CCNA IAM Questions

s3:ListBucket requires resource ARN 'arn:aws:s3:::my-bucket' (without /*). The policy only grants access to objects, not the bucket itself. Option A is incorrect because the action is not allowed.

Option C is incorrect because the resource is wrong. Option D is incorrect because service control policies are not mentioned.

Option D is correct because the Deny statement applies to all actions if MFA is not present, so the AssumeRole action is denied. Option A is incorrect because the Allow statement is overridden by the Deny. Option B is incorrect because the Deny is explicit.

Option C is incorrect because the Deny applies to all actions including AssumeRole.

Option A is correct because AWS CloudTrail logs all IAM API calls, enabling detection of user creation and policy attachment. Option B is wrong because IAM Access Analyzer focuses on resource policies, not user actions. Option C is wrong because AWS Config rules evaluate resource configurations, not API calls.

Option D is wrong because S3 server access logs track object-level access, not IAM actions.

Option C is correct because IAM:UpdateAccessKey is used to manage a user's own access keys. Option A is wrong because IAM:CreateAccessKey creates a new key, but rotation involves updating. Option B is wrong because IAM:ChangePassword is for password.

Option D is wrong because IAM:DeleteAccessKey deletes a key.

D: Correct – The SCP should deny s3:CreateBucket if the request does not include the x-amz-server-side-encryption-aws-kms-key-id header. This prevents creation of unencrypted buckets. A: Incorrect – CloudTrail is already logging; additional logging does not prevent the action.

B: Incorrect – IAM permissions boundary does not override SCP; the SCP should already prevent the action, but it was not effective because the SCP did not deny s3:CreateBucket without encryption. C: Incorrect – S3 Block Public Access does not enforce encryption.

Option C is correct because a service control policy (SCP) can deny changes to the password policy that don't meet the requirement. Option A is wrong because SCPs cannot set password policies; they can only deny actions. Option B is wrong because AWS Config can detect non-compliance but cannot enforce.

Option D is wrong because IAM is a global service and cannot be restricted to a specific Region.

Option D is correct because the trust policy allows the root user of account 123456789012 to assume the role only if MFA is present. Option A is wrong because it requires MFA. Option B is wrong because it allows the root user, not all users.

Option C is wrong because it allows the root user, not specific users.

Options B and D are correct. B: An AWS managed policy is a standalone policy that can be attached to IAM identities. D: An inline policy is embedded directly in a user, group, or role.

Option A is wrong because a bucket policy is a resource-based policy, not identity-based. Option C is wrong because an SCP is a policy used in AWS Organizations, not an identity-based policy. Option E is wrong because a trust policy is attached to a role to define who can assume it, not an identity-based policy.

Option B is correct because a service control policy (SCP) can be applied to all accounts to deny access if MFA is not present. Option A is incorrect because IAM policies in individual accounts can be overridden by account administrators. Option C is incorrect because an SCP cannot directly enable MFA; it can only deny access.

Option D is incorrect because while AWS CloudTrail can log, it does not enforce.

Option A is correct because an explicit deny in a separate policy, such as a service control policy (SCP) or a permissions boundary, overrides any allow. Option B is wrong because the user's own policy is an allow. Option C is wrong because S3 bucket policies are resource-based and can deny access.

Option D is wrong because IAM policies are evaluated as a whole; there is no implicit deny for specific buckets unless a deny exists.

Options A, B, and D are correct. Create a role with permissions to launch instances (A), attach a policy that restricts the subnet via a condition (B), and assign the role to the developers (D). Option C is wrong because a VPC endpoint does not grant IAM permissions.

Option E is wrong because security groups control network traffic, not IAM permissions.

Option B is correct because iam:PassRole allows passing a role to an AWS service, which could lead to privilege escalation if the role has more permissions than intended. Option A is wrong because it's not about changing policies. Option C is wrong because it's not about creating users.

Option D is wrong because it's not about deleting roles.

Option D is correct because for cross-account access or access from EC2, the bucket policy must explicitly grant access to the role. Option A is incorrect because explicit deny is not present. Option B is incorrect because the policy is attached to the role, not the user.

Option C is incorrect because service control policies (SCPs) are not mentioned and would be an organization-level deny.

Option A is correct because the S3 bucket policy must explicitly grant access to the IAM user ARN, not just the account. Option B is wrong because explicit deny in the IAM policy would be unusual. Option C is wrong because S3 does not require VPC endpoints.

Option D is wrong because the user is in the same account as the policy.

