CLF-C02 Identity and Access Management 3

Question 1

What is the primary purpose of AWS IAM Identity Center (formerly AWS Single Sign-On)?

Accepted Answer

Centrally managing access for multiple AWS accounts and applications with SSO

Answer

Managing encryption keys across AWS services

Answer

Creating VPN connections to on-premises networks

Answer

Monitoring and logging user sign-in activity

Question 2

Which of the following is an AWS best practice for managing IAM access keys?

Accepted Answer

Rotate access keys regularly and use IAM roles where possible instead of keys

Answer

Share a single access key among all team members for convenience

Answer

Embed access keys directly in application source code

Answer

Create one master access key to be used by all applications

Question 3

What does the IAM Policy Simulator allow you to do?

Accepted Answer

Test the effects of IAM policies to see what actions they allow or deny

Answer

Automatically generate IAM policies based on usage patterns

Answer

Estimate the cost of IAM resource usage

Answer

Create temporary IAM users for testing purposes

Question 4

Which type of policy is used with AWS Organizations to set the maximum available permissions for all accounts within an organization or organizational unit?

Accepted Answer

Service Control Policy (SCP)

Answer

Identity-based policy

Answer

Resource-based policy

Answer

Permissions boundary

Question 5

What is the purpose of an IAM credential report?

Accepted Answer

To audit IAM users and the status of their credentials across the account

Answer

To generate billing statements for IAM-related costs

Answer

To automatically rotate IAM credentials on a schedule

Answer

To monitor IAM API calls in real time

Question 6

Which capability allows an IAM role in one AWS account to be assumed by a user or service in a different AWS account?

Accepted Answer

Cross-account role assumption

Answer

IAM User Federation

Answer

VPC Peering

Answer

AWS Direct Connect

Question 7

What is an IAM instance profile and what is it used for?

Accepted Answer

A container for an IAM role that can be attached to an EC2 instance to grant it AWS permissions

Answer

A file that stores the OS configuration for EC2 instances

Answer

A network configuration container that manages EC2 security groups

Answer

A log file storing authentication events from EC2 instances