Courseiva

CCNA Identity and Access Management Questions

21 questions · Identity and Access Management · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
Multi-Selecthard

A large enterprise wants to implement SAML 2.0-based federation to allow employees to access the AWS Management Console using their existing corporate credentials. Which TWO steps are required to establish this trust relationship and enable user access?

Select 2 answers
A.Create an IAM SAML identity provider in the AWS account using the metadata document provided by the corporate IdP.
B.Configure the corporate IdP to send SAML assertions that include the 'Role' and 'RoleSessionName' attributes.
C.Install the AWS CLI on each employee's local machine and configure it with their corporate username and password.
D.Enable Multi-Factor Authentication (MFA) on the AWS root user to allow SAML assertions to be processed securely.
E.Create individual IAM users for every employee and map them to their corresponding corporate identities using tags.
AnswersA, B

The IAM SAML identity provider is a resource that tells AWS about your external IdP. By uploading the XML metadata document from your IdP, AWS can verify the digital signatures on SAML assertions sent by your organization. This is the foundational step for establishing the cryptographic trust between both parties.

Why this answer

Establishing SAML federation requires a mutual trust between the Identity Provider (IdP) and AWS. This involves exchanging metadata and mapping SAML attributes to AWS IAM roles. These steps ensure that AWS can verify the identity of the incoming user and assign them the correct permissions based on their corporate group membership.

Practice this question →
2
Multi-Selecthard

Which THREE actions are best practices for managing root user account security? (Select THREE)

Select 3 answers
A.Enable multi-factor authentication (MFA) on the root account.
B.Store the root access keys in a secure, encrypted S3 bucket.
C.Use the root account for daily administrative tasks to simplify management.
D.Delete the root access keys and do not create new ones.
E.Set up a strong password and rotate it at least once every 90 days.
AnswersA, D, E

MFA is the most critical defense against compromised root credentials. Without MFA, a leaked password grants full control over the AWS account. Requiring a hardware or virtual MFA device adds a necessary layer of protection, ensuring that even if the password is stolen, the attacker cannot access the account.

Why this answer

The root user has unrestricted access to all resources. Therefore, it must be protected with the highest level of security. Enabling MFA, deleting access keys, and avoiding day-to-day tasks are essential.

These actions minimize the risk of a full account takeover. By following these, you ensure that the root account is reserved for critical tasks like closing the account or managing specific billing configurations that cannot be delegated through IAM.

Practice this question →
3
Multi-Selecteasy

A security engineer is using Service Control Policies (SCPs) to manage permissions across an AWS Organization. Which TWO statements accurately describe the behavior and limitations of SCPs?

Select 2 answers
A.SCPs can grant permissions to an IAM user that hasn't been given access by an identity-based policy.
B.SCPs affect all users and roles in the member account, including the account's root user.
C.SCPs are applied to the management account of the organization to restrict its own administrator activities.
D.An explicit Deny in an SCP overrides any Allow in an IAM policy within the member account.
E.SCPs are used to manage resource-level permissions for cross-account access between different organizations.
AnswersB, D

Unlike identity-based policies which do not apply to the root user, SCPs explicitly restrict the root user of a member account. This makes them an extremely powerful tool for enforcing organizational security standards and preventing even administrative users from performing prohibited actions.

Why this answer

SCPs are a key component of AWS Organizations for implementing guardrails across multiple accounts. They do not grant permissions but define the maximum available permissions for IAM users and roles within the targeted accounts. Understanding how SCPs interact with identity-based and resource-based policies is essential for maintaining a secure and compliant multi-account environment.

Practice this question →
4
Multi-Selecthard

A security engineer is troubleshooting an IAM policy evaluation issue where an explicit deny statement inside a permissions boundary is failing to restrict permissions as expected for a developer role. Which TWO factors must the engineer verify during the evaluation process?

Select 2 answers
A.Verify whether the attached identity-based policy contains an explicit deny that overrides the permissions boundary constraints.
B.Confirm that the evaluated request is not using AWS account root user credentials, as permissions boundaries do not apply to the root user.
C.Check if an active service control policy in the organization enables permissions boundaries to be bypassed for trusted administrative roles.
D.Ensure that the principal is not performing an action that is exempted from permissions boundaries, such as setting up specific IAM policies.
E.Verify that the request is not originating from a trusted service making service-linked role calls that inherently bypass permissions boundaries.
AnswersB, E

Permissions boundaries can be applied to IAM users and roles, but they cannot restrict the AWS account root user. If testing is inadvertently performed using root credentials, permissions boundaries and their contained denies will be completely ignored.

