AWS Certified Solutions Architect IAM Policies and User Roles 2

Question 1

Which IAM policy element is evaluated FIRST when AWS determines whether to allow or deny a request?

Accepted Answer

Explicit deny in any policy

Answer

An explicit Deny in any applicable policy always overrides any Allow, making it the highest-priority evaluation result.

Question 2

A company wants to grant an EC2 instance access to S3 without embedding credentials. What is the recommended approach?

Accepted Answer

Attach an IAM role to the EC2 instance

Answer

Attaching an IAM role to an EC2 instance provides temporary credentials via the instance metadata service, eliminating the need for long-term credentials.

Question 3

What does the IAM policy condition key 'aws:RequestedRegion' allow you to do?

Accepted Answer

Restrict actions to specific AWS regions

Answer

The aws:RequestedRegion condition key lets you restrict which AWS regions a principal can make API calls to.

Question 4

Which type of IAM policy is attached directly to AWS resources such as S3 buckets and KMS keys?

Accepted Answer

Resource-based policy

Answer

Resource-based policies are JSON policy documents attached directly to a resource and specify who has access to that resource.

Question 5

An IAM user in Account A needs to access resources in Account B. What must be configured in Account B?

Accepted Answer

A cross-account IAM role with a trust policy allowing Account A

Answer

Cross-account access requires an IAM role in Account B with a trust policy that allows principals from Account A to assume it.

AWS Practice Test

AWS Practice Test

AWS Certified Solutions Architect IAM Policies and User Roles 2