Courseiva

CCNA IAM Questions

46 questions · IAM topic · All types, answers revealed

Practice these questionsExam hubAll questions
1
MCQhard

A large enterprise uses AWS Organizations to manage multiple accounts. The security team has implemented a Service Control Policy (SCP) at the root level that denies all actions unless the request originates from the corporate IP range (10.0.0.0/8). Recently, a developer in a member account tried to launch an EC2 instance from the AWS Management Console while connected via a VPN that provides an IP address within the corporate range. However, the launch failed with an 'AccessDenied' error. The developer is using an IAM user with full EC2 permissions (ec2:*). The SCP is as follows: {"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"*","Resource":"*","Condition":{"NotIpAddress":{"aws:SourceIp":"10.0.0.0/8"}}}]}. What is the MOST likely reason for the failure?

A.The SCP allows actions only from the specified IP range, but the developer's IP is not in that range.
B.The SCP does not apply to IAM users in member accounts; it only applies to the root user.
C.The aws:SourceIp condition key does not work correctly for requests made via the AWS Management Console because the console may use a different IP.
D.The IAM user does not have the necessary permissions because the SCP explicitly denies all actions.
AnswerC

The console may use intermediary IPs; the source IP condition is not reliable for console access.

Why this answer

The SCP uses the aws:SourceIp condition, but when accessing the Management Console, the IP address seen by AWS is the console's IP, which may not be the same as the developer's VPN IP if the console uses a proxy or if the VPN is configured incorrectly. Option A is wrong because SCPs affect all principals, including the root user. Option B is wrong because the SCP denies actions, not allows them; an explicit deny overrides allows.

Option D is wrong because the SCP denies all actions, so even if the developer has permissions, the SCP denies them.

Practice this question →
2
MCQmedium

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that no IAM user in any account can create new IAM users. Which approach should be used?

A.Apply an IAM policy to the root user of each account.
B.Use an SCP attached to each IAM user.
C.Use an IAM permissions boundary on each IAM user.
D.Apply a service control policy (SCP) at the root organizational unit that denies IAM:CreateUser.
AnswerD

SCPs can deny actions across all accounts in the organization.

Why this answer

Service control policies (SCPs) are the correct mechanism because they allow you to centrally restrict permissions across all accounts in an AWS Organization. By attaching an SCP at the root organizational unit that denies the `iam:CreateUser` action, you ensure that no IAM user in any member account can create new IAM users, regardless of any IAM policies applied within those accounts. SCPs act as a guardrail that overrides any allow permissions granted by IAM policies.

Exam trap

The trap here is that candidates often confuse SCPs with IAM permissions boundaries or think SCPs can be attached directly to IAM users, but SCPs only apply to accounts or organizational units and are designed for centralized governance across an AWS Organization.

How to eliminate wrong answers

Option A is wrong because the root user of each account is not subject to IAM policies; the root user has full administrative access and cannot be restricted by IAM policies. Option B is wrong because SCPs are attached to AWS accounts or organizational units, not to IAM users; attaching an SCP to an IAM user is not a valid operation. Option C is wrong because an IAM permissions boundary only limits the maximum permissions an IAM user can have, but it does not prevent the user from creating other IAM users if the boundary allows it; it is not a global deny mechanism across accounts.

Practice this question →
3
Multi-Selectmedium

A security engineer is designing IAM policies for a data analytics platform that uses Amazon S3, Amazon Athena, and AWS Glue. The platform must allow data scientists to query data in S3 using Athena, but only from specific VPC subnets. Additionally, the data must be encrypted at rest using AWS KMS. Which TWO actions should the engineer take to meet these requirements? (Choose TWO.)

Select 2 answers
A.Grant kms:Decrypt permission in the IAM policy and configure the KMS key policy to allow the IAM role to use the key.
B.Add kms:EncryptionContext condition to the IAM policy to require a specific encryption context.
C.Create a VPC endpoint for Athena and attach a bucket policy that restricts access to that endpoint.
D.Use the s3:SourceIp condition key in the IAM policy to restrict access to the private IP ranges of the VPC subnets.
E.Enable default encryption on the S3 bucket using SSE-S3 and configure the KMS key policy to allow the IAM role.
AnswersA, C

Correct – Provides kms:Decrypt permission and ensures the KMS key policy allows the IAM role, enabling Athena to decrypt objects encrypted with a customer-managed KMS key.

Why this answer

A: Correct – Granting kms:Decrypt permission in the IAM policy and ensuring the KMS key policy allows the IAM role enables Athena to decrypt S3 objects encrypted with a customer-managed KMS key. C: Correct – Creating a VPC endpoint for Athena (or S3) and attaching a bucket policy that restricts access to that endpoint ensures queries are only allowed from the specified VPC subnets. B: Incorrect – The s3:SourceIp condition key does not work for requests made via VPC endpoints; use aws:SourceVpce instead.

D: Incorrect – The kms:EncryptionContext condition is not used for restricting encryption at rest; it is used for encryption context in KMS operations. E: Incorrect – SSE-S3 does not use KMS, so the KMS key policy would not be relevant.

Exam trap

A common trap is confusing VPC endpoint policies with source IP conditions. When using a VPC endpoint, you must use aws:SourceVpce in the bucket policy, not s3:SourceIp.

Practice this question →
4
Multi-Selecthard

A company has a requirement that all IAM users must use multi-factor authentication (MFA) to access the AWS Management Console. Which TWO steps should the company take to enforce this?

Select 2 answers
A.Enable MFA devices for each IAM user.
B.Use a service control policy (SCP) to require MFA for all users.
C.Attach an IAM policy that denies all actions unless the request includes MFA (condition aws:MultiFactorAuthPresent).
D.Enable MFA for the root user only.
E.Configure an IAM password policy that requires MFA.
AnswersA, C

Users must have MFA devices assigned.

Why this answer

To enforce MFA, each IAM user must have an MFA device enabled. Option C is correct because attaching an IAM policy with a condition that denies all actions unless aws:MultiFactorAuthPresent is true ensures that users must authenticate with MFA to perform any action. Option B is incorrect because service control policies (SCPs) are used in AWS Organizations to manage permissions across accounts, not for individual user-level MFA enforcement.

Option D is incorrect because enabling MFA for the root user only does not enforce MFA for all IAM users. Option E is incorrect because an IAM password policy controls password complexity and rotation, not MFA requirements.

Practice this question →
5
MCQeasy

Refer to the exhibit. An IAM user has this policy attached. Can the user create a new IAM user in the us-east-1 region?

A.Yes, because the Allow statement explicitly permits CreateUser.
B.No, because IAM is a global service and region conditions do not apply.
C.Yes, because the Deny only applies to us-east-1.
D.No, because the Deny statement blocks all IAM actions in us-east-1.
AnswerD

The Deny is explicit and overrides the Allow.

Why this answer

The Deny statement blocks all IAM actions in us-east-1, which overrides the Allow for CreateUser. Since the Deny is explicit, it blocks the action even though there is an Allow. The request fails.

Practice this question →
6
MCQmedium

A company has an S3 bucket policy that allows cross-account access for a specific IAM role in another account. The bucket policy includes a Principal element with the ARN of the role. However, users in the other account that assume the role are unable to access the bucket. Which of the following is the MOST likely cause?

