AWS Certified Solutions Architect IAM Policies and User Roles 2 — Questions and Answers
Question 1: Which IAM policy element is evaluated FIRST when AWS determines whether to allow or deny a request?
- Allow statements in identity-based policies
- Explicit deny in any policy (Correct answer)
- Service control policies (SCPs)
- Resource-based policies
Correct answer: Explicit deny in any policy
An explicit Deny in any applicable policy always overrides any Allow, making it the highest-priority evaluation result.
Question 2: A company wants to grant an EC2 instance access to S3 without embedding credentials. What is the recommended approach?
- Store IAM user credentials in the instance user data
- Attach an IAM role to the EC2 instance (Correct answer)
- Create an S3 bucket policy referencing the instance IP
- Use environment variables to store the access key
Correct answer: Attach an IAM role to the EC2 instance
Attaching an IAM role to an EC2 instance provides temporary credentials via the instance metadata service, eliminating the need for long-term credentials.
Question 3: What does the IAM policy condition key 'aws:RequestedRegion' allow you to do?
- Restrict actions to specific AWS regions (Correct answer)
- Allow access only from a specific VPC
- Enforce MFA on specific regional endpoints
- Tag resources in specific regions only
Correct answer: Restrict actions to specific AWS regions
The aws:RequestedRegion condition key lets you restrict which AWS regions a principal can make API calls to.
Question 4: Which type of IAM policy is attached directly to AWS resources such as S3 buckets and KMS keys?
- Identity-based policy
- Permission boundary
- Resource-based policy (Correct answer)
- Session policy
Correct answer: Resource-based policy
Resource-based policies are JSON policy documents attached directly to a resource and specify who has access to that resource.
Question 5: An IAM user in Account A needs to access resources in Account B. What must be configured in Account B?
- An IAM user with the same username as Account A's user
- A cross-account IAM role with a trust policy allowing Account A (Correct answer)
- An S3 bucket policy referencing Account A's ARN only
- A VPC peering connection between both accounts
Correct answer: A cross-account IAM role with a trust policy allowing Account A
Cross-account access requires an IAM role in Account B with a trust policy that allows principals from Account A to assume it.
Question 6: What is the purpose of an IAM permissions boundary?
- It grants additional permissions beyond what the identity-based policy allows
- It sets the maximum permissions an IAM entity can have regardless of other policies (Correct answer)
- It replaces SCPs in AWS Organizations
- It restricts access to specific VPC endpoints
Correct answer: It sets the maximum permissions an IAM entity can have regardless of other policies
A permissions boundary is a managed policy that sets the maximum permissions an identity-based policy can grant to an IAM entity.
Question 7: Which IAM feature allows you to test the effect of IAM policies before applying them in production?
- IAM Access Analyzer
- IAM Policy Simulator (Correct answer)
- AWS Config Rules
- AWS Trusted Advisor
Correct answer: IAM Policy Simulator
The IAM Policy Simulator lets you test and troubleshoot identity-based and resource-based policies to understand what actions are allowed or denied.
AWS Certified Solutions Architect IAM Policies and User Roles 2
Which IAM policy element is evaluated FIRST when AWS determines whether to allow or deny a request?