AWS AWS Security and IAM 4 — Questions and Answers
Question 1: Which IAM policy evaluation logic applies when a resource-based policy grants access but an identity-based policy is silent on the action?
- Access is denied by default
- Access is granted because resource-based policies take precedence (Correct answer)
- Access is granted only if an explicit Allow exists in both policies
- Access is denied unless an SCP allows it
Correct answer: Access is granted because resource-based policies take precedence
When a resource-based policy grants access to an IAM principal in the same account, access is allowed even if the identity-based policy doesn't explicitly permit it.
Question 2: What is the purpose of an IAM Permission Boundary?
- It prevents root account actions from affecting IAM users
- It sets the maximum permissions an IAM entity can have regardless of attached policies (Correct answer)
- It defines which AWS services can assume a role
- It encrypts IAM policy documents at rest
Correct answer: It sets the maximum permissions an IAM entity can have regardless of attached policies
A permissions boundary is a managed policy that sets the maximum permissions an identity-based policy can grant to an IAM entity.
Question 3: An EC2 instance needs to access S3 without embedding credentials. What is the recommended approach?
- Store access keys in the instance user data
- Attach an IAM role to the EC2 instance (Correct answer)
- Use AWS SSM Parameter Store with hardcoded keys
- Create a dedicated IAM user and install keys via SSH
Correct answer: Attach an IAM role to the EC2 instance
Attaching an IAM role to an EC2 instance allows it to obtain temporary credentials automatically via the instance metadata service.
Question 4: Which AWS service provides centralized governance and policy management across multiple AWS accounts in an organization?
- AWS Config
- AWS Control Tower
- AWS Organizations with SCPs (Correct answer)
- AWS IAM Identity Center
Correct answer: AWS Organizations with SCPs
AWS Organizations with Service Control Policies (SCPs) lets you centrally control the maximum available permissions across all accounts in your organization.
Question 5: What happens when an explicit Deny exists in any policy during IAM evaluation?
- It can be overridden by a resource-based policy Allow
- It overrides all Allow statements and access is denied (Correct answer)
- It only applies to identity-based policies
- It is ignored if the user has AdministratorAccess
Correct answer: It overrides all Allow statements and access is denied
An explicit Deny in any applicable policy always overrides any Allow, regardless of the policy type or attached permissions.
Question 6: Which credential type should be used for programmatic access to AWS APIs from a long-running external application?
- IAM user access keys stored in environment variables
- IAM role with temporary credentials via STS AssumeRole (Correct answer)
- Root account access keys
- AWS Management Console password
Correct answer: IAM role with temporary credentials via STS AssumeRole
Using STS AssumeRole provides temporary, automatically-rotated credentials, which is more secure than long-term IAM user access keys.
Question 7: A company wants to allow developers to create IAM roles but prevent them from granting more permissions than they themselves have. Which IAM feature enforces this?
- IAM Access Analyzer
- Service Control Policies
- Permission Boundaries on the created roles (Correct answer)
- IAM Policy Simulator
Correct answer: Permission Boundaries on the created roles
Requiring developers to attach a permissions boundary when creating roles ensures the new roles cannot exceed the developer's own permission level.
AWS AWS Security and IAM 4
Which IAM policy evaluation logic applies when a resource-based policy grants access but an identity-based policy is silent on the action?