Answer: D. A policy is a JSON document containing statements that specify an effect, actions, resources, and optional conditions. Attaching it to a user, group, or role makes it an identity-based policy; attaching it to a resource such as an Amazon S3 bucket makes it a resource-based policy.
A. Credentials such as passwords and access keys prove who is making a request. A policy decides what that requester is allowed to do once identified.
B. IAM groups collect users for permission management, not for billing. Cost separation is achieved with accounts, tags, and AWS Organizations.
C. The record of API calls is produced by AWS CloudTrail, which is a separate service from IAM.
42
Which statement about AWS Identity and Access Management (IAM) is correct?
Easy · Choose one
Explanation
Answer: C. IAM identities and policies are account-wide and are not tied to a Region. A role or user created once can be used against service endpoints in any Region the account has access to, which is why the IAM console does not present a Region selector.
A. IAM itself is offered at no additional charge. Customers pay for the AWS resources their identities use.
B. There is nothing to enable. IAM exists as soon as the account does, and the root user is present from account creation.
D. Consumer sign-in for a company's own application is what Amazon Cognito provides. IAM governs access to AWS resources.
43
What does an IAM password policy control?
Easy · Choose one
Explanation
Answer: A. A password policy sets account-wide rules for the console passwords of IAM users in that account, covering length, required character types, whether users may change their own password, whether passwords expire, and whether previous passwords may be reused.
B. MFA is configured per identity and can be required through a policy condition. It is not part of the password policy.
C. Storing and rotating application secrets is the role of AWS Secrets Manager, not of the IAM password policy.
D. Access keys are long-term programmatic credentials with no automatic expiry. Rotating them is an operational task guided by last-used information.
44
An application running on an Amazon EC2 instance must call Amazon S3. What is the recommended way to give it access without placing long-term credentials on the instance?
Easy · Choose one
Explanation
Answer: A. An instance profile delivers temporary security credentials for the attached role to the instance, and the AWS SDKs retrieve and refresh them automatically. Nothing durable is stored on disk, so there is no key to leak in an image, a backup, or a source repository, and no rotation task.
B. Cognito identity pools issue temporary AWS credentials to the end users of a web or mobile application, not to server-side workloads running on EC2.
C. Long-term access keys on an instance are exactly the pattern roles exist to eliminate. They persist in snapshots and images and must be rotated manually.
D. Root access keys give unrestricted access to the entire account and AWS advises against creating them at all, let alone deploying them to a server.
45
Which TWO practices does AWS recommend for securing access to an AWS account? (Choose TWO.)
Easy · Select 2 answers
Explanation
Answer: D and E. Both practices attack the same weakness, which is a credential that can be stolen and reused. MFA means a captured password alone is not enough to sign in, and temporary credentials, obtained by assuming a role or through federation, expire on their own so a leaked credential has a short life.
A. Credentials in source code are among the most common causes of exposure, since they spread through repositories, forks, and build artifacts.
B. AWS advises against using the root user for routine work. Daily administration should be performed with IAM roles or IAM Identity Center users that carry only the permissions needed.
C. A shared identity destroys accountability, since the logs cannot show which person acted, and it makes removing one person's access impossible without disrupting everyone.
46
A team in AWS account B needs to read objects from an Amazon S3 bucket in AWS account A. What is the recommended way to grant this access?
Intermediate · Choose one
Explanation
Answer: B. A cross-account role is the standard pattern. The role's trust policy names account B as the principal that may assume it, and its permissions policy defines exactly what may be done in account A. The team receives temporary credentials, and access can be revoked at any time by changing the role.
A. Copying data duplicates it, adds cost and latency, and multiplies the number of places the data must be secured and governed.
C. Obscurity is not access control. Public buckets are routinely discovered and are one of the most common causes of data exposure.
D. Sharing long-term keys across an organizational boundary removes accountability and creates a credential that neither account can easily rotate or revoke cleanly.
47
What is an IAM permissions boundary?
Intermediate · Choose one
Explanation
Answer: B. A permissions boundary caps rather than grants. The identity's effective permissions are the intersection of its identity-based policies and its boundary, which lets an administrator safely delegate policy creation to a team while guaranteeing they cannot escalate beyond the cap.
A. Organization-wide guardrails are service control policies and resource control policies in AWS Organizations. A boundary is attached to one user or role.
C. The number of attachable policies is an IAM quota, unrelated to what a permissions boundary does.
D. A boundary never grants anything on its own. An action must still be allowed by an identity-based or resource-based policy.
48
A security team wants a single output listing every IAM user in an account, whether each has MFA enabled, and when each access key was last rotated and used. Which capability provides this?
Intermediate · Choose one
Explanation
Answer: C. The credential report is a downloadable CSV covering all IAM users in the account and the state of their credentials, including password status and last use, MFA status, and the rotation and last-used details of each access key. It can be generated at most once every four hours.
A. An aggregator centralizes AWS Config resource configuration and compliance data. It is not a credential inventory.
B. Amazon Inspector scans workloads for software vulnerabilities and unintended network exposure, which is unrelated to IAM credentials.
D. CloudTrail Insights detects unusual patterns in API call volume or error rates. It reports anomalies, not credential status.
49
A development team needs to store non-sensitive configuration values, such as service endpoint URLs and feature flags, and retrieve them from applications at no per-item charge. Which service is the appropriate choice?
Intermediate · Choose one
Explanation
Answer: B. Parameter Store provides hierarchical storage for configuration data and secrets, with standard parameters available at no additional charge. It suits values that change rarely and do not require automatic rotation, and it can still encrypt sensitive values as SecureString parameters using AWS KMS.
A. AWS KMS manages encryption keys. It is not a store for application configuration values.
C. Secrets Manager is priced per secret per month plus API calls. Its value is automatic rotation, which plain configuration data does not need.
D. AWS Artifact is a repository for AWS compliance reports and agreements and has no application configuration role.
50
A company uses AWS IAM Identity Center and needs to give one group of engineers the same set of permissions in five different AWS accounts. What should the company create?
Intermediate · Choose one
Explanation
Answer: D. A permission set is a reusable definition of permissions that IAM Identity Center applies by creating and maintaining an IAM role in each account where the set is assigned. One definition therefore produces consistent access across many accounts, and changing it updates every account at once.
A. A service control policy limits the maximum permissions available in accounts. It grants nothing and cannot give the engineers access.
B. Cognito user pools authenticate the end users of a customer-facing application, not a company's own workforce signing in to AWS accounts.
C. Creating separate IAM users per account reintroduces exactly the duplication and drift that IAM Identity Center exists to remove, and gives each engineer several sets of credentials.