A.The IAM role does not have a permissions policy granting s3:GetObject on the bucket.
B.The bucket policy has an explicit Deny statement that overrides the Allow.
C.The role's trust policy does not allow the S3 service to assume the role.
D.The bucket policy uses the role ARN in the Principal element instead of the AWS account ID.
AnswerA

In cross-account S3 access, the requesting IAM role must have an identity-based permissions policy that explicitly allows s3:GetObject on the specific bucket. The bucket policy alone is insufficient; if the role lacks the necessary IAM permissions, the request is denied even when the bucket policy states that access is allowed. This missing permissions policy is the most common root cause when a role cannot read from a bucket it was supposedly granted access to.

Why this answer

For cross-account access using an S3 bucket policy, the IAM role in the trusted account must have a permissions policy that grants the necessary S3 actions (e.g., s3:GetObject). Without this policy, even if the bucket policy allows the role, the role itself does not have permission to perform the action. Options B, C, and D are less likely: B is possible but not the most common; C is incorrect because the trust policy allows users to assume the role, not the S3 service; D is incorrect because role ARNs are valid principals in S3 bucket policies.

Exam trap

Candidates often forget that the IAM role itself needs both a trust policy and a permissions policy. The bucket policy grants access to the role, but the role must also have the required permissions.

How to eliminate wrong answers

Option A is wrong because the question states the bucket policy allows cross-account access for a specific IAM role, and the issue is about the policy's Principal element, not the role's permissions policy; even if the role had an s3:GetObject permission, the bucket policy's Principal mismatch would still block access. Option B is wrong because there is no mention of an explicit Deny statement in the scenario; the problem is that the Allow statement itself is misconfigured due to the Principal element, not overridden by a Deny. Option C is wrong because the role's trust policy controls which entities can assume the role, not whether the S3 service can assume it; S3 does not assume roles—users or services assume roles, and the trust policy is irrelevant to S3 bucket policy evaluation.

Practice this question →
7
MCQeasy

An IAM user receives an 'AccessDenied' error when trying to list objects in an S3 bucket. The user has the following policy attached: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::example-bucket"}]}. What is the most likely reason?

A.The policy is missing a condition
B.The bucket policy explicitly denies the action
C.The policy does not include s3:GetObject
D.The policy has a syntax error
AnswerB

An explicit deny in the bucket policy overrides the user policy allow.

Why this answer

The IAM policy grants the s3:ListBucket action on the bucket, which should allow listing objects. However, an explicit deny in a bucket policy overrides any allow, including those from IAM policies. Since the user receives an 'AccessDenied' error, the most likely cause is that the bucket policy explicitly denies the s3:ListBucket action for this user, as explicit denies take precedence over all allows.

Exam trap

The trap here is that candidates often assume an IAM policy alone is sufficient and forget that bucket policies can explicitly deny actions, overriding IAM allows, leading them to incorrectly choose options like missing permissions or syntax errors.

How to eliminate wrong answers

Option A is wrong because a missing condition would not cause an 'AccessDenied' error if the action and resource are correctly allowed; conditions only further restrict access, and their absence typically broadens access. Option C is wrong because s3:GetObject is not required for listing objects; s3:ListBucket alone is sufficient for the ListObjects operation. Option D is wrong because a syntax error would result in a different error (e.g., 'MalformedPolicy') or the policy would be invalid, not an 'AccessDenied' error during the API call.

Practice this question →
8
MCQhard

A security engineer needs to ensure that an IAM role can be assumed only from a specific VPC. Which IAM policy condition key should be used?

A.aws:RequestedRegion
B.aws:VpcSourceIp
C.aws:SourceVpc
D.aws:SourceIp
AnswerC

This is the correct condition key. It restricts requests to originate from a specified VPC.

Why this answer

Aws:SourceVpc. This condition key allows you to restrict requests to originate from a specific VPC ID. Option A, aws:RequestedRegion, restricts region, not VPC.

Option B, aws:VpcSourceIp, is not a valid condition key. Option D, aws:SourceIp, restricts source IP address, not VPC.

Practice this question →
9
Multi-Selecthard

A security engineer is designing a permissions boundary for an IAM user. Which TWO statements about permissions boundaries are correct?

Select 2 answers
A.Permissions boundaries can be applied to service-linked roles.
B.Permissions boundaries can only be applied to IAM users, not roles.
C.The effective permissions are the intersection of the identity-based policy and the permissions boundary.
D.Permissions boundaries can override resource-based policies.
E.A permissions boundary alone does not grant permissions; an identity-based policy is also required.
AnswersC, E

Intersection of both policies.

Why this answer

The correct answers are C and E. Permissions boundaries set the maximum permissions that an identity-based policy can grant. The effective permissions are the intersection of the identity-based policy and the permissions boundary (C).

A permissions boundary alone does not grant permissions; you must also attach an identity-based policy (E). Option A is incorrect because permissions boundaries cannot be applied to service-linked roles. Option B is incorrect because permissions boundaries can be applied to both IAM users and roles.

Option D is incorrect because permissions boundaries do not affect resource-based policies; they only limit identity-based policies.

Practice this question →
10
MCQmedium

A company wants to allow users from an external AWS account to assume an IAM role in its account. What must be configured in both accounts?

A.An IAM password policy in both accounts.
B.Only the trusting account's role trust policy.
C.Only the external account's IAM policy to allow sts:AssumeRole.
D.Both the trusting account's role trust policy and the external account's IAM policy to allow sts:AssumeRole.
AnswerD

Correct. Both the trusting account's role trust policy and the external account's IAM policy to allow sts:AssumeRole are required for cross-account role access.

Why this answer

Cross-account role access requires configuration on both sides: the trusting account (where the role resides) must have a trust policy that allows the external account to assume the role, and the external account must have an IAM policy that grants its users permission to call sts:AssumeRole targeting that role. Option A is incorrect because an IAM password policy is unrelated to cross-account role access. Option B is incorrect because while the trusting account's trust policy is necessary, the external account also needs to grant sts:AssumeRole permission to its users.

Option C is incorrect because the external account's policy alone is insufficient without the trusting account's trust policy.

Practice this question →
11
Multi-Selecthard

A security engineer is designing a solution to allow an external auditor to access logs in an S3 bucket in the company's AWS account. The auditor does not have an AWS account. The engineer needs to grant read-only access to the specific bucket for a limited time. Which TWO actions should the engineer take? (Choose two.)

Select 2 answers
A.Enable S3 Access Analyzer on the bucket to generate findings for the auditor.
B.Create a cross-account IAM role in the company's account and share the role ARN with the auditor.
C.Use AWS STS to issue temporary credentials that the auditor can use to access the bucket.
D.Generate a pre-signed URL for each log file the auditor needs to access.
E.Configure the bucket policy to grant access to 'Principal': '*' with a condition that limits access to the auditor's IP address.
AnswersC, D

STS can issue temporary credentials with a specified expiration; the auditor can use these to access the bucket.

Why this answer

AWS Security Token Service (STS) can issue temporary, limited-privilege credentials (access key, secret key, and session token) that the auditor can use to authenticate API requests to the S3 bucket. This approach does not require the auditor to have an AWS account and allows the engineer to control the validity period (via the DurationSeconds parameter) to enforce a limited time window. Option D is correct because a pre-signed URL embeds temporary credentials and a specific expiration time, granting read-only access to a single object without requiring the auditor to have AWS credentials or an AWS account.

