AWS IAM Quiz

What is the operational scope of the AWS Identity and Access Management (IAM) service?

• It is a Regional service

• It is an Availability Zone service

• It is a Global service

• It is an On-Premises service

Answer explanation

AWS IAM is a Global service, meaning it operates across all AWS regions. This allows for centralized management of user permissions and access controls, making it easier to secure resources regardless of their location.

In what text document format are AWS IAM Policy permissions written?

• HTML

• JSON

• XML

• CSV

Answer explanation

AWS IAM Policy permissions are written in JSON format, which allows for structured data representation. JSON is widely used for configuration files and APIs, making it the correct choice for defining IAM policies.

When a brand new IAM User is initially created in the console and has no custom policies attached to it, what are its baseline default permissions?

• It automatically inherits Full Administrator Access

• It has Read-Only access to all services

• It has no permissions at all (Implicit Deny)

• It has access to the billing console only

Answer explanation

When a new IAM User is created, it has no permissions by default, which means it is subject to an implicit deny. This means the correct answer is that it has no permissions at all.

Which of the following security practices requires an operator to provide a password plus an active code generated from a token or mobile application during sign-in?

• Multi-Factor Authentication (MFA)

• Access Key Rotation

• Least Privilege Access

• Credential Auditing

Answer explanation

Multi-Factor Authentication (MFA) enhances security by requiring both a password and a time-sensitive code from a token or app, ensuring that access is granted only to authorized users.

What pair of credentials must be used when configuring the AWS Command Line Interface (CLI) or an SDK tool for programmatic access?

• Console Username and Password

• Access Key ID and Secret Access Key

• Root Email and MFA Code

• SSH Key Pair and Security Group ID

Answer explanation

The correct credentials for configuring the AWS CLI or SDK for programmatic access are the Access Key ID and Secret Access Key. These keys allow secure access to AWS services without using a console username and password.

Which privileged identity should you completely avoid using for daily common operational tasks according to AWS security best practices?

• Standard IAM User

• Assumed IAM Role

• The Root User

• Group Member Identity

Answer explanation

The Root User has unrestricted access to all AWS resources and should be avoided for daily tasks to minimize security risks. Instead, use IAM users or roles with limited permissions for operational tasks.

What security practice describes granting an identity only the absolute minimum permissions strictly required to complete their assigned responsibilities?

• Continuous Compliance Auditing

• Multi-Factor Authentication Management

• Root Account Separation

• Principle of Least Privilege

Answer explanation

The Principle of Least Privilege is a security practice that ensures users are granted only the permissions necessary to perform their tasks, minimizing potential security risks.

What specific type of IAM entity is ideal for an active AWS service (such as an EC2 instance) to securely assume short-term permissions dynamically?

• IAM User Account

• IAM Role

• IAM User Group Folder

• Account Root Profile

Answer explanation

An IAM Role is ideal for an active AWS service like an EC2 instance to assume short-term permissions dynamically. Unlike IAM Users, Roles provide temporary credentials, enhancing security and flexibility for service operations.

Which IAM diagnostic tool generates an account-wide downloadable CSV spreadsheet audit tracking every user along with password age and active MFA configuration states?

• IAM Access Analyzer

• AWS Cost Explorer

• IAM Credential Report

• AWS Trusted Advisor Dashboard

Answer explanation

The IAM Credential Report is the tool that generates a downloadable CSV file containing an audit of all users, including details on password age and MFA configurations, making it the correct choice.

What centralized IAM service enables single-portal user entry for team members to navigate across dozens of corporate AWS accounts and SaaS cloud web apps uniformly?

• IAM Identity Center

• IAM Access Analyzer

• Amazon CloudWatch Gateway

• AWS Shield Security Framework

Answer explanation

IAM Identity Center provides a centralized identity management solution, allowing team members to access multiple AWS accounts and SaaS applications through a single portal, ensuring uniform navigation and streamlined access.