Option B is correct. The command lists the managed policies attached to a role named 'MyRole'. Option A is wrong because it lists attached policies, not inline policies.

Option C is wrong because it lists the policies attached to a role, not a user. Option D is wrong because it lists attached policies, not all policies in the account.

Option C is correct because IAM password policies allow enforcing complexity, length, and rotation. Option A is wrong because AWS KMS is for encryption keys. Option B is wrong because AWS Organizations is for managing multiple accounts.

Option D is wrong because AWS CloudTrail is for logging.

Option C is correct because an S3 bucket policy denying PutObject requests that do not include the x-amz-server-side-encryption header set to aws:kms ensures that only objects encrypted with SSE-KMS can be uploaded. Option A is wrong because bucket policies cannot enforce default encryption; they can only deny requests based on conditions. Option B is wrong because enabling default encryption does not prevent uploads without encryption headers.

Option D is wrong because SSE-S3 is not KMS encryption.

Option B is correct because using a cross-account IAM role in the target account allows the EC2 instance to assume the role and access the bucket securely, without sharing long-term credentials. Option A is less secure and requires managing keys. Option C is not secure.

Option D is overly permissive.

Option A is correct because the policy only allows s3:ListBucket, which lists the bucket itself, not its objects. s3:ListObjects is required to list objects. Option B is wrong because s3:GetObject is for reading objects. Option C is wrong because s3:PutObject is for uploading.

Option D is wrong because the role can assume.

Option C is correct because SCPs do not affect the management account of the organization. If the member account is actually the management account, the SCP does not apply. Option A is incorrect because SCPs are not affected by service control policies at the account level (they are the same).

Option B is incorrect because SCPs do not require explicit allow; they work by denying. Option D is incorrect because SCPs apply to all users and roles, including root user, unless explicitly exempted.

The correct answers are A, B, and D. IAM roles are global and not region-specific, can be assumed by AWS services, and can be used by federated users. Option C is wrong because roles cannot be attached to IAM users directly; users assume roles.

Option E is wrong because roles can be used by cross-account access.

Option D is correct because the policy grants access only when the condition is met (SSE-KMS). Since the object is not encrypted with SSE-KMS, the condition fails, and the request is denied by default (implicit deny). Option A is incorrect because the policy does not have an explicit deny.

Option B is incorrect because the condition must be met. Option C is incorrect because the condition is evaluated.

Option C is correct because it allows the user to change their own password. Option A is wrong because it allows any user to change any password. Option B is wrong because it allows listing users.

Option D is wrong because it denies password change.

Option A is correct because the IAM role in the target account must have a trust policy that allows the pipeline account to assume it. Option D is correct because the pipeline (using AWS CodeBuild or similar) must call STS AssumeRole with the role ARN. Option B is wrong because CloudFormation itself does not assume roles for stack operations; the entity calling CloudFormation assumes the role.

Option C is wrong because the pipeline's role does not need a trust policy for the target account. Option E is wrong because cross-account role assumption does not require root user credentials.

Option B is correct because it uses condition keys ec2:InstanceType and ec2:SecurityGroup to restrict the RunInstances action. Option A does not restrict instance type. Option C uses the wrong condition key for security group.

Option D uses RequestTag but security group is not a tag.

Option A is correct because it grants s3:ListBucket on the specific bucket without allowing other actions. Option B is wrong because it allows all S3 actions. Option C is wrong because it grants GetObject instead of ListBucket.

Option D is wrong because it uses a condition that is not required for listing.

Option A is correct because IAM access key last used information can be monitored by AWS Config to trigger automatic rotation. Option B is wrong because CloudTrail logs API calls but does not rotate keys. Option C is wrong because Lambda can be used but needs to be triggered by something like Config.

Option D is wrong because SCPs do not rotate keys.

Option A is correct. The trust policy must allow the specific IAM entity (user or role) or the entire account. If the trust policy allows the account, it should work.

But if the trust policy requires an external ID and the developer does not provide it, the assumption will fail. Option B is wrong because the developer's policy allows the action. Option C is wrong because the role exists.

Option D is wrong because the developer is not using MFA unless required.

Option C is correct because the condition restricts kms:ViaService to S3 in us-east-1. Since the request is made directly to KMS API, the condition is not met, resulting in implicit deny. Option A is incorrect because the condition is not satisfied.

Option B is incorrect because the policy is valid. Option D is incorrect because the condition is not about the principal.

Option B is correct because even though the Lambda execution role has the necessary permissions, the DynamoDB table might have a resource-based policy that explicitly denies access to the Lambda execution role. Option A is incorrect because the policy does not need the dynamodb:Scan action for GetItem. Option C is incorrect because VPC endpoints do not affect IAM permissions; they affect network connectivity.

