Arch::07::IAM

What is the first action an account owner should perform with its root user of an account?

• Delete existing access keys

• Activate MFA and create an administrator user

• Delete the root user

Is it possible to override a deny statement in an IAM policy?

• No
• Yes

Is it possible to attach IAM policies to objects other than principals?

• Yes, to resources
• Yes, to devices like smartphones and PCs
• No

What is the purpose of the IAM STS?

• To generate ssh key pairs
• To generate AK/SK
• To authenticate AWS users
• To store user's credentials

What is the most strighforward way of providing a single sign on experience on AWS?

• By integrating an external Active Directory and then using AssumeRoleWithSAML
• By using AWS Identity Center service

• By running AD in your AWS account
• By activating STS

How much money costs to create an AWS account?

• $100 per month
• It is free
• $100 up-front payment
• Depends of the account type

What service provides the ability to manage related accounts?

• IAM
• Organizations
• Shared network
• Account Manager

How is possible to apply common restrictions to a set of related accounts?

• By using Service Control Policies applied to the account
• By using Service Control Policies applied to an Organization Unit
• By grouping the accounts under a Organization Unit
• By applying IAM permissions to an Organization Unit

What is considered the best practice to test if a new SCP will impact in current workloads?

• Apply the new SCP to a single account and check everything is fine
• Create a new account and use the new SCP on it
• Create a new OU, apply the new SCP to it and move an account to this temporal OU
• Apply the new SCP as an additional set of rules over the previous one

What would NOT be a valid reason to use several accounts to deploy different workloads?

• To reduce the blast radius of a security incident
• To reduce the total cost
• To facilitate cost control
• To overcome hard fixed resource limits