IAM practice questions

Amazon CloudWatch

Why wrong: CloudWatch collects metrics and logs from AWS services and applications. While it can capture application logs, it does not specifically record who made AWS API calls like deleting an S3 bucket.

AWS Config

Why wrong: AWS Config records the configuration state of AWS resources over time and can show that the bucket no longer exists, but it does not capture the API event details (caller identity, IP, timestamp) the way CloudTrail does.

Amazon GuardDuty

Why wrong: GuardDuty is a threat detection service that analyses CloudTrail logs among other sources to find suspicious activity. It uses CloudTrail data but is not the source of API audit records.

Create an IAM user and embed the access key in the application code

Why wrong: Hardcoding access keys in application code is a major security risk. Keys can be leaked in code repositories, and they are long-term credentials that do not rotate automatically.

Store the access key in an EC2 environment variable

Why wrong: Storing long-term access keys in environment variables on the instance still violates the requirement to avoid long-term credentials. Environment variables can be read by any process on the instance.

Use an IAM group to assign the permissions to the EC2 instance

Why wrong: IAM groups are used to manage permissions for IAM users, not EC2 instances. EC2 instances cannot be members of IAM groups.

AWS Shield

Why wrong: AWS Shield is a DDoS protection service. It protects applications from distributed denial of service attacks and has no role in multi-factor authentication for console access.

AWS WAF

Why wrong: AWS WAF is a web application firewall that protects web applications from common exploits. It operates at the HTTP layer and does not control AWS console authentication.

Amazon Cognito

Why wrong: Amazon Cognito manages user authentication for customer-facing applications. IAM console MFA is a separate feature built into IAM itself, not managed through Cognito.

Operational Excellence

Why wrong: Operational Excellence covers running and improving operations. IAM policies, encryption, and security detection are Security pillar activities.

Reliability

Why wrong: Reliability focuses on failure recovery and availability. Security controls like IAM, encryption, and network access are the Security pillar.

Cost Optimisation

Why wrong: Cost Optimisation focuses on reducing unnecessary spending. Security controls are in the Security pillar regardless of their cost.

IAM permissions boundaries

Why wrong: IAM permissions boundaries limit the maximum permissions for an IAM user or role, but they are applied per entity and can be overridden by other policies within the account. They do not provide a centralized guardrail across all member accounts in an organization.

AWS Config conformance packs

Why wrong: AWS Config conformance packs contain a collection of AWS Config rules and remediation actions. They can evaluate resources against policies and trigger remediation, but they do not actively prevent actions; they detect and potentially fix noncompliant resources after the fact.

AWS CloudTrail Insights

Why wrong: AWS CloudTrail Insights analyzes management events to detect unusual activity, such as changes to S3 bucket policies. However, it is a monitoring and logging service; it does not prevent or block API calls.

Delete the GitHub repository

Why wrong: Deleting the repository won't help since the keys may already be cached by bots that continuously scrape GitHub. The keys must be rotated.

Enable MFA for the IAM user

Why wrong: MFA protects console access, not programmatic API access via access keys. Enabling MFA does not invalidate the exposed access keys.

Move the credentials to a private repository

Why wrong: The credentials are already public. Moving the repository to private does not revoke the exposed credentials.

AWS Shield

Why wrong: AWS Shield is a managed DDoS protection service. It does not evaluate IAM user configurations or provide compliance rule evaluation and automatic remediation.

AWS CloudTrail

Why wrong: AWS CloudTrail records API activity for auditing, but it does not evaluate resource compliance or automatically trigger remediation actions. It is a logging service, not a configuration compliance service.

AWS WAF

Why wrong: AWS WAF is a web application firewall that filters HTTP/HTTPS traffic. It does not check IAM user MFA status or perform remediation on IAM resources.

Reliability

Why wrong: Reliability focuses on workload recovery from failures and meeting demand — it's about uptime and resilience, not security protection.

Operational Excellence

Why wrong: Operational Excellence focuses on running and monitoring systems to deliver business value and continually improving processes.

Performance Efficiency

Why wrong: Performance Efficiency focuses on using computing resources efficiently to meet requirements as demand changes.

