AWS AWS Identity & Access Management

Question 1

Which type of IAM policy is attached directly to an AWS resource, such as an S3 bucket, rather than to an IAM identity?

Accepted Answer

Resource-based Policy

Answer

Resource-based policies are attached to resources like S3 buckets or SQS queues and define who can perform actions on that resource.

Question 2

Which AWS service provides centralized single sign-on access to multiple AWS accounts and business applications?

Accepted Answer

AWS IAM Identity Center

Answer

AWS IAM Identity Center (formerly AWS SSO) enables users to sign in once and access multiple AWS accounts and SAML-enabled applications.

Question 3

What happens when an IAM policy evaluation encounters both an explicit Allow and an explicit Deny for the same action?

Accepted Answer

Deny wins

Answer

In IAM policy evaluation, an explicit Deny always overrides any Allow, regardless of which policy contains the Deny statement.

Question 4

Which IAM feature allows an EC2 instance to make AWS API calls without embedding long-term credentials in the instance?

Accepted Answer

Instance Profile

Answer

An instance profile is a container for an IAM role that can be attached to an EC2 instance, providing temporary credentials automatically via the metadata service.

Question 5

Which IAM policy type defines the maximum permissions available to IAM entities within an AWS Organizations member account?

Accepted Answer

Service Control Policy

Answer

Service Control Policies (SCPs) are applied at the Organizations level and set the outer boundary of what member accounts can do, even for the root user.

AWS Practice Test

AWS Practice Test

AWS AWS Identity & Access Management