CLF-C02 Security and Compliance Practice Question
A company hires 10 new developers and needs to assign them identical AWS permissions — read access to S3 and the ability to launch EC2 instances. What is the AWS best practice for assigning these permissions efficiently?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an IAM group, attach the required policies to the group, and add all 10 users to the group
IAM groups allow administrators to assign permissions to multiple users at once. By creating a 'Developers' group with the required policies and adding all 10 users to it, permissions are managed centrally. Adding a policy to the group affects all members simultaneously.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Attach an inline policy to each of the 10 IAM users individually
Why it's wrong here
Attaching an inline policy to each of the ten IAM users duplicates the same authorization rules in ten separate, embedded policy documents. Inline policies cannot be reused or managed centrally, so whenever the team's required permissions change, you must locate and update each user's policy individually, inviting drift and typographical inconsistencies. This approach is error-prone and does not scale, whereas a managed policy attached to an IAM group can be changed once and immediately apply to every user in the group.
- ✓
Create an IAM group, attach the required policies to the group, and add all 10 users to the group
Why this is correct
IAM groups are specifically designed for this purpose. Assign policies once to the group, add users to the group, and all users inherit the permissions. Future permission changes only need to be made to the group.
- ✗
Create one IAM user account and share the credentials with all 10 developers
Why it's wrong here
Sharing one IAM user's credentials among ten developers destroys the unambiguous identity audit trail that IAM is designed to provide. CloudTrail and AWS Config records would show only the shared user's ARN, so if a data deletion or misconfiguration is investigated, you cannot determine which developer was responsible. Additionally, rotating the password or re-enrolling MFA for the shared user disrupts all ten developers at once, and any leak of those credentials gives every developer—and any attacker—exactly the same full access.
- ✗
Grant the developers root account access with MFA enabled
Why it's wrong here
Granting developers the AWS account root user's credentials—even with MFA enabled—is a severe anti-pattern because the root user is not bound by IAM permissions and cannot be scoped down to a least-privilege model. Every API action any developer performs would appear in CloudTrail as the root user, so you could not tell who made a change, and revoking one developer's access would require rotating credentials for everyone. MFA is a baseline safeguard, but it does not provide per-user authorization, accountability, or a way to limit the blast radius of a compromised root session.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.