IAM-AWS

You're trying to create a custom IAM policy to more closely manage access to components in your application stack. Which of the following syntax‐related statements is a correct description of IAM policies?

• • The Action element refers to the way IAM will react to a request.

• The * character applies an element globally—as broadly as possible.

• The Resource element refers to the third‐party identities that will be allowed to access the account.

• The Effect element refers to the anticipated resource state after a request is granted.

What happens if you delete an IAM role that is associated with a running EC2 instance?

• Any application running on the instance that is using the role will be denied access immediately.

• The application continues to use that role until the EC2 server is shut down.

• The application will have the access until the session is alive.

• The application will continue to have access.

Which of the following is the greatest risk posed by using your AWS account root user for day‐to‐day operations?

• There would be no easy way to control resource usage by project or class.

• There would be no effective limits on the effect of an action, making it more likely for unintended and unwanted consequences to result.

• Since root has full permissions over your account resources, an account compromise at the hands of hackers would be catastrophic.

• It would make it difficult to track which account user is responsible for specific actions.

One of the vendors working with your organization wants to have access to your AWS resources to perform operations. As a security architect, what would be your recommended approach?

• Create an Admin IAM account for them and provide them with credentials

• Share your Access Key with the vendor

• Build an IAM policy for your vendor

• Create an IAM role and map it to your vendor AWS Account

A developer in your team needs to access S3 bucket. As an IAM administrator, what would be your recommended approach?

• Grant permission to the developers to access IAM account

• Attach S3 Full access policy to developer IAM account

• Create a Customer managed policy for the S3 bucket. Attach the policy to IAM account

• Attach S3 Full access AWS managed policy to the Developer Group

As a IAM administrator, you have created a custom policy to give permission to access production account. After some time, you have updated the policy to add more permissions which have an unintended effect. The business has requested to roll it back. What is the best option you can use?

• The policy cannot be rolled back, you need to rewrite the policy

• Set the default version of customer managed policy to the older version

• Delete the update to the policy, this will revert the permissions

• Use an AWS-managed policy

A developer working in your team has mistakenly eliminated AWS Access Key from your QA environment, and there is no back up available for those. How do you solve this problem?

• Under IAM role, you can retrieve the lost Access Key

• Provide Access Key from another IAM account

• Redeploy the QA application, and the key will be restored

• Inactivate the older key and generate a new key which should be updated in the QA environment

In your current organization, the Accounting team and the Reporting team are using two different AWS accounts. They are using a redundant server to do similar activities in their accounts. As a Solution Architect, suggest some strategies to optimize cost sustainably.

• Reduce the size of the instances based on the utilization of resources in each account

• Create Roles for other accounts and provide access for resources in your account to effectively use the resources

• Use AWS Resource Access Manager to build up shared resources for the two AWS accounts

• Merge both the accounts into one and identify the overlapping resources

To reduce your exposure to possible attacks, you're auditing the active access keys associated with your account. Which of the following AWS CLI commands can tell you whether a specified access key is still being used?

• aws iam get‐access‐key‐used –access‐key‐id <key_ID>

• aws iam ‐‐get‐access‐key‐last‐used access‐key‐id <key_ID>

• aws iam get‐access‐key‐last‐used access‐last‐key‐id <key_ID>

• aws iam get‐access‐key‐last‐used ‐‐access‐key‐id <key_ID>

As a part of the external security audit, it has been identified that the IAM users with administrator access are using highly predictable password like "Password1234". What is you recommendation to fix this security issue?

• Reach out to the IAM user with administrative access to change to complex password

• Set up a password policy for all the IAM user

• Ask root user to change password for all IAM Admin accounts and then share password with IAM users

• Set up password rotation policy