An IAM user belongs to a group whose policy allows s3:DeleteObject. A separate policy attached directly to that user explicitly denies s3:DeleteObject. What happens when the user tries to delete an object?
Intermediate · Choose one
Explanation
Answer: C. IAM evaluates all applicable policies together and applies a fixed order of precedence: an explicit deny always wins, otherwise an explicit allow is required, and anything not explicitly allowed is denied by default. An explicit deny in an identity-based policy, a service control policy, or a resource control policy overrides an allow from any source.
A. There is no precedence between group-attached and user-attached policies. IAM combines every policy that applies to the principal and then applies the deny-over-allow rule.
B. A single explicit deny anywhere is sufficient. A bucket policy could add its own deny, but the identity-based deny already settles the outcome.
D. Policies are not ranked by when they were attached. AWS evaluates every policy that applies to the request, and the enforcement logic looks first for an explicit deny in any of them; if one applies, the final decision is deny.
62
A company wants its employees to sign in with their existing Microsoft Entra ID credentials and then access several AWS accounts within its AWS Organizations structure. Which service should the company use?
Intermediate · Choose one
Explanation
Answer: D. AWS IAM Identity Center connects workforce users to AWS accounts and AWS managed applications. Deployed as an organization instance in the AWS Organizations management account, it becomes the single point for managing user access across accounts, and it federates with an external identity provider such as Microsoft Entra ID or Okta through SAML 2.0, so the company federates once rather than per account.
A. AWS Resource Access Manager shares resources such as subnets and Transit Gateways between accounts. It does not authenticate people.
B. AD Connector is a directory proxy that redirects requests to an existing on-premises Microsoft Active Directory. It can serve as an identity source for on-premises AD, but it does not federate a cloud identity provider such as Microsoft Entra ID and it does not manage access across multiple AWS accounts.
C. Amazon Cognito is an identity platform for a company's web and mobile application end users, not for its own employees signing in to AWS accounts.
63
A startup is building a mobile application and needs sign-up, sign-in, and social identity provider support for the consumers who use the app. Which AWS service is designed for this requirement?
Intermediate · Choose one
Explanation
Answer: C. Amazon Cognito is an identity platform for web and mobile apps, acting as a user directory, an authentication server, and an authorization service. A user pool handles sign-up and sign-in for the app's own users, including federation with social providers, while an identity pool can exchange those tokens for temporary AWS credentials when the app must call AWS services directly.
A. IAM Identity Center manages workforce access, meaning a company's own employees reaching AWS accounts and AWS managed applications. It is not intended as the sign-in system for a consumer application.
B. AWS Directory Service provides Microsoft Active Directory capabilities for enterprise workloads and directory-aware applications, not consumer app sign-in.
D. IAM controls access by principals to AWS resources. Creating an IAM user for every consumer of a mobile app does not scale and is not the intended use of the service.
64
An application connects to an Amazon RDS database, and the security team requires that the database credentials be rotated automatically on a schedule without the team writing and maintaining custom rotation code. Which service meets this requirement?
Intermediate · Choose one
Explanation
Answer: A. AWS Secrets Manager stores secrets encrypted with AWS KMS and provides built-in automatic rotation on a configurable schedule. For Amazon RDS, Aurora, DocumentDB, and Redshift it offers managed rotation, so the credential is rotated without the customer supplying a rotation function.
B. AWS KMS creates and manages the encryption keys that protect a secret. It does not store the database credential or rotate it.
C. IAM access keys authenticate a principal to AWS APIs. They are not the database engine's own username and password, and they carry no automatic rotation.
D. Parameter Store securely stores configuration data and secrets as SecureString parameters, but it has no built-in rotation. The AWS documentation itself points to Secrets Manager for database credentials because of that difference.
65
Which TWO tasks require the account root user credentials in a standalone AWS account that is not part of an organization? (Choose TWO.)
Hard · Select 2 answers
Explanation
Answer: A and C. AWS publishes a short list of tasks that only the root user can perform. Closing the account is on it, and for a standalone account so is changing the root user email address, root password, or root access keys. The common thread is that these actions concern the account itself rather than resources inside it.
B. Enabling CloudTrail or creating a trail in another Region requires CloudTrail permissions, which can be granted to an IAM identity like any other service permission.
D. Creating IAM roles is a standard administrative action available to any principal holding the relevant IAM permissions, and it should not be performed as the root user.
E. This is a frequently repeated but outdated answer. AWS documentation now states that changing the support plan requires IAM permissions, and the task no longer appears on the list of root-only actions.