Exam trap

The trap here is that candidates often choose cross-account IAM roles (Option B) without realizing that the external user must have an AWS account to assume the role, which is explicitly not the case in this scenario.

Practice this question →
12
MCQeasy

A company requires that all access to its S3 buckets be logged for compliance. Which AWS service should be used to record API calls to S3?

A.Amazon GuardDuty
B.Amazon Inspector
C.AWS Config
D.AWS CloudTrail
AnswerD

AWS CloudTrail records API calls for auditing purposes.

Why this answer

AWS CloudTrail records API calls for auditing purposes, making it the correct service for logging access to S3 buckets. Option A is incorrect because Amazon GuardDuty is a threat detection service, not a logging service. Option B is incorrect because Amazon Inspector assesses vulnerabilities.

Option C is incorrect because AWS Config tracks resource configuration changes, not API calls.

Practice this question →
13
MCQhard

A company uses an IAM role to allow an EC2 instance to access an S3 bucket. The security team wants to ensure that if the EC2 instance is compromised, the attacker cannot use the role credentials to access resources outside the account. What should the security team do?

A.Store the role credentials in AWS Secrets Manager and rotate them frequently.
B.Use an instance profile with a short-lived session token.
C.Use an SCP to deny all actions except S3 access for the role.
D.Attach a permissions boundary to the IAM role that limits access to only the required S3 bucket.
AnswerD

Permissions boundaries set the maximum permissions for the role.

Why this answer

Using a permissions boundary restricts the maximum permissions the role can have, limiting the impact of a compromised instance.

Practice this question →
14
MCQmedium

A security engineer is investigating an IAM role that was used to access AWS resources from an external account. The role has a trust policy that allows the external account to assume it. Which of the following is a required step for the external account to use the role?

A.Configure the role to require MFA for the external account.
B.Create a new IAM role in the external account with a trust policy allowing the role's ARN.
C.Add the external account's root user ARN to the role's trust policy.
D.Attach an IAM policy to an IAM user in the external account that allows sts:AssumeRole for the role ARN.
AnswerD

The external user needs permission to assume the role.

Why this answer

To assume a role in another AWS account, the external account must have an IAM user or role with permissions to call the sts:AssumeRole API for the target role ARN. Option D correctly describes this requirement. Option A is incorrect because MFA is not a required step unless specified in the role's trust policy.

Option B is incorrect because the external account does not need to create a new role; it only needs a principal (user or role) with the appropriate permissions. Option C is incorrect because the trust policy is attached to the role in the target account, not the external account.

Practice this question →
15
MCQmedium

A company wants to allow cross-account access to an S3 bucket in Account A for a user in Account B. What is the correct combination of steps?

A.Add a bucket policy in Account A allowing access to the user in Account B, and attach an IAM policy to the user in Account B allowing access to the bucket.
B.Create an IAM role in Account A with access to the bucket, and have the user in Account B assume that role.
C.Add a bucket policy in Account A allowing access to Account B, and no action is needed in Account B because the user already has permissions.
D.Add a bucket policy in Account A allowing access to Account B, and attach an IAM policy to the user in Account B allowing access to the bucket.
AnswerA

Correct: Both a bucket policy granting access to the specific user and an IAM policy for that user are required for cross-account access.

Why this answer

Cross-account access to an S3 bucket requires two key permissions: a resource-based policy (bucket policy) in the owning account (Account A) that grants access to the specific IAM user in Account B, and an identity-based policy (IAM policy) attached to that user in Account B that permits the necessary S3 actions. Option A correctly describes this combination. Option D grants the bucket policy to the entire Account B, which may work but is less secure and not the recommended least-privilege approach; furthermore, the bucket policy to 'Account B' alone does not grant access to a specific user unless accompanied by the correct IAM policy, but the phrasing is ambiguous and not as precise as Option A.

Option B suggests using an IAM role in Account A, which would require the user to assume the role, a different pattern not matching the question's scenario. Option C is incorrect because the user in Account B must have an explicit IAM policy; the bucket policy alone is insufficient.

Practice this question →
16
Multi-Selecthard

A company uses AWS KMS to encrypt objects in an S3 bucket. The security team wants to ensure that only users with the appropriate KMS key permissions can decrypt objects. Which TWO conditions should be included in the S3 bucket policy to enforce this? (Choose TWO.)

Select 2 answers
A."Condition": {"StringEquals": {"kms:ViaService": "s3.us-east-1.amazonaws.com"}}
B."Condition": {"StringEquals": {"kms:KeySpec": "SYMMETRIC_DEFAULT"}}
C."Condition": {"StringEquals": {"kms:ViaService": "s3.us-east-1.amazonaws.com"}}
D."Condition": {"StringEquals": {"kms:GranteePrincipal": "arn:aws:iam::123456789012:role/Admin"}}
E."Condition": {"StringEquals": {"kms:EncryptionContext": {"aws:s3:arn": "arn:aws:s3:::my-bucket"}}}
AnswersA, E

Correct. This condition restricts the KMS key to be used only via the S3 service, ensuring that decryption requests must come through S3.

Why this answer

Options A and E are the only distinct conditions that can be used in an S3 bucket policy to enforce that only users with appropriate KMS key permissions can decrypt objects. kms:ViaService restricts the use of the KMS key to requests coming via the S3 service, and kms:EncryptionContext restricts decryption to requests that include the specific S3 bucket ARN. Option C is identical to A and thus does not provide an additional constraint, making it redundant. Options B and D are not valid condition keys for S3 bucket policies.

Practice this question →
17
MCQmedium

A security engineer notices that an IAM role has a trust policy allowing any AWS account to assume it. Which attack is this misconfiguration most likely to enable?

A.Logging bypass via CloudTrail
B.Cross-service confused deputy attack
C.Unauthorized access by an external attacker
D.Privilege escalation by attaching additional policies
AnswerC

This is correct: an overly broad trust policy—for example `"Principal": "*"` without restrictive conditions—allows any AWS principal from any account to call `sts:AssumeRole` and obtain the role's temporary security credentials. Once assumed, the attacker receives all permissions attached to the role, enabling unauthorized actions in the account. In the absence of conditions like `aws:PrincipalArn`, `aws:PrincipalAccount`, or an external ID, there is no mechanism to distinguish legitimate principals from external attackers, so the role effectively exposes its permissions to the entire AWS ecosystem.

Why this answer

An IAM role trust policy that allows any AWS account (i.e., `"Principal": {"AWS": "*"}`) to assume the role means that any user or service in any AWS account can call the STS `AssumeRole` API to obtain temporary credentials for the role. This directly enables unauthorized access by an external attacker who can discover the role ARN and assume it, gaining all permissions attached to the role.

Exam trap

The trap here is that candidates may confuse a trust policy misconfiguration with a permissions policy misconfiguration, thinking that privilege escalation (Option D) is the primary risk, when in fact the trust policy directly controls who can assume the role, making unauthorized access the immediate and most likely attack.

