AWS Quiz - IAM_S3_EC2

An organization has hosted an application on the EC2 instances. There will be multiple users connecting to the instance for setup and configuration of application. The organization is planning to implement certain security best practices. Which of the below mentioned pointers will not help the organization achieve better security arrangement?

• Apply the latest patch of OS and always keep it updated.

• Allow only IAM users to connect with the EC2 instances with their own secret access key.

• Disable the password-based login for all the users. All the users should use their own keys to connect with the instance securely.

• Create a procedure to revoke the access rights of the individual user when they are not required to connect to EC2 instance anymore for the purpose of application configuration.

An organization is planning to create a user with IAM. They are trying to understand the limitations of IAM so that they can plan accordingly. Which of the below mentioned statements is not true with respect to the limitations of IAM?

• One IAM user can be a part of a maximum of 5 groups

• Organization can create 100 groups per AWS account

• One AWS account can have a maximum of 5000 IAM users

• One AWS account can have 250 roles

A company needs to deploy services to an AWS region which they have not previously used. The company currently has an AWS identity and Access Management (IAM) role for the Amazon EC2 instances, which permits the instance to have access to Amazon DynamoDB. The company wants their EC2 instances in the new region to have the same privileges. How should the company achieve this?

• Create a new IAM role and associated policies within the new region

• Assign the existing IAM role to the Amazon EC2 instances in the new region

• Copy the IAM role and associated policies to the new region and attach it to the instances

• Create an Amazon Machine Image (AMI) of the instance and copy it to the desired region using the AMI Copy feature

Your organization is preparing for a security assessment of your use of AWS. In preparation for this assessment, which two IAM best practices should you consider implementing? Choose 2 answers

• Create individual IAM users for everyone in your organization

• Configure MFA on the root account and for privileged IAM users

• Assign IAM users and groups configured with policies granting least privilege access

• Ensure all users have been assigned and are frequently rotating a password, access ID/secret key, and X.509 certificate

An organization has created 50 IAM users. The organization has introduced a new policy which will change the access of an IAM user. How can the organization implement this effectively so that there is no need to apply the policy at the individual user level?

• Use the IAM groups and add users as per their role to different groups and apply policy to group

• The user can create a policy and apply it to multiple users in a single go with the AWS CLI

• Add each user to the IAM role as per their organization role to achieve effective policy setup

• Use the IAM role and implement access at the role level

When assessing an organization AWS use of AWS API access credentials which of the following three credentials should be evaluated? Choose 3 answers

• Key pairs

• Console passwords

• Access keys

• Signing certificates

• Security Group memberships (required for EC2 instance access)

Your organization’s security policy requires that all privileged users either use frequently rotated passwords or one-time access credentials in addition to username/password. Which two of the following options would allow an organization to enforce this policy for AWS users? Choose 2 answers

• Configure multi-factor authentication for privileged IAM users

• Create IAM users for privileged accounts

• Implement identity federation between your organization’s Identity provider leveraging the IAM Security Token Service

• Enable the IAM single-use password policy option for privileged users

An organization has 500 employees. The organization wants to set up AWS access for each department. Which of the below mentioned options is a possible solution?

• Create IAM roles based on the permission and assign users to each role

• Create IAM users and provide individual permission to each

• Create IAM groups based on the permission and assign IAM users to the groups

• It is not possible to manage more than 100 IAM users with AWS

You are getting started with AWS and your manager wants things to remain simple yet secure. He wants management of engineers to be easy, and not re-invent the wheel every time someone joins your company. What will you do?

• I'll create one IAM user and everyone will share the credentials

• I'll create multiple IAM users, and assign each user their own policy

• I'll create multiple IAM users and groups and assign policies to groups. New users will be added to groups

You have an Allow policy that grants permissions only when access is made from a specific Public IP address: 78.124.30.112

You have a Deny policy for all actions when access is not made from 85.154.120.55

What is the net effect if both these policies are attached to an IAM User and user is making a request from an EC2 instance with public IP address 85.154.120.55? There is no other policy attached to the IAM user.

• User can access all services

• User can access all services specified in Allow policy conditions

• Policy runs into default deny as there are no other matching Allows

• Policy runs into default allow as there is no other matching deny