Option D is incorrect because DynamoDB uses a resource-based policy, not an identity-based policy on the table.

Option C is correct because IAMUserChangePassword is the action for changing passwords, and UpdateAccessKey is for managing access keys. Option A is for group management. Option B is for creating users.

Option D is for login profile deletion.

Options A, C, and E are correct. Option A is correct because SCPs can deny the UpdateAccountPasswordPolicy action. Option C is correct because the SCP must be attached to the organization root or OUs to apply to all accounts.

Option E is correct because the SCP should use a condition to check MinimumPasswordLength. Option B is wrong because SCPs cannot set the policy directly. Option D is wrong because IAM is a global service and cannot be restricted to a Region.

Option B is correct. It creates separate policies for S3 and RDS, restricts S3 to the specific bucket and prefix, and restricts RDS to the specific resource and enforces SSL. Option A is wrong because using an IAM user and storing credentials on EC2 is insecure.

Option C is wrong because using a single policy with wildcards is still overly permissive and does not enforce SSL. Option D is wrong because resource-based policies on the S3 bucket and RDS instance would not be sufficient without the IAM role permissions; also, S3 bucket policies are not the primary method for granting EC2 access.

Option C is correct because the user must be assigned to the account in IAM Identity Center with a permission set to see and access the account. Option A is wrong because the user can log in, so the identity source is fine. Option B is wrong because the permission set defines the access level, but the user must be assigned to the account first.

Option D is wrong because the user is already authenticated via SSO.

Option B is correct because a Service Control Policy (SCP) can be applied at the organization level to deny actions across all member accounts. Option A is an IAM policy that applies only to specific users. Option C is for permissions boundaries, but it's per-user and not automatically enforced.

Option D is for resource-based policies.

Option A is correct because the policy only allows Describe actions, and RunInstances is not allowed, resulting in an explicit deny from the simulation. Option B is incorrect because the policy does not deny. Option C is incorrect because the policy allows Describe* but not RunInstances.

Option D is incorrect because there is no resource restriction.

Option A is correct: the user in the production account must have an IAM policy that allows sts:AssumeRole targeting the development account role ARN. Option B is wrong because the trust policy is already set. Option C is wrong because the role must be created in the development account.

Option D is wrong because the trust policy should reference the production account.

Option D is correct. For cross-account access, the IAM role in Account B must have an IAM policy that allows the action (s3:GetObject) on the target bucket. Even if the bucket policy grants access, the role itself must also allow the action.

Option A is wrong because the bucket policy uses the correct principal format. Option B is wrong because S3 does not require KMS for access unless encryption is involved. Option C is wrong because the bucket policy allows all principals in the role, not just specific users.

Option A is correct because an SCP can deny console access for all users across all accounts. Option B is wrong because it only applies to the root user. Option C is wrong because IAM policies are per-account and can be overridden by administrators.

Option D is wrong because password policies do not prevent console access if the user has a password.

Option B is correct. The trust policy allows EC2 to assume the role, but if the instance does not have the correct instance profile, it cannot assume the role. The error suggests the role is not being used.

Option A is incorrect because the trust policy is fine. Option C is not the cause. Option D is not relevant.

Option A is correct because cross-account access requires a trust policy in the target account's role that allows the source account to assume it, and a permissions policy that grants the necessary actions. Option B is wrong because resource-based policies are not used for role assumption. Option C is wrong because IAM users from the source account need a policy to call AssumeRole, but the trust policy is the key.

Option D is wrong because the trust policy goes on the role, not the IAM group.

Option A is correct because using a VPC endpoint for DynamoDB keeps traffic within the AWS network and avoids the public internet, while the execution role grants permissions via IAM. Option B requires internet access, which is not available. Option C is less secure as resource-based policies are not needed if the Lambda role has permissions.

Option D is for API Gateway, not DynamoDB.

Option A is correct: use a VPC endpoint and the aws:SourceVpce condition. Option B is wrong because aws:SourceIp is not effective for VPC traffic from S3. Option C is wrong because the condition is on the bucket policy, not the role policy.

Option D is wrong because allowing only specific instances is not granular.

Option B is correct because attaching an IAM role with the required permissions to the Lambda function is the standard and secure method. Option A is wrong because embedding credentials in code is insecure. Option C is wrong because resource-based policies are used for cross-account access, not for Lambda to CloudWatch.

Option D is wrong because using the root user is insecure and unnecessary.