AWS AWS Identity & Access Management 5 — Questions and Answers
Question 1: An organization uses AWS Organizations. Which policy type can be used to restrict the maximum available permissions for all accounts within an organizational unit (OU)?
- IAM permission boundaries
- Service control policies (SCPs) (Correct answer)
- Resource-based policies
- AWS Config rules
Correct answer: Service control policies (SCPs)
SCPs in AWS Organizations set guardrails on the maximum permissions available to IAM entities in member accounts, acting as organization-level permission boundaries.
Question 2: What is the effect of attaching the AWS managed policy 'ReadOnlyAccess' to an IAM role while also attaching a customer-managed policy that explicitly denies s3:GetObject?
- The role can still read S3 objects because the managed policy allows it
- The explicit deny in the customer policy overrides the allow, blocking S3 GetObject (Correct answer)
- The two policies cancel each other out and no S3 access is granted
- AWS merges both policies and the most permissive rule wins
Correct answer: The explicit deny in the customer policy overrides the allow, blocking S3 GetObject
An explicit Deny in any applicable policy always overrides any Allow, so the customer-managed policy's deny blocks S3 GetObject access regardless of ReadOnlyAccess.
Question 3: Which AWS STS API call is used by an IAM user to assume a cross-account role?
- sts:GetSessionToken
- sts:AssumeRole (Correct answer)
- sts:GetFederationToken
- sts:AssumeRoleWithSAML
Correct answer: sts:AssumeRole
sts:AssumeRole is used to obtain temporary security credentials for a role in the same or a different AWS account.
Question 4: A company wants to allow employees to sign in to AWS using their corporate Active Directory credentials without creating IAM users. Which solution should they use?
- IAM Groups with LDAP integration
- AWS IAM Identity Center (SSO) with AD Connector or AWS Managed Microsoft AD (Correct answer)
- Amazon Cognito User Pools with SAML federation
- AWS Directory Service for Simple AD only
Correct answer: AWS IAM Identity Center (SSO) with AD Connector or AWS Managed Microsoft AD
AWS IAM Identity Center integrates with AWS Managed Microsoft AD or AD Connector to provide SSO access to AWS accounts using existing corporate credentials.
Question 5: Which IAM policy condition operator would you use to match a tag value against multiple possible values using a single condition?
- StringEquals
- StringLike
- ForAnyValue:StringEquals (Correct answer)
- ArnLike
Correct answer: ForAnyValue:StringEquals
ForAnyValue:StringEquals is a set operator that returns true if any value in a multivalued request context key matches any value in the condition.
Question 6: What is the default behavior of IAM when no policy grants access to a requested action?
- Allow, to prevent disruption to existing workloads
- Deny, because IAM uses an implicit deny by default (Correct answer)
- It depends on whether the action is destructive or read-only
- Prompt the root user for approval
Correct answer: Deny, because IAM uses an implicit deny by default
IAM uses an implicit deny as its default; requests are denied unless an explicit allow exists and no explicit deny overrides it.
Question 7: A Lambda function needs read access to a specific DynamoDB table. What is the recommended way to grant this access?
- Embed IAM access keys in the Lambda function's environment variables
- Attach an IAM execution role with a policy allowing DynamoDB read actions to the Lambda function (Correct answer)
- Store credentials in AWS Secrets Manager and have Lambda retrieve them at runtime
- Use the root account credentials passed as Lambda environment variables
Correct answer: Attach an IAM execution role with a policy allowing DynamoDB read actions to the Lambda function
Assigning an IAM execution role to the Lambda function allows it to automatically receive temporary credentials with the necessary DynamoDB permissions without storing long-term credentials.
AWS AWS Identity & Access Management 5
An organization uses AWS Organizations.
Which policy type can be used to restrict the maximum available permissions for all accounts within an organizational unit (OU)?