AWS CloudTrail

Why wrong: AWS CloudTrail records all API activity in your account but does not automatically analyze the logs for anomalies or raise alerts for suspicious usage patterns. While you can enable CloudTrail Insights to detect unusual API activity, the question specifically asks for a managed threat detection service, which is not CloudTrail's primary function.

AWS Trusted Advisor

Why wrong: AWS Trusted Advisor inspects your AWS environment and provides best practice recommendations in categories such as cost optimization, performance, security, and fault tolerance. However, it does not continuously monitor API activity or detect compromised credentials; it performs periodic checks based on static rules.

Amazon Inspector

Why wrong: Amazon Inspector is an automated vulnerability management service that scans EC2 instances, container images, and Lambda functions for software vulnerabilities and network exposure. It does not analyze IAM user activity or API call patterns, so it cannot detect compromised credentials based on geographic anomalies.

AWS Trusted Advisor

Why wrong: AWS Trusted Advisor inspects AWS environments and provides best-practice recommendations in categories including cost, performance, security, and fault tolerance. It can check S3 bucket permissions for public access, but it does not specifically analyze policies for access granted to specific external AWS accounts, and it does not provide a continuous policy analysis dashboard for external access findings.

AWS Config

Why wrong: AWS Config evaluates the configuration of AWS resources against desired rules and tracks configuration changes. While it can be used to detect changes to S3 bucket policies, it does not natively analyze whether a policy grants access to an external AWS account. Config is more about compliance with internal rules (e.g., 'require encryption') rather than detecting external access.

AWS Service Catalog

Why wrong: AWS Service Catalog helps organizations centrally manage approved IT service catalogs and allows users to launch only pre-approved resources. It does not have any capability to analyze existing S3 bucket policies for external access. This service is used for governance and provisioning, not for post-deployment policy analysis.

Create an AWS IAM policy with a Deny effect for ec2:RunInstances where the instance type starts with 'g' or 'p' and attach it to a specific IAM role in each account.

Why wrong: This approach is not centralized and requires manual IAM policy configuration in every account. It can also be bypassed if users assume roles that do not have the policy attached. SCPs provide a single, enforceable boundary across all accounts.

Use an AWS Config managed rule to detect GPU instance launches and trigger an auto-remediation action that terminates the instances.

Why wrong: AWS Config is a detective control and can only react after the instance is already launched. Auto-remediation can terminate it, but this may incur costs for the brief period the instance runs and wastes resources. The requirement is for a proactive, preventive policy.

Use AWS Trusted Advisor cost optimization checks to identify GPU instances and then manually disable them in each account.

Why wrong: Trusted Advisor provides recommendations and cost-saving suggestions, but it cannot enforce policies or block resource creation. It is an advisory tool, not a preventive control mechanism.

AWS IAM policies

Why wrong: IAM policies govern access within a single account — they can't enforce policies across multiple accounts in an organization.

AWS Config rules

Why wrong: Config rules detect non-compliant resources but don't proactively prevent actions from being taken.

Amazon GuardDuty

Why wrong: GuardDuty detects threats — it doesn't enforce or restrict what actions accounts can perform.

AWS Cost Explorer with a cost allocation tag filter

Why wrong: AWS Cost Explorer helps visualize and analyze costs, but it cannot automatically stop instances when a cost threshold is exceeded. It is a reporting and analytics tool, not an action-taking service.

AWS Trusted Advisor with the cost optimization check

Why wrong: AWS Trusted Advisor provides recommendations to optimize costs, such as identifying idle instances, but it does not automatically take actions like stopping instances when a cost limit is exceeded. It is a guidance tool, not an enforcement tool.

Amazon CloudWatch with a billing metric alarm

Why wrong: Amazon CloudWatch can monitor billing metrics (e.g., estimated charges) and trigger an alarm, but the alarm cannot directly stop EC2 instances. It can send notifications via SNS, but automated stopping would require additional custom integration (e.g., Lambda), which is not the native feature described.

AWS Config rules with auto-remediation

Why wrong: AWS Config rules are used to evaluate resource configurations for compliance, and auto-remediation can trigger actions to fix noncompliant resources. However, they do not prevent the creation of publicly accessible S3 buckets in real time; they react after the resource is created. Additionally, account administrators could disable or modify the rules. This does not meet the requirement for a policy that cannot be overridden.