Why this answer

Understanding IAM evaluation logic is critical for debugging complex access control models. Permissions boundaries limit the maximum permissions an IAM entity can have, but they do not grant permissions on their own. Explicit denies anywhere in the evaluation chain will always take precedence over allows.

Practice this question →
5
MCQmedium

Refer to the exhibit. An IAM user with the 'Finance' tag is trying to upload an object to the 'production-data' bucket. The upload is failing. What is the most likely cause?

A.The user is missing the required S3 permission in their IAM policy.
B.The user does not have the 'Department' tag attached to their IAM principal.
C.The S3 bucket policy is not allowing the action.
D.The S3 bucket is in a different AWS region.
AnswerB

The Condition uses StringNotEquals. If the tag is missing, the condition evaluates to true for the Deny, because 'null' is not equal to 'Finance'. Therefore, the Deny policy takes effect. ABAC implementations often fail when principals lack the necessary tags required by the policy logic, resulting in unexpected access denial.

Why this answer

The policy uses a Deny effect with a StringNotEquals condition. If the principal tag 'Department' is anything other than 'Finance', the action is denied. However, if the user's tag is missing or the principal does not have the expected tag during the request, the condition evaluates to true, triggering the Deny.

This exhibit highlights how attribute-based access control (ABAC) relies heavily on accurate, consistent tagging across all principal entities.

Practice this question →
6
Multi-Selectmedium

A company is setting up SAML 2.0 federation to allow employees to log into the AWS Management Console using their corporate credentials. Which TWO components are required to establish this trust relationship in AWS?

Select 2 answers
A.An IAM User with programmatic access keys for the Identity Provider.
B.A CloudFront distribution to cache the SAML assertion responses.
C.An IAM SAML Identity Provider entity created in the AWS account.
D.An Amazon Cognito User Pool to store the federated user profiles.
E.An IAM Role with a trust policy that allows the 'sts:AssumeRoleWithSAML' action.
AnswersC, E

You must create a SAML Identity Provider entity in IAM to establish the trust between your AWS account and your external IdP. This entity is configured by uploading the SAML metadata document provided by your IdP, which contains the public keys and endpoints needed for secure communication.

Why this answer

SAML 2.0 federation allows users to use their existing corporate credentials to access the AWS Management Console. This centralizes identity management and reduces the need for multiple sets of credentials. Configuring the trust relationship involves exchanging metadata between the Identity Provider and AWS, ensuring that the assertion contains the necessary attributes for role mapping and session management.

Practice this question →
7
Multi-Selecthard

A developer in Account A needs to use an AWS KMS customer managed key (CMK) located in Account B to encrypt data. Which TWO configuration steps are necessary to allow this cross-account access?

Select 2 answers
A.The KMS key policy in Account B must grant the developer's IAM ARN in Account A permission to use the key.
B.The developer's IAM policy in Account A must grant permission to use the KMS key ARN from Account B.
C.The developer must assume a role in Account B that has permissions to the KMS key.
D.The KMS key in Account B must be converted to a multi-Region key to be accessible from Account A.
E.An IAM Peering Connection must be established between Account A and Account B.
AnswersA, B

KMS key policies are the primary way to control access to keys. For cross-account access, the policy in the account that owns the key (Account B) must specifically list the external IAM principal from Account A and grant it the necessary actions like 'kms:Encrypt' or 'kms:GenerateDataKey'.

Why this answer

Accessing a KMS key in a different account requires coordination between the IAM policy in the calling account and the key policy in the owning account. KMS is unique because the key policy must explicitly allow the use of the key even if an IAM policy provides permission. This double-check mechanism ensures that key owners maintain strict control over who can decrypt data.

Practice this question →
8
MCQmedium

A company uses AWS Organizations with all features enabled. A security engineer has applied a Service Control Policy (SCP) at the Organizational Unit (OU) level that explicitly denies the 'iam:CreateUser' action. However, a specific IAM user in a member account within that OU has an administrator policy attached. What is the resulting behavior when this user attempts to create a new IAM user?

A.The user will successfully create the new IAM user because the administrator policy provides full access that overrides the SCP.
B.The request will fail because the SCP acts as a filter that restricts the maximum permissions available to any identity in the account.
C.The request will succeed only if the user uses the AWS Management Console, but it will fail if they use the AWS CLI or SDK.
D.The request will be sent to the master account for approval before the new IAM user is created in the member account.
AnswerB

Service Control Policies establish the permission boundaries for the entire account. Even if a user has an 'Allow' in their identity-based policy, the lack of an 'Allow' in the SCP or an 'Explicit Deny' in the SCP will result in the action being blocked during the evaluation.