How to eliminate wrong answers

Option A is wrong because CloudTrail logs all AWS API calls, including STS `AssumeRole` actions, and there is no mechanism in this misconfiguration to bypass or disable CloudTrail logging. Option B is wrong because a cross-service confused deputy attack involves a malicious service tricking another service into using its own permissions, not an overly permissive trust policy allowing any AWS account to assume a role. Option D is wrong because the misconfiguration is in the trust policy, not in the permissions policy; privilege escalation by attaching additional policies would require the attacker to already have IAM permissions to modify policies, which is not enabled by the trust policy alone.

Practice this question →
18
MCQeasy

A developer needs to grant an EC2 instance read-only access to an S3 bucket. Which of the following is the most secure way to provide these permissions?

A.Use an IAM role and store the credentials in AWS Systems Manager Parameter Store, then retrieve them at instance launch.
B.Create an IAM role with read-only access and attach it to the EC2 instance profile.
C.Create a bucket policy that grants read-only access to the instance's public IP address.
D.Create an IAM user with read-only access and store the access keys in the instance's user data.
AnswerB

IAM roles for EC2 provide temporary credentials without managing keys.

Why this answer

Using an IAM role attached to an instance profile grants temporary credentials and eliminates long-term access keys. Option A is incorrect because storing credentials in Parameter Store (or any static storage) is less secure than using an instance profile, and IAM roles do not have static credentials to store. Option C is incorrect because a bucket policy cannot grant access based on an instance's public IP in a secure or reliable way, and it would grant access to anyone with that IP, not just the instance.

Option D is incorrect because storing IAM user access keys in user data exposes long-term credentials, which is less secure than using an instance profile.

Practice this question →
19
MCQeasy

Which IAM entity can be used to delegate permissions to an AWS service to perform actions on your behalf?

A.Service role
B.Service-linked role
C.Instance profile
D.Permissions boundary
AnswerA

A service role allows an AWS service to assume it and perform actions.

Why this answer

A service role is an IAM role that a service assumes to perform actions on your behalf. Option A is correct. Option B is wrong because a service-linked role is a special type of service role, but not all service roles are service-linked.

Option C is wrong because an instance profile is used for EC2. Option D is wrong because a permissions boundary is used to set maximum permissions.

Practice this question →
20
MCQhard

Refer to the exhibit. An IAM policy allows running EC2 instances. A developer tries to launch a t2.micro instance but receives an 'AccessDenied' error. What is the most likely reason?

A.The policy does not grant permissions for other required resources such as images or security groups.
B.The developer is trying to launch a different instance type.
C.The region in the policy does not match the developer's region.
D.The policy has an explicit deny elsewhere.
AnswerA

RunInstances requires permissions on multiple resource types; the policy only grants on instance, not on image, network, etc.

Why this answer

Even though the policy allows the ec2:RunInstances action on the instance resource, the RunInstances API call requires permissions for other resources such as Amazon Machine Images (AMI), security groups, and key pairs. Without explicit permissions for these resources, the API call fails with an AccessDenied error. Option B is incorrect because the condition specifies t2.micro, matching the developer's request.

Option C is incorrect because the policy does not restrict by region. Option D is incorrect because there is no explicit deny; the denial is due to missing resource permissions.

Practice this question →
21
MCQeasy

A company wants to allow an external auditor to read all objects in a specific S3 bucket for a limited time. What is the most secure way to grant this access?

A.Generate pre-signed URLs for the objects the auditor needs to read, with an expiration time.
B.Use a bucket policy that allows access only from the auditor's IP address.
C.Make the bucket public and restrict access via IP address in the bucket policy.
D.Create an IAM user for the auditor with read-only access to the bucket and share the access keys.
AnswerA

Pre-signed URLs provide time-limited access without sharing credentials.

Why this answer

Pre-signed URLs provide temporary, granular access to specific S3 objects without requiring the auditor to have AWS credentials. The expiration time ensures access is limited. Option B is incorrect because a bucket policy restricting by IP address still requires the auditor to have some form of authentication (like IAM user credentials) to access the bucket, and it doesn't provide object-level granularity.

Option C is incorrect because making the bucket public, even with IP restrictions, is less secure as it could allow unintended access from allowed IPs and doesn't provide temporary access. Option D is incorrect because creating an IAM user for an external auditor and sharing access keys is a security risk; the credentials could be compromised or misused, and it's not a best practice for temporary external access.

Practice this question →
22
Multi-Selectmedium

Which TWO of the following are valid ways to grant an IAM user permissions to access an S3 bucket? (Choose 2.)

Select 2 answers
A.Assign an instance profile to the user.
B.Create a VPC endpoint policy.
C.Attach an IAM policy to the user.
D.Add the user to an IAM group with a policy.
E.Use an SCP to allow access.
AnswersC, D

IAM policies attached to users grant permissions.

Why this answer

An IAM policy attached directly to a user explicitly grants that user permissions to perform specific actions on an S3 bucket. This is a fundamental method of identity-based access control in AWS, where the policy document defines allowed or denied actions (e.g., s3:GetObject) and resources (e.g., arn:aws:s3:::example-bucket/*).

Exam trap

The trap here is that candidates often confuse identity-based policies (attached to users/groups/roles) with resource-based policies (like bucket policies) or other access control mechanisms (like SCPs or VPC endpoint policies), leading them to select options that do not directly grant permissions to an IAM user.

Practice this question →
23
MCQhard

An IAM policy is attached to a user. The user is trying to change their own password in the IAM console but receives an 'Access Denied' error. The user has an MFA device configured and is logged in with MFA. Why is the password change failing?

A.The Allow statement for iam:ChangePassword is not sufficient because the Deny statement explicitly denies all actions.
B.The Deny statement uses 'BoolIfExists' which evaluates to true if the condition key is not present. In the IAM console, the 'aws:MultiFactorAuthPresent' key may not be set, causing the Deny to apply even when the user has MFA.
C.The Deny statement denies all actions unconditionally, so the Allow statement cannot override it.
D.The user does not have permission to change their own password because the Allow statement is not specific enough.
AnswerB

BoolIfExists returns true if the key does not exist, so the Deny applies, blocking all actions including password change.

Why this answer

The Deny statement uses the `BoolIfExists` condition operator with the `aws:MultiFactorAuthPresent` key. In the IAM console, the `aws:MultiFactorAuthPresent` key may not be present in the request context (e.g., during the initial password change flow before MFA is re-validated), causing `BoolIfExists` to evaluate to true when the key is absent. This triggers the Deny even though the user has an MFA device and is logged in with MFA, blocking the `iam:ChangePassword` action.

Exam trap

The trap here is that candidates assume `BoolIfExists` behaves like `Bool` and that MFA presence is always indicated in the request context, but `BoolIfExists` treats a missing key as true, causing the Deny to apply when the key is absent, such as in the IAM console's password change flow.

How to eliminate wrong answers

Option A is wrong because the Deny statement does not explicitly deny all actions; it only denies actions when the condition evaluates to true, so the Allow statement could be sufficient if the condition were not met. Option C is wrong because the Deny statement is not unconditional; it includes a condition (`BoolIfExists`), so it only applies when the condition is true, not to all actions. Option D is wrong because the Allow statement is specific enough (it allows `iam:ChangePassword` for the user's own account), but the Deny overrides it due to the condition evaluation.