AWS Identity and Access Management (IAM) policies with a Deny effect

Why wrong: IAM policies can deny actions, but they are attached to individual IAM users, groups, or roles within a single AWS account. Account administrators have full control over IAM policies in their own account and could create policies that override these denials. This approach does not provide centralized, unchangeable enforcement across all accounts in the organization.

Amazon Macie with automated response

Why wrong: Amazon Macie is a fully managed data security and data privacy service that uses machine learning to discover, monitor, and protect sensitive data in AWS. It can alert on publicly accessible S3 buckets, but it does not have the ability to prevent the creation of such buckets. It is a detection tool, not an enforcement mechanism, and it does not provide a policy that account administrators cannot override.

AWS Identity and Access Management (IAM) policies

Why wrong: IAM policies are attached to IAM users, groups, or roles within a single account. They cannot enforce restrictions across multiple accounts or prevent the root user from creating IAM users. They also do not apply automatically to new accounts added to the organization.

AWS Config managed rules with automatic remediation

Why wrong: AWS Config rules can detect when an IAM user is created (non-compliant) and trigger automatic remediation actions, but they cannot prevent the creation in the first place. This is a detective and reactive solution, not a preventive one, and it requires per-account configuration.

IAM Access Analyzer

Why wrong: IAM Access Analyzer is used to analyze resource-based policies (e.g., S3 bucket policies, IAM roles) to identify resources shared with external principals. It does not have the ability to enforce restrictions on the creation of IAM users.

Server-side encryption with customer-provided keys (SSE-C)

Why wrong: SSE-C requires the customer to supply and manage the encryption keys. The customer must provide the key with each request, and AWS does not manage key rotation. This does not meet the automatic rotation requirement.

Client-side encryption using the AWS Encryption SDK

Why wrong: Client-side encryption requires the application to encrypt data before uploading it to S3. The customer is responsible for key management and rotation; AWS does not perform automatic rotation. This adds complexity and does not meet the automatic rotation requirement.

Server-side encryption with Amazon S3 managed keys (SSE-S3)

Why wrong: SSE-S3 uses managed keys that are automatically rotated by AWS, but it does not allow the customer to control access to the keys with IAM policies. The company cannot restrict decryption to specific users or roles, which violates the access control requirement.

Rapid elasticity

Why wrong: Rapid elasticity refers to the ability to quickly scale resources up or down based on demand. It does not address how data is isolated on shared hardware.

On-demand self-service

Why wrong: On-demand self-service allows customers to provision and manage resources without requiring human interaction with the provider. It does not explain how data isolation is maintained on shared hardware.

Measured service

Why wrong: Measured service means that cloud resource usage is metered and billed on a pay-per-use basis. While this characteristic relies on resource pooling, it does not itself describe the isolation mechanism.

Amazon Cognito

Why wrong: Cognito is for authenticating app end-users — it's not designed for workforce/employee SSO to AWS management services.

AWS Directory Service AD Connector

Why wrong: AD Connector is a proxy that redirects directory requests to on-premises AD — it's a component used with IAM Identity Center, not the SSO solution itself.

AWS IAM roles

Why wrong: IAM roles with SAML federation can enable AD integration but require complex manual configuration — IAM Identity Center provides a much simpler managed SSO solution.

Hardcode the IAM user access keys in the application code

Why wrong: Hardcoded credentials are a critical security vulnerability — they can be exposed through code repositories, logs, or instance access, and are difficult to rotate.

Store IAM access keys in environment variables on the EC2 instance

Why wrong: Environment variables on EC2 are accessible to all processes on the instance and can be exposed through process listings or application vulnerabilities.

Create an IAM user and configure the instance with its credentials

Why wrong: IAM user credentials stored on instances are long-term and require manual rotation — IAM roles are the secure, AWS-recommended alternative.

Patching the Lambda execution environment and runtime

Why wrong: AWS manages the Lambda execution environment, including runtime updates and security patches — this is AWS's responsibility for serverless services.

Managing the underlying servers that run Lambda functions

Why wrong: AWS manages all underlying infrastructure for Lambda — customers have no access to the servers running their functions.

Ensuring Lambda scales automatically during traffic spikes

Why wrong: Lambda's automatic scaling is an AWS-managed capability — customers don't configure or manage scaling infrastructure for Lambda.