM entity?

Accepted Answer

Permission boundaries

Answer

Permission boundaries are managed policies that define the maximum permissions an IAM entity can have, regardless of what identity-based policies grant.

Question 2

An IAM role has a trust policy and a permissions policy. What does the trust policy define?

Accepted Answer

Which principals are allowed to assume the role

Answer

A trust policy defines which principals (users, roles, services, or accounts) are permitted to assume the IAM role via sts:AssumeRole.

Question 3

What is the purpose of an IAM instance profile?

Accepted Answer

To attach an IAM role to an EC2 instance so applications can obtain temporary credentials

Answer

An instance profile is a container for an IAM role that allows EC2 instances to retrieve temporary credentials via the instance metadata service.

Question 4

A developer needs temporary credentials scoped to specific S3 objects for a third-party application. Which approach is most appropriate?

Accepted Answer

Use GetFederationToken with a scoped session policy

Answer

GetFederationToken issues temporary credentials and accepts a session policy to further restrict permissions for the federated session.

Question 5

Which condition key in IAM policies allows you to restrict access based on the presence of MFA authentication?

Accepted Answer

aws:MultiFactorAuthPresent

Answer

The aws:MultiFactorAuthPresent condition key returns true when the request was authenticated using MFA, allowing you to enforce MFA for sensitive actions.

AWS Practice Test

AWS Practice Test

AWS AWS Identity & Access Management 4