Practice this question →
24
MCQmedium

An administrator wants to audit all IAM actions in the account. Which AWS service should be used?

A.AWS Config
B.Amazon GuardDuty
C.AWS CloudTrail
D.Amazon CloudWatch
AnswerC

AWS CloudTrail records API activity, which includes all IAM actions.

Why this answer

AWS CloudTrail records API activity, including all IAM actions. AWS Config tracks resource configuration changes, not API actions. Amazon GuardDuty is a threat detection service.

Amazon CloudWatch monitors metrics and logs, but does not record API calls.

Practice this question →
25
MCQmedium

A security team needs to audit all changes to IAM resources in their AWS account. Which AWS service should they use?

A.VPC Flow Logs
B.AWS CloudTrail
C.AWS Config
D.Amazon CloudWatch Logs
AnswerB

CloudTrail records all AWS API calls for auditing.

Why this answer

AWS CloudTrail records API calls made in the AWS account, including changes to IAM resources. Therefore, option B is correct. Option A is wrong because VPC Flow Logs capture network traffic, not IAM changes.

Option C is wrong because AWS Config records resource configuration changes but does not capture all API calls; it can be used to track IAM changes but CloudTrail is the primary service for API audit. Option D is wrong because CloudWatch Logs stores logs from various sources but does not capture API calls by default; it can be integrated with CloudTrail but is not the service that directly records IAM changes.

Practice this question →
26
MCQmedium

A company has an S3 bucket with a bucket policy that grants access to a specific IAM role. However, users who assume that role are unable to list objects in the bucket. The bucket policy includes a Principal element set to the role ARN. What is the MOST likely cause?

A.The IAM role does not have a permissions policy that allows s3:ListBucket.
B.The bucket has an ACL that denies access to the role.
C.The bucket policy requires MFA, but the role does not enforce MFA.
D.The role's trust policy does not allow sts:AssumeRole.
AnswerA

The IAM role needs a permissions policy that allows s3:ListBucket. A bucket policy alone does not grant access to IAM principals; the role must also have an IAM policy allowing the action.

Why this answer

Bucket policies do not grant permissions to IAM role principals unless the role has an IAM policy that allows the S3 action. Option B is false; ACLs are not the issue here; the role lacks an IAM policy. Option C is false; the scenario does not involve MFA, and even if MFA were required, the role’s inability to list objects is due to missing IAM permissions.

Option D is false; the role’s trust policy allows AssumeRole, otherwise the users could not assume the role.

Practice this question →
27
MCQmedium

A company uses AWS Organizations with SCPs to restrict services. An administrator creates an SCP that denies access to EC2. A developer in a member account tries to launch an EC2 instance but fails. What is the most likely reason?

A.The SCP from the organization denies EC2
B.The root user of the account has denied EC2
C.The developer's IAM permissions boundary blocks EC2
D.The EC2 instance has a resource-based policy denying access
AnswerA

SCPs apply to all principals in the account.

Why this answer

Service Control Policies (SCPs) in AWS Organizations act as a centralized governance mechanism that applies a deny effect across all IAM principals in member accounts. When an SCP explicitly denies access to EC2, it overrides any allow permissions at the account level, including those granted by IAM policies. The developer's launch attempt fails because the SCP's deny is evaluated before any account-level permissions, effectively blocking the action regardless of the developer's IAM role or user permissions.

Exam trap

The trap here is that candidates often assume IAM permissions or permissions boundaries are the primary cause of access failures, overlooking that SCPs apply a blanket deny that overrides all account-level permissions, including those of the root user.

How to eliminate wrong answers

Option B is wrong because the root user of a member account is also subject to SCPs from the organization; while the root user has full permissions by default, an SCP that denies EC2 applies to the root user as well, so the root user cannot bypass the SCP to allow EC2. Option C is wrong because an IAM permissions boundary limits the maximum permissions a principal can have, but it does not deny actions by itself; if the developer's IAM policy allowed EC2 and the boundary did not explicitly deny EC2, the boundary would not cause the failure—the SCP's deny is the overriding factor. Option D is wrong because EC2 instances do not have resource-based policies that control who can launch them; resource-based policies are used for services like S3 buckets or Lambda functions, not for controlling the ability to create EC2 instances.

Practice this question →
28
Multi-Selectmedium

Which TWO actions can be used to restrict access to an S3 bucket to only users who authenticate using multi-factor authentication (MFA)? (Choose TWO.)

Select 2 answers
A.Use AWS CloudTrail to log requests and deny those without MFA
B.Use pre-signed URLs with MFA credentials
C.Set an S3 bucket ACL that requires MFA
D.Add a condition in the IAM policy that checks aws:MultiFactorAuthPresent is true
E.Add a condition in the bucket policy that checks aws:MultiFactorAuthPresent is true
AnswersB, E

Pre-signed URLs can be generated with MFA, requiring MFA for access.

Why this answer

The correct answers are B and E. Option B: Pre-signed URLs generated with MFA credentials require the user to authenticate with MFA before accessing the S3 object. Option E: A bucket policy with a condition `aws:MultiFactorAuthPresent: true` enforces MFA for all operations on the bucket.

Option A is wrong because AWS CloudTrail only logs API calls, it does not enforce access control. Option C is wrong because S3 bucket ACLs do not support conditions to check MFA. Option D is wrong because IAM policies with MFA conditions apply at the user/group level, not directly to the S3 bucket; the bucket policy is needed to restrict bucket access.

Practice this question →
29
Multi-Selectmedium

Which TWO actions are valid ways to grant an IAM user access to an S3 bucket owned by another AWS account? (Choose TWO.)

Select 2 answers
A.Have the user assume an IAM role in the bucket-owning account with appropriate permissions.
B.Create a bucket policy that grants access to the user's AWS account.
C.Attach an IAM policy to the user in their own account allowing access to the bucket.
D.Add the user's ARN to the bucket's ACL.
E.Use an S3 access point with a policy that allows the user.
AnswersA, B

Cross-account role assumption grants temporary access.

Why this answer

Correct answers are A and B. Option A: Assuming a role in the bucket-owning account is a standard cross-account access method. Option B: A bucket policy granting access to the user's AWS account, combined with the user having appropriate IAM permissions (e.g., s3:GetObject), allows access.

Option C is incorrect because the user's own IAM policy cannot grant access to resources in another account; the resource owner must grant access. Option D is incorrect because ACLs do not support granting access to an IAM user ARN; they only support AWS accounts or predefined groups. Option E is incorrect because S3 access points are used within the same account or with bucket policies, but cannot be used to grant access to an IAM user in another account directly.

Practice this question →
30
MCQhard

A security engineer is analyzing an IAM policy that is attached to a group. The policy is intended to allow users to manage their own credentials. However, users are reporting that they cannot change their password. The policy is: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": ["iam:ChangePassword", "iam:GetAccountPasswordPolicy"], "Resource": "*" } ] } What is the issue?

A.The policy does not include the iam:UpdateLoginProfile action.
B.The policy should be attached to the user instead of the group.
C.The policy is missing the iam:CreateLoginProfile action.
D.The policy resource is set to "*", but ChangePassword requires the resource to be the specific user ARN.
AnswerD

IAM enforces that ChangePassword must be scoped to the user's own ARN.

