Font size
WorksheetsIAM Roles
Total questions: 20
Worksheet time: 8mins
A Solutions Architect is designing a shared service for hosting containers from several customers on Amazon ECS. These containers will use several AWS services. A container from one customer should not be able access data from another customer. Which of the below solutions should the architect use to meet these requirements?
IAM Roles for tasks
IAM Roles for EC2 Instances
IAM Instance profile for EC2 instances
Security Group Rules
Your organization AWS Setup has an AWS S3 bucket which stores confidential documents which can be only downloaded by users authenticated and authorized via your application. You do not want to create IAM users for each of these users and as a best practice you have decided to generate AWS STS Federated User temporary credentials each time when a download request is made and then use the credentials to generate presigned URL and redirect user for download. However, when user is trying to access the presigned URL, they are getting Access Denied Error. What could be the reason?
AWS STS service must be given access in S3 bucket ACL
IAM User used to generate Federated User credentials does not have access on S3 bucket.
IAM Role used to generate Federated User credentials does not have access on S3 bucket.
Your application must be whitelisted in AWS STS service to perform Federated User action.
Your organization has an AWS setup and planning to build Single Sign On for users to authenticate with on-premise Microsoft Active Directory Federation Services (ADFS) and let users login to AWS console using AWS STS Enterprise Identity Federation. Which of the following service you need to call from AWS STS service after you authenticate with your on-premise?
AssumeRoleWithSML
GetFederationToken
AssumeRoleWithWebIdentity
GetCallerIdentity
An EC2 Instance hosts a Java based application that accesses a DynamoDB table. This EC2 Instance is currently serving production users. Which of the following is a secure way for the EC2 Instance to access the DynamoDB table?
UseIAM Roles with permissions to interact with DynamoDB and assign it to the EC2Instance
UseKMS Keys with the right permissions to interact with DynamoDB and assign it to the EC2 Instance.
UseIAM Access Keys with the right permissions to interact with DynamoDB and assign it to the EC2 Instance.
UseIAM Access Groups with the right permissions to interact with DynamoDB and assign it to the EC2 Instance.
You work in the media industry and have created a web application where users will be able to upload photos they create to your website. This web application must be able to call the S3 API in order to be able to function. Where should you store your API credentials whilst maintaining the maximum level of security?
Save the API credentials to your PHP files.
Don’t save your API credentials. Instead create a role in IAM and assign this role to an EC2 instance when you first create it.
Save your API credentials in a public Github repository.
Pass API credentials to the instance using instance user data.
Your company is planning on hosting their development, test and production applications on EC2 Instances in AWS. They are worried about how access control would be given to relevant IT Admins for each of the above environments. As an architect, what would you suggest for managing the relevant accesses?
Add tags to the instances marking each environment and then segregate access using IAM Policies.
Add Userdata to the underlying instances to mark each environment.
Add Metadata to the underlying instances to mark each environment.
Add each environment to a separate Auto Scaling Group.
An EC2 Instance setup in AWS will host an application which will make API calls to the Simple Storage Service. What is an ideal way for the application to access the Simple Storage Service?
Pass API credentials to the instance using instance user data.
Store API credentials as an object in a separate Amazon S3 bucket.
Embed the API credentials into your application.
Create and Assign an IAM role to the EC2 Instance.
You are developing a mobile application that needs to issue temporary security credentials to users. This is essential due to security concerns. Which of the below services can help achieve this?
AWS STS
AWS Config
AWS Trusted Advisor
AWS Inspector
Your company is planning on using the API Gateway service to manage APIs for developers and users. There is a need to segregate the access rights for both developers and users. How can this be accomplished?
Use IAM permissions to control the access.
Use AWS Access keys to manage the access.
Use AWS KMS service to manage the access.
Use AWS Config Service to control the access.
Your company has a set of EC2 Instances that access data objects stored in an S3 bucket. Your IT Security department is concerned about the security of this architecture and wants you to implement the following:
1) Ensure that the EC2 Instance securely accesses the data objects stored in the S3 bucket
2) Prevent accidental deletion of objects
Which of the following would help fulfill the requirements of the IT Security department? Choose 2 answers from the options given below.
Create an IAM user and ensure the EC2 Instances use the IAM user credentials to access the data in the bucket.
Create an IAM Role and ensure the EC2 Instances use the IAM Role to access the data in the bucket.
Use S3 Cross-Region Replication to replicate the objects so that the integrity of data is maintained.
Use an S3 bucket policy that ensures that MFA Delete is set on the objects in the bucket.
Which of the following is the most secure way of giving access to AWS services to applications running on Ec2 instances?
Creating Service users
Creating service groups
Roles
Attaching policies to applications
True or False : An explicit Deny in IAM precedes over an explicit allow
TRUE
FALSE
Which of the following sections in a policy specifies the entities to whom access to a resource is granted or denied?
Statement ID
Resources
Principal
Conditions
TRUE or FALSE : By default a new user in IAM has permisiions to log in to the AWS Console.
TRUE
FLASE
Which of the following is not an IAM best practice?
Delete user accounts not in use
Attach policies to individual users
Manage permissions by adding users to groups
Enable MFA on user accounts
Wch of the following set of credentials are used to log in to AWS programmatically? (Choose two)
Username
Access Key
Password
Secret Key
Wch of the following set of credentials are used to log in to AWS programmatically? (Choose two)
Username
Access Key
Password
Secret Key
It is add two-factor authentication to your account and to individual users for extra security
MFA
username
password
Identity Federation
It represents the person or service who uses the IAM user to interreact with AWS.
users
groups
root account
roles
It is very similar to a user, in that it is an identity with permission policies that determine what the identity can and cannot do in AWS.
users
groups
root account
roles