Why this answer

In AWS IAM evaluation logic, an explicit deny always overrides any allow, regardless of where the deny is defined. Since SCPs act as a guardrail for the entire account, any action denied at the SCP level cannot be performed by any principal within that account, including those with full administrator privileges.

Practice this question →
9
MCQeasy

A company is using AWS IAM Identity Center (successor to AWS Single Sign-On) to manage access to their AWS accounts. They want to automate the process of adding and removing users based on their status in an external identity provider. Which protocol should they use?

A.SAML 2.0 (Security Assertion Markup Language)
B.LDAP (Lightweight Directory Access Protocol)
C.OpenID Connect (OIDC)
D.SCIM (System for Cross-domain Identity Management)
AnswerD

SCIM is an open standard protocol specifically designed to automate the exchange of user identity information between identity domains or IT systems. AWS IAM Identity Center supports SCIM to allow external identity providers like Okta or Azure AD to automatically provision and deprovision users and groups.

Why this answer

AWS IAM Identity Center is the recommended service for managing single sign-on access to AWS accounts and business applications. It provides a centralized place to manage user identities and their access levels. For organizations with existing directories like Active Directory, Identity Center simplifies the process of provisioning users and mapping them to specific permission sets across the entire AWS Organization.

Practice this question →
10
MCQhard

A security engineer needs to prevent IAM users from disabling CloudTrail. Which policy element is most appropriate?

A.Create an IAM policy that denies 'cloudtrail:StopLogging' to all users.
B.Use an SCP to explicitly deny 'cloudtrail:StopLogging' for the organization.
C.Enable MFA Delete on all CloudTrail S3 buckets.
D.Restrict access to the CloudTrail console via IAM groups.
AnswerB

SCPs are the perfect tool for organizational-wide guardrails. By applying a 'Deny' on 'cloudtrail:StopLogging' at the organization level, you ensure that no user or role, including administrative roles, can disable CloudTrail. This provides a central, immutable security control that meets stringent regulatory requirements for consistent logging across the entire enterprise.

Why this answer

Using an explicit 'Deny' on the 'cloudtrail:StopLogging' action in a Service Control Policy (SCP) or a Permission Boundary is the most effective way to prevent even administrators from disabling logging. By applying this as a guardrail, you ensure that audit integrity is maintained regardless of individual user privileges. This is crucial for compliance, as it creates an immutable audit trail that security teams can rely on during incident investigations.

Practice this question →
11
MCQmedium

An auditor needs to verify which IAM policies are attached to a specific user. Which command provides this information?

A.aws iam list-user-policies --user-name <username>
B.aws iam list-attached-user-policies --user-name <username>
C.aws iam get-user-policy --user-name <username>
D.aws iam describe-user --user-name <username>
AnswerB

This is the correct CLI command to list all managed policies attached to an IAM user. Managed policies are the most common way to grant permissions, so listing them is the first step in assessing a user's permission set. This command provides a clear, concise list for audit reporting.

Why this answer

The AWS CLI is the primary tool for querying IAM metadata. The 'list-attached-user-policies' command specifically returns a list of all managed policies attached to the specified user. This is critical for security audits, where verifying the effective permissions of a principal is essential to ensure they match the requirements of their role and that no excessive privileges have been granted accidentally over time.

Practice this question →
12
Multi-Selecthard

A company is building a mobile application that requires users to authenticate before accessing private data stored in Amazon S3 and Amazon DynamoDB. Which THREE components or features of Amazon Cognito should be used to implement this securely?

Select 3 answers
A.Cognito User Pools to provide a sign-in and sign-up directory for the application users.
B.Cognito Identity Pools to exchange authentication tokens for temporary AWS credentials.
C.IAM roles with trust policies that allow the Cognito Identity Pool service principal to assume them.
D.Cognito Sync to store all user files directly from the mobile device to the cloud.
E.AWS Secrets Manager to store the Cognito User Pool Client Secret on the mobile device.
AnswersA, B, C

User Pools act as your identity provider, managing the user directory, authentication, and security features like MFA and password policies. They issue JSON Web Tokens (JWTs) upon successful login, which are then used by the application to prove the user's identity to other services or backends.

Why this answer

Amazon Cognito provides a robust framework for mobile and web authentication. User Pools handle the management of user identities (sign-up/sign-in), while Identity Pools (Federated Identities) provide the mechanism to exchange those identities for temporary AWS credentials. Together with IAM roles, they ensure secure, scoped access to AWS resources.