Why this answer

The ChangePassword action requires the resource ARN to be the specific user's ARN (e.g., arn:aws:iam::account-id:user/${aws:username}). Using a wildcard '*' causes the policy to fail because IAM validates the resource ARN against the user's own ARN. Options A and C are incorrect because the required action is iam:ChangePassword, not UpdateLoginProfile or CreateLoginProfile.

Option B is incorrect because the policy attachment to the group is not the issue; the resource restriction is the problem.

Practice this question →
31
MCQhard

A company has a multi-account AWS organization with centralized logging in a Security account. The Security account contains an S3 bucket that stores CloudTrail logs from all member accounts. The bucket policy allows CloudTrail from member accounts to deliver logs. Recently, a security audit revealed that the bucket is publicly accessible. The security engineer must ensure that only authorized accounts can access the logs. The engineer updates the bucket policy to include a condition that restricts access to specific AWS accounts. However, after the change, member accounts report that CloudTrail is failing to deliver logs to the bucket. The bucket policy currently includes the following statement: { "Effect": "Allow", "Principal": "*", "Action": "s3:PutObject", "Resource": "arn:aws:s3:::central-logs/*", "Condition": { "StringEquals": { "aws:SourceAccount": "111111111111" } } } The Security account ID is 222222222222. What is the MOST likely cause of the delivery failure, and what should the engineer do to fix it?

A.Modify the KMS key policy to allow CloudTrail to decrypt and re-encrypt logs if SSE-KMS is enabled.
B.Update the bucket ACL to grant the CloudTrail service write access, as CloudTrail requires both bucket policy and ACL permissions.
C.Change the Principal from "*" to the CloudTrail service principal to restrict access more tightly.
D.Create an IAM role in the Security account and configure member accounts to use that role for log delivery.
AnswerC

This is correct. Changing the Principal from `*` to the CloudTrail service principal allows the policy to match CloudTrail requests. The condition should additionally be updated to use `aws:SourceArn` for proper account restriction, but among the given options, this is the best fix.

Why this answer

The bucket policy's condition using `aws:SourceAccount` is not appropriate for CloudTrail. CloudTrail uses the service principal (`cloudtrail.amazonaws.com`) and the `aws:SourceAccount` key is not evaluated for service principals. The condition does not match, causing log delivery failures.

Changing the Principal from `*` to the CloudTrail service principal is a necessary step to properly scope the policy. However, the condition should also be changed to use `aws:SourceArn` or removed entirely. Among the options, option C is the most direct fix, while option B is incorrect because CloudTrail does not require bucket ACLs.

Options A and D are irrelevant to the issue.

Practice this question →
32
MCQeasy

A company has a single AWS account with multiple IAM users. The administrator created an IAM policy that allows all users to launch EC2 instances, but only if they use a specific AMI ID (ami-12345678) and a specific instance type (t3.micro). The policy uses a condition that checks the EC2 instance type and AMI ID. However, a user is able to launch an EC2 instance with a different AMI ID and a larger instance type. The administrator reviews the policy and confirms that the condition is correctly written. What is the most likely reason that the policy is not working as expected?

A.The condition keys used (ec2:InstanceType and ec2:ImageId) are not supported for the RunInstances action in IAM policies.
B.The policy is attached to the user but must also be attached to the IAM group.
C.The policy does not include an explicit deny statement for non-compliant launches.
D.The condition is written incorrectly; it should use StringLike instead of StringEquals.
AnswerC

In IAM, the default behavior is to deny access, but that default is overridden by any applicable allow statement from another policy. This policy only allows RunInstances when the specified condition keys match; it does not explicitly deny RunInstances when the conditions are not met. Consequently, if the user has any other identity-based or resource-based policy that allows RunInstances without conditions, the user can still launch non-compliant instances. An explicit Deny statement using a condition like StringNotEquals (or a NotCondition) would be required to block those non-compliant launches, making the missing deny the root cause.

Why this answer

The most likely reason is that the user has another IAM policy attached (e.g., a managed policy or group policy) that allows ec2:RunInstances without the condition. IAM evaluates all policies; if any allow statement grants the action, the action is permitted unless explicitly denied. The conditional allow only restricts when that specific statement is used, but a separate unconditional allow overrides the condition.

Adding an explicit deny for non-compliant launches would block them regardless of other policies.

Exam trap

Candidates often assume that adding a condition to an allow statement is sufficient to restrict actions, but if another allow statement without the condition exists, the condition is ineffective. An explicit deny is required to override other allows.

How to eliminate wrong answers

Option B is wrong because attaching a policy to an IAM group is not required for it to take effect; policies attached directly to a user are fully evaluated and do not need group attachment to work. Option C is wrong because an explicit deny statement is not needed; IAM policies are deny-by-default, so an allow with a condition that fails results in an implicit deny, but the condition keys are unsupported, so the condition is ignored and the allow applies broadly. Option D is wrong because the condition key issue is not about the operator (StringEquals vs StringLike); even if StringLike were used, the unsupported condition keys would still be ignored, so the policy would still not restrict the launch.

Practice this question →
33
MCQmedium

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all IAM users in the production account must use multi-factor authentication (MFA) to access the AWS Management Console. Which combination of actions should the security team take to enforce this requirement?

A.Use an SCP to deny access to the AWS Management Console unless MFA is present. Attach the SCP to the production OU.
B.Disable password-based access for all IAM users and require federation with an identity provider that enforces MFA.
C.Enable MFA on the root user and apply a password policy that requires MFA.
D.Create an IAM policy that denies all console actions unless MFA is present. Attach the policy to the IAM group that contains all production users.
AnswerD

After an IAM user signs in to the console with only a password, the resulting temporary credentials have aws:MultiFactorAuthPresent set to false. An explicit deny policy using that condition key will block every console action, forcing the user to either re-authenticate with MFA or call STS GetSessionToken with MFA to obtain valid credentials. This effectively enforces MFA for all console access and directly satisfies the stated requirement for production users.

Why this answer

An IAM policy with a condition that denies all console actions unless MFA is present can be attached to an IAM group containing all production users. This enforces MFA at the user level within the account, directly meeting the requirement to ensure all IAM users in the production account must use MFA to access the AWS Management Console.

Exam trap

The trap here is that candidates often confuse SCPs with IAM policies, thinking SCPs can enforce MFA for console access within an account, but SCPs apply at the organizational level and cannot target specific IAM users or groups within an account.

How to eliminate wrong answers

Option A is wrong because SCPs cannot deny access to the AWS Management Console specifically; they deny actions on AWS resources, and the condition for MFA in an SCP would apply to all accounts in the OU, not just the production account's IAM users. Option B is wrong because disabling password-based access and requiring federation with an identity provider that enforces MFA is a valid approach but not listed as a combination of actions that the security team can take directly within the production account; it requires external setup and does not enforce MFA for existing IAM users. Option C is wrong because enabling MFA on the root user and applying a password policy that requires MFA does not enforce MFA for all IAM users; the root user MFA is separate, and password policies cannot enforce MFA for console access.

Practice this question →
34
MCQhard

Refer to the exhibit. A security engineer runs the IAM Policy Simulator with the provided policy input. The result shows 'explicitDeny' for ec2:RunInstances even though the policy only contains an Allow. What is the most likely reason?

