AWS AWS Identity & Access Management 5

Question 1

An organization uses AWS Organizations. Which policy type can be used to restrict the maximum available permissions for all accounts within an organizational unit (OU)?

Accepted Answer

Service control policies (SCPs)

Answer

SCPs in AWS Organizations set guardrails on the maximum permissions available to IAM entities in member accounts, acting as organization-level permission boundaries.

Question 2

What is the effect of attaching the AWS managed policy 'ReadOnlyAccess' to an IAM role while also attaching a customer-managed policy that explicitly denies s3:GetObject?

Accepted Answer

The explicit deny in the customer policy overrides the allow, blocking S3 GetObject

Answer

An explicit Deny in any applicable policy always overrides any Allow, so the customer-managed policy's deny blocks S3 GetObject access regardless of ReadOnlyAccess.

Question 3

Which AWS STS API call is used by an IAM user to assume a cross-account role?

Accepted Answer

sts:AssumeRole

Answer

sts:AssumeRole is used to obtain temporary security credentials for a role in the same or a different AWS account.

Question 4

A company wants to allow employees to sign in to AWS using their corporate Active Directory credentials without creating IAM users. Which solution should they use?

Accepted Answer

AWS IAM Identity Center (SSO) with AD Connector or AWS Managed Microsoft AD

Answer

AWS IAM Identity Center integrates with AWS Managed Microsoft AD or AD Connector to provide SSO access to AWS accounts using existing corporate credentials.

Question 5

Which IAM policy condition operator would you use to match a tag value against multiple possible values using a single condition?

Accepted Answer

ForAnyValue:StringEquals

Answer

ForAnyValue:StringEquals is a set operator that returns true if any value in a multivalued request context key matches any value in the condition.

AWS Practice Test

AWS Practice Test

AWS AWS Identity & Access Management 5