Practice this question →
13
MCQeasy

A company wants to identify any S3 buckets or IAM roles in their AWS account that are accessible by external AWS accounts or public users. Which AWS service provides this functionality by analyzing resource-based policies?

A.AWS Trusted Advisor
B.Amazon GuardDuty
C.AWS Config
D.AWS IAM Access Analyzer
AnswerD

IAM Access Analyzer is designed to identify resources shared with external principals. It uses mathematical proof-based reasoning to analyze resource-based policies and provides findings for S3 buckets, IAM roles, KMS keys, Lambda functions, and SQS queues that are accessible from outside your account or organization.

Why this answer

AWS IAM Access Analyzer helps identify resources in your organization and accounts that are shared with an external entity. This includes S3 buckets, IAM roles, and KMS keys. By analyzing resource-based policies, it provides findings that allow security engineers to verify if the access is intended, helping to prevent accidental data exposure or unauthorized cross-account access.

Practice this question →
14
MCQmedium

Which IAM configuration helps prevent the 'confused deputy' problem when accessing cross-account resources?

A.MFA requirement on the role.
B.External ID.
C.Role session name.
D.Source IP condition.
AnswerB

The External ID is the primary mechanism for preventing the confused deputy problem in cross-account role assumptions. It serves as a secret value shared only between the trustor and the trustee, ensuring that the trust relationship is validated correctly during the assume-role process and preventing unauthorized access to resources.

Why this answer

The 'External ID' is specifically designed to mitigate the confused deputy problem. When a third party assumes a role in your account, they must provide a unique identifier that you have pre-shared with them. This ensures that the third party is acting on behalf of the correct customer, preventing an attacker from tricking the service into accessing the wrong account's resources.

It is a critical security control for cross-account integrations.

Practice this question →
15
MCQmedium

A security engineer is tasked with granting a developer in Account A access to an Amazon S3 bucket located in Account B. The developer needs to perform PutObject and GetObject operations. According to security best practices for cross-account access, which configuration provides the most secure and manageable solution?

A.Create an IAM user in Account B for the developer and provide the static access keys to the developer in Account A.
B.Define a resource-based policy on the S3 bucket in Account B that grants the developer's IAM ARN in Account A direct access.
C.Create an IAM role in Account B with the required S3 permissions and a trust policy allowing Account A, then let the developer assume it.
D.Configure a VPC Peering connection between Account A and Account B to allow the developer to access the S3 bucket privately.
AnswerC

This method follows the principle of least privilege and uses AWS Security Token Service for temporary access. The trust policy defines who can assume the role, and the identity-based policy defines what they can do. This architecture is scalable and aligns with the AWS Well-Architected Framework security pillar.

Why this answer

Cross-account access is best managed by assuming an IAM role in the destination account. This approach generates temporary security credentials via AWS STS, reducing the risk associated with long-term credentials. It centralizes permission management within the account owning the resource while allowing the source account to control which identities can initiate the switch.

Practice this question →
16
MCQmedium

An application running on EC2 needs to access DynamoDB tables. What is the most secure way to provide these permissions?

A.Embed IAM access keys directly into the application code.
B.Store IAM access keys in a configuration file on the EC2 instance.
C.Assign an IAM role to the EC2 instance via an instance profile.
D.Create a public DynamoDB table to allow unauthenticated access.
AnswerC

Using IAM roles with instance profiles is the gold standard for EC2 security. It provides temporary, short-lived credentials that are automatically rotated by the AWS environment. The application uses the AWS SDK to retrieve these credentials, ensuring no sensitive data is stored on the disk or exposed in the code.

Why this answer

Assigning an IAM role to an EC2 instance is the secure, standard AWS approach. The instance profile automatically provides temporary credentials that the SDK uses, eliminating the need for manual key rotation or storage. This method follows the principle of least privilege by scoping access strictly to the necessary DynamoDB resources, preventing exposure of long-term credentials and simplifying maintenance for the application developers and security administrators.

Practice this question →
17
MCQhard

Refer to the exhibit. This S3 bucket policy is applied to a bucket named 'marketing-data'. What is the effect of this policy regarding access to the objects in the bucket?

A.It allows any IAM user or role within any account belonging to the AWS Organization 'o-1234567890' to read objects.
B.It makes the bucket public to anyone on the internet as long as they are using an AWS account.
C.It allows access only if the S3 bucket itself is owned by the organization 'o-1234567890'.
D.It requires that the request must originate from a VPC endpoint that is tagged with the organization ID.
AnswerA

The 'aws:PrincipalOrgID' condition key filters the 'Principal: *' to only include identities that are part of the specified AWS Organization. This effectively restricts access to all members of the organization while granting them the 's3:GetObject' permission for the objects in the 'marketing-data' bucket.