A.The user has an attached policy or SCP that explicitly denies ec2:RunInstances.
B.The policy input has a syntax error.
C.The simulate-custom-policy command does not support ec2:RunInstances.
D.The resource ARN is incorrect for ec2:RunInstances.
AnswerA

Explicit deny overrides Allow; other policies may be causing the deny.

Why this answer

The most likely reason is that the user has another policy attached (such as an identity-based policy or a service control policy) that explicitly denies ec2:RunInstances. The IAM Policy Simulator evaluates all applicable policies, so even if the provided policy only contains an Allow, an explicit deny from another policy overrides and results in an explicitDeny. Option B (syntax error) is not likely because a syntax error typically causes an error or implicit deny, not an explicit deny.

Option C is incorrect because the simulate-custom-policy command does support ec2:RunInstances. Option D is incorrect because an incorrect resource ARN would result in an implicit deny, not an explicit deny.

Practice this question →
35
MCQhard

Refer to the exhibit. An IAM user has this policy attached. The user tries to download an object from the S3 bucket using the AWS CLI from an on-premises server with IP address 198.51.100.50. What will happen?

A.The request will succeed because the policy allows s3:GetObject.
B.The request will fail because the user must use HTTPS.
C.The request will fail because the user's IP is not in the allowed range.
D.The request will fail because the user must use MFA.
AnswerC

The condition restricts to 192.0.2.0/24.

Why this answer

The policy includes a condition that restricts access to only requests originating from a specific IP address range. Since the user's on-premises server IP (198.51.100.50) is not within that allowed range, the request will be denied. Option A is incorrect because the policy does not grant unconditional access; the condition overrides the Allow effect.

Option B is incorrect because the policy does not require HTTPS; it only checks the source IP. Option D is incorrect because there is no MFA condition in the policy.

Practice this question →
36
MCQeasy

A company wants to allow an IAM user to manage only their own password in the AWS Management Console. Which IAM policy action should be used?

A.iam:ChangePassword
B.iam:ListUsers
C.iam:CreateAccessKey
D.iam:DeactivateMFADevice
AnswerA

Allows the user to change their own password.

Why this answer

The correct IAM policy action to allow a user to manage only their own password is iam:ChangePassword. This action enables the user to change their password in the AWS Management Console. Option A is correct.

Option B (iam:ListUsers) is used to list IAM users, not relevant to password management. Option C (iam:CreateAccessKey) creates access keys, which is unrelated. Option D (iam:DeactivateMFADevice) deactivates MFA devices, also not relevant.

Therefore, only iam:ChangePassword is appropriate.

Practice this question →
37
Multi-Selecteasy

A company wants to grant an IAM user the ability to manage (create and update) their own access keys. Which TWO IAM actions must be allowed in the policy?

Select 2 answers
A.iam:UpdateAccessKey
B.iam:CreateAccessKey
C.iam:GetAccessKeyLastUsed
D.iam:DeleteAccessKey
E.iam:ListAccessKeys
AnswersA, B

Allows activation and deactivation of access keys; required for update.

Why this answer

To allow a user to manage (create and update) their own access keys, the policy must include iam:CreateAccessKey and iam:UpdateAccessKey. These actions enable the user to generate new keys and activate/deactivate them. iam:DeleteAccessKey is not required for this specific scope.

Practice this question →
38
MCQhard

A company uses an IAM role to allow an EC2 instance to access an S3 bucket. The role has an attached policy that grants s3:GetObject on the bucket. However, the application on the EC2 instance is unable to read objects. What is the MOST likely cause?

A.The S3 bucket policy denies access to the IAM role.
B.The EC2 instance does not have an IAM instance profile configured.
C.The policy is attached to the EC2 instance instead of the role.
D.The EC2 instance is not running the latest user data script.
AnswerB

Without an instance profile, the role credentials are not available to the instance.

Why this answer

For an IAM role to be used by an EC2 instance, the role must be associated with an instance profile, and that profile must be attached to the instance. Without the instance profile, the instance cannot assume the role, so the application lacks the necessary permissions to read from S3. Option A is incorrect because the bucket policy denying access would be a possible cause, but it is not the most likely given that the role already has the s3:GetObject permission.

Option C is incorrect because policies are attached to roles, not instances directly. Option D is incorrect because the user data script does not affect IAM permissions.

Practice this question →
39
MCQmedium

An organization is using IAM roles for EC2 instances. The security team needs to ensure that each EC2 instance can only assume a specific role based on tags. Which feature should be used?

A.Service Control Policy (SCP)
B.IAM policy with 'aws:SourceIp' condition
C.IAM permissions boundary
D.Role trust policy with 'aws:ResourceTag' condition
AnswerD

The trust policy can use tags to restrict which EC2 instances can assume the role.

Why this answer

The role trust policy can use the 'aws:ResourceTag' condition key to restrict which EC2 instances can assume the role based on the instance's tags. This ensures that only instances with specific tags (e.g., 'Environment=Production') are allowed to assume the IAM role, meeting the security team's requirement for tag-based role assumption.

Exam trap

The trap here is that candidates often confuse IAM permissions boundaries (which limit permissions) with trust policies (which control who can assume a role), leading them to select Option C instead of the correct trust policy condition.

How to eliminate wrong answers

Option A is wrong because Service Control Policies (SCPs) are used to set permission boundaries across accounts in an AWS Organization, not to control role assumption based on EC2 instance tags. Option B is wrong because 'aws:SourceIp' condition restricts access based on the source IP address, not on EC2 instance tags, and is irrelevant for instance-based role assumption. Option C is wrong because IAM permissions boundaries define the maximum permissions a role or user can have, but they do not control which EC2 instances can assume a role based on tags.

Practice this question →
40
MCQhard

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all IAM users in member accounts must have a password policy that requires a minimum length of 14 characters. How can this be achieved centrally?

A.Use a service control policy (SCP) to enforce the password policy across all accounts.
B.Use IAM permission boundaries to restrict password policy changes to specific Regions.
C.Use AWS Config rules to automatically remediate non-compliant password policies.
D.Use an SCP that denies the UpdateAccountPasswordPolicy action unless the policy has MinimumPasswordLength >= 14.
AnswerD

SCPs can deny API calls that don't meet conditions.

Why this answer

A service control policy (SCP) can deny the UpdateAccountPasswordPolicy action if the password policy does not have MinimumPasswordLength >= 14. Option A is incorrect because SCPs cannot set password policies; they only allow or deny actions. Option B is incorrect because IAM permission boundaries do not apply to password policy changes, and IAM is a global service.

Option C is incorrect because AWS Config rules can detect non-compliance but cannot enforce the policy; remediation requires additional steps and is not a centralized enforcement method.

Practice this question →
41
Multi-Selecteasy

A developer wants to allow an IAM role to be assumed by an EC2 instance that is part of an Auto Scaling group. Which TWO AWS services or features are required? (Choose TWO.)

Select 2 answers
A.AWS Config
B.Instance profile
C.IAM role
D.AWS CloudFormation
E.AWS Single Sign-On (SSO)
AnswersB, C

The instance profile is the container for the role that can be attached to EC2 instances.

