CLF-C02 Identity and Access Management 1 — Questions and Answers
Question 1: What is the primary purpose of AWS Identity and Access Management (IAM)?
- To control who can access AWS services and what actions they can perform (Correct answer)
- To monitor AWS infrastructure performance
- To manage encryption keys for AWS services
- To configure network security groups
Correct answer: To control who can access AWS services and what actions they can perform
IAM is used to manage authentication and authorization, controlling which users and services can access AWS resources and what actions they can take.
Question 2: Which IAM entity should be used to grant permissions to an AWS service such as EC2 to access S3?
- IAM User
- IAM Group
- IAM Role (Correct answer)
- IAM Policy
Correct answer: IAM Role
IAM Roles are designed to grant permissions to AWS services so they can interact with other AWS services without requiring long-term credentials.
Question 3: What is the AWS best practice recommendation for the root account?
- Use it for all daily administrative tasks
- Share it with trusted administrators only
- Enable MFA and avoid using it for everyday tasks (Correct answer)
- Delete it after creating IAM users
Correct answer: Enable MFA and avoid using it for everyday tasks
AWS recommends enabling MFA on the root account and reserving its use only for tasks that specifically require root-level access.
Question 4: What is an IAM policy?
- A JSON document that defines allowed or denied actions on AWS resources (Correct answer)
- A list of all IAM users in an AWS account
- A billing configuration that enforces spending limits
- A network rule that restricts IP-based access
Correct answer: A JSON document that defines allowed or denied actions on AWS resources
IAM policies are JSON documents specifying which actions are allowed or denied on which AWS resources, and they are attached to IAM identities or resources.
Question 5: Which of the following is NOT a valid IAM identity type?
- User
- Group
- Role
- Permission (Correct answer)
Correct answer: Permission
IAM identity types are Users, Groups, and Roles; Permission is not an identity but rather something granted to identities through policies.
Question 6: What does the principle of least privilege mean in the context of AWS IAM?
- Granting only the minimum permissions necessary to perform a required task (Correct answer)
- Providing all users with administrative access by default
- Restricting users to the least expensive AWS services
- Minimizing the total number of IAM users in an account
Correct answer: Granting only the minimum permissions necessary to perform a required task
The principle of least privilege means assigning only the permissions users need to do their jobs, reducing the attack surface and potential for misuse.
Question 7: Which AWS feature requires users to provide a second form of authentication in addition to a password?
- AWS Shield
- AWS WAF
- Multi-Factor Authentication (MFA) (Correct answer)
- Amazon GuardDuty
Correct answer: Multi-Factor Authentication (MFA)
MFA adds an extra layer of security by requiring a second authentication factor (such as a one-time code) beyond the username and password.
CLF-C02 Identity and Access Management 1
What is the primary purpose of AWS Identity and Access Management (IAM)?