Why this answer

The PrincipalOrgID condition key is a powerful tool for restricting resource access to identities within a specific AWS Organization. This allows for broad 'Allow' statements that are still safely scoped to internal users only. Mastering this condition helps in creating scalable resource-based policies that don't require listing individual account IDs, thus reducing complexity and manual errors.

Practice this question →
18
Multi-Selecthard

An organization is migrating to AWS and needs to enforce security guardrails across multiple accounts. Which TWO actions should the security team perform to ensure compliance? (Select TWO)

Select 2 answers
A.Apply SCPs at the root level to restrict specific AWS services in member accounts.
B.Assign IAM policies directly to the root user of every member account.
C.Use IAM Permission Boundaries on all developer-created roles.
D.Configure individual IAM users in every account to ensure fine-grained control.
E.Enable AWS CloudTrail only in the primary management account.
AnswersA, C

SCPs applied at the root or organizational unit level are effective at enforcing global compliance standards. They restrict the maximum permissions available to any user or role within the account, ensuring that sensitive services or regions are off-limits, which is fundamental for maintaining a secure and compliant AWS multi-account environment.

Why this answer

Implementing AWS Organizations allows for centralized management and governance. Service Control Policies (SCPs) act as guardrails, defining the maximum permissions allowed within an account, regardless of user identity. Combining SCPs with IAM Permission Boundaries provides a robust multi-layered defense strategy.

This setup ensures that even if an administrator mistakenly grants broad permissions, the guardrails remain in effect, effectively preventing accidental or malicious privilege escalation across the entire AWS organization.

Practice this question →
19
MCQhard

Refer to the exhibit. A developer is attempting to upload a file to 'my-secure-bucket' using the S3 console but receives an Access Denied error. The developer is not specifying any encryption settings during the upload. Based on the provided IAM policy, what is the reason for the failure?

A.The S3 bucket lacks a bucket policy that explicitly allows the PutObject action for the developer.
B.The explicit Deny statement takes precedence because the upload request does not include the required KMS encryption header.
C.The developer's IAM user does not have the 'kms:GenerateDataKey' permission required to encrypt the object.
D.The resource ARN in the policy is incorrect because it should include the bucket name without the trailing slash.
AnswerB

In AWS IAM, an explicit deny always overrides an allow. The policy denies 'PutObject' if the encryption header is not 'aws:kms'. Since the developer did not specify encryption, the condition evaluates to true for the deny statement, resulting in an Access Denied error for the operation.

Why this answer

This question tests the understanding of IAM policy evaluation logic, specifically the explicit deny rule. Even if an allow statement exists, any matching deny statement will take precedence. In this scenario, the user is restricted from uploading objects unless they specify KMS encryption, which is a common requirement for maintaining data security standards within a bucket.

Practice this question →
20
MCQeasy

An application running on an Amazon EC2 instance needs to access files in an Amazon S3 bucket. What is the most secure way to provide the application with the necessary credentials?

A.Store AWS access keys in a configuration file within the application's source code.
B.Assign an IAM role to the EC2 instance using an instance profile.
C.Use the root user's access keys to ensure the application has uninterrupted access to all resources.
D.Create an IAM user with S3 permissions and hardcode its credentials in the EC2 User Data script.
AnswerB

Using an IAM role allows the application to retrieve temporary security credentials from the Instance Metadata Service (IMDS). This is the most secure method because the credentials are automatically rotated by AWS and are never stored permanently on the instance or in the application code.

Why this answer

AWS recommends using IAM roles for EC2 instances to provide temporary credentials. This avoids the need to store sensitive access keys in application code or configuration files. The EC2 instance profile automatically manages the rotation and delivery of these credentials to the instance via the metadata service.

Practice this question →
21
MCQeasy

A security team wants to identify which IAM roles in their AWS account have been granted permissions that allow access from external AWS accounts or public entities. Which AWS service should they use to automate this audit?

A.AWS Secrets Manager
B.IAM Access Analyzer
C.AWS Shield
D.Amazon Inspector
AnswerB

IAM Access Analyzer helps you identify the resources in your account, such as Amazon S3 buckets or IAM roles, that are shared with an external entity. This lets you identify unintended access to your resources and data, which is a critical part of the security auditing process.

Why this answer

AWS IAM Access Analyzer is designed specifically to identify resources that are shared with an external entity. It uses mathematical logic to analyze resource-based policies across S3, IAM roles, KMS keys, and more, providing a comprehensive list of findings that highlight potential unintended public or cross-account access.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Identity and Access Management questions.

Start 20-question session