Why this answer

An instance profile is required to attach an IAM role to an EC2 instance. When an EC2 instance is launched with an instance profile, the AWS credentials provider on the instance can retrieve temporary security credentials from the IAM role via the instance metadata service (IMDS). This allows the instance to assume the role and perform authorized API actions without embedding long-term credentials.

Exam trap

The trap here is that candidates often confuse IAM roles with instance profiles, thinking a role can be directly attached to an EC2 instance, but the instance profile is the required intermediary container that enables the role to be assumed by the instance.

Practice this question →
42
MCQmedium

A security engineer is troubleshooting an issue where an IAM role used by an EC2 instance cannot access an S3 bucket, even though the role has an attached policy that grants s3:GetObject on the bucket. The bucket policy does not explicitly deny access. What is the most likely cause?

A.A service control policy (SCP) is denying access
B.The bucket policy does not grant access to the IAM role
C.The IAM policy is attached to the user instead of the role
D.The bucket has an explicit deny in its policy
AnswerB

When using an IAM role, the bucket policy must explicitly allow the role, otherwise the implicit denial applies.

Why this answer

The bucket policy does not grant access to the IAM role. For an IAM role used by an EC2 instance to access an S3 bucket, both the IAM policy attached to the role and the bucket policy must allow the action. Even though the IAM policy grants s3:GetObject, the bucket policy must also explicitly grant access to the role principal.

Since the bucket policy does not explicitly deny access (option D is false), the lack of an explicit allow in the bucket policy is the most likely cause. Options A and C are incorrect: SCPs would deny at the organization level, and the IAM policy is attached to the role, not the user.

Practice this question →
43
MCQmedium

A company has an S3 bucket that contains sensitive data. The security team wants to ensure that all objects uploaded to the bucket are encrypted at rest using server-side encryption with AWS KMS (SSE-KMS). What should the security team do to enforce this requirement?

A.Use an S3 bucket policy that requires the x-amz-server-side-encryption-aws-kms-key-id header to match a specific KMS key.
B.Use an S3 bucket policy with a condition that requires the x-amz-server-side-encryption header to be present.
C.Configure the bucket's default encryption to use SSE-KMS.
D.Use an S3 bucket policy with a condition that denies PutObject if the x-amz-server-side-encryption header is not set to 'aws:kms'.
AnswerD

This policy denies uploads that do not use SSE-KMS, effectively enforcing the requirement.

Why this answer

An S3 bucket policy with a condition that denies PutObject requests unless the x-amz-server-side-encryption header is set to 'aws:kms' ensures that only objects encrypted with SSE-KMS can be uploaded. Option A is incorrect because requiring a specific KMS key ID is not necessary; the policy should enforce the use of SSE-KMS, not a specific key. Option B is incorrect because requiring the header to be present does not enforce SSE-KMS; it could be 'AES256' for SSE-S3.

Option C is incorrect because default encryption only encrypts objects that lack encryption headers; it does not prevent uploads that specify SSE-S3 or no encryption.

Practice this question →
44
MCQhard

A security engineer needs to design an IAM policy that allows an IAM user to launch EC2 instances only if they specify a specific security group ID (sg-12345) and a specific instance type (t2.micro). Which policy achieves this?

A.{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "arn:aws:ec2:*:*:security-group/sg-12345", "Condition": { "StringEquals": { "ec2:InstanceType": "t2.micro" } } } ] }
B.{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "*", "Condition": { "StringEquals": { "ec2:InstanceType": "t2.micro", "aws:RequestTag/security-group": "sg-12345" } } } ] }
C.{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "*", "Condition": { "StringEquals": { "ec2:InstanceType": "t2.micro" } } } ] }
D.{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "*", "Condition": { "StringEquals": { "ec2:InstanceType": "t2.micro", "ec2:SecurityGroup": "sg-12345" } } } ] }
AnswerD

Correctly restricts both instance type and security group.

Why this answer

It uses the condition keys 'ec2:InstanceType' and 'ec2:SecurityGroup' to restrict the RunInstances action to only allow launching t2.micro instances into the security group sg-12345. Option A incorrectly specifies the security group as a resource ARN, but security groups cannot be specified as resources in RunInstances; they are specified via condition keys. Option B uses 'aws:RequestTag/security-group' which is not a valid condition key for security groups; security groups are identified by 'ec2:SecurityGroup'.

Option C only restricts instance type but does not restrict the security group. Therefore, only D correctly enforces both constraints.

Practice this question →
45
MCQmedium

Refer to the exhibit. An IAM policy is attached to a group. An IAM user in that group attempts to stop an EC2 instance from IP address 198.51.100.10. What will happen?

A.The action is allowed because the first statement allows StopInstances
B.The action is allowed because the resource is '*'
C.The action is denied because the source IP does not match the allowed range
D.The action is denied only if the user is not using MFA
AnswerC

The Deny statement blocks requests from IPs not in the allowed range.

Why this answer

The IAM policy includes a `Deny` statement with a `NotIpAddress` condition that restricts all actions (including `StopInstances`) to the IP range `10.0.0.0/8`. Since the user's source IP is `198.51.100.10`, which falls outside this range, the deny statement explicitly blocks the action. In IAM, an explicit deny always overrides any allow, so the request is denied regardless of the allow statement in the first policy block.

Exam trap

The trap here is that candidates assume the allow statement with `Effect: Allow` and `Action: ec2:StopInstances` will grant permission, forgetting that an explicit deny with a condition that does not match the request context takes precedence over any allow.

How to eliminate wrong answers

Option A is wrong because the explicit deny statement with the `NotIpAddress` condition overrides the allow statement; IAM evaluates deny before allow, and an explicit deny cannot be bypassed by a separate allow. Option B is wrong because while the resource is `*`, the deny statement applies to all resources and actions, and the condition key `aws:SourceIp` is evaluated against the source IP, not the resource ARN. Option D is wrong because the policy does not include any condition requiring MFA (`aws:MultiFactorAuthPresent`); the denial is based solely on the source IP mismatch.

Practice this question →
46
MCQmedium

Refer to the exhibit. A security engineer runs the 'simulate-custom-policy' command to test a policy. The output shows 'explicitDeny' for ec2:RunInstances. What is the most likely reason?

A.The policy does not include ec2:RunInstances in the Action list
B.The policy includes an explicit Deny statement for ec2:RunInstances
C.The policy allows ec2:Describe* but the action ec2:RunInstances is not a Describe action
D.The policy uses a Resource of '*' which does not include the required resources
AnswerB

The 'explicitDeny' result directly corresponds to an explicit Deny statement in the policy that denies ec2:RunInstances.

Why this answer

The 'simulate-custom-policy' output shows 'explicitDeny', which indicates that the policy contains an explicit Deny statement for the action ec2:RunInstances. An explicitDeny is only returned when a Deny statement matches the action, not when the action is simply missing from an Allow list. Therefore, the most likely reason is that the policy includes an explicit Deny statement.

Exam trap

A common trap is confusing 'explicitDeny' with 'implicitDeny'. An explicitDeny only occurs when an actual Deny statement in the policy or identity-based policy denies the action. A missing allow leads to an implicitDeny, not explicitDeny.

Practice this question →

Ready to test yourself?

Try a timed practice session using only IAM questions.

Start 20-question session