CLF-C02 Identity and Access Management 2 — Questions and Answers
Question 1: Which type of IAM policy is attached directly to IAM users, groups, or roles?
- Resource-based policy
- Identity-based policy (Correct answer)
- Service control policy
- Permissions boundary
Correct answer: Identity-based policy
Identity-based policies are attached to IAM identities (users, groups, or roles) and define what actions those identities are permitted to perform.
Question 2: What are IAM access keys used for?
- Encrypting data stored in Amazon S3
- Logging into the AWS Management Console
- Programmatic access to AWS services via CLI or SDK (Correct answer)
- Enabling MFA for IAM users
Correct answer: Programmatic access to AWS services via CLI or SDK
IAM access keys (consisting of an access key ID and secret access key) are used for programmatic access to AWS through the CLI, SDK, or direct API calls.
Question 3: Which IAM feature acts as a guardrail by setting the maximum permissions an IAM entity can ever receive?
- IAM Policy
- IAM Role
- Permissions Boundary (Correct answer)
- Service Control Policy
Correct answer: Permissions Boundary
Permissions boundaries define the maximum permissions an IAM entity can be granted, even if attached policies would otherwise allow more.
Question 4: Which statement about IAM groups is accurate?
- Groups can be nested inside other groups
- A single IAM user can belong to multiple groups (Correct answer)
- Groups can directly assume IAM roles
- Groups have their own access keys for API calls
Correct answer: A single IAM user can belong to multiple groups
An IAM user can be a member of multiple groups simultaneously, inheriting the combined permissions from all groups they belong to.
Question 5: When an IAM policy contains both an explicit Allow and an explicit Deny for the same action, what is the result?
- Allow takes precedence
- Deny takes precedence (Correct answer)
- The most recently applied policy wins
- The user is prompted to resolve the conflict
Correct answer: Deny takes precedence
In IAM, an explicit Deny always overrides any Allow, ensuring that denied permissions cannot be inadvertently granted by another policy.
Question 6: Which AWS service generates temporary security credentials for federated users or applications assuming IAM roles?
- IAM Users
- IAM Groups
- AWS Security Token Service (STS) (Correct answer)
- AWS Secrets Manager
Correct answer: AWS Security Token Service (STS)
AWS STS (Security Token Service) issues temporary security credentials that are used when entities assume IAM roles or when users authenticate through external identity providers.
Question 7: What is the default maximum number of IAM users allowed per AWS account?
- 100
- 500
- 5,000 (Correct answer)
- Unlimited
Correct answer: 5,000
AWS allows up to 5,000 IAM users per account by default, and this soft limit can be increased by submitting a service quota request.
CLF-C02 Identity and Access Management 2
Which type of IAM policy is attached directly to IAM users, groups, or roles?