AWS - Certified Solutions Architect IAM Policies and User Roles Questions and Answers

Question 1

A company runs an application on an Amazon EC2 instance that needs to access objects in an Amazon S3 bucket.
To adhere to security best practices, how should the Solutions Architect grant the necessary permissions?

Accepted Answer

Create an IAM role with the necessary S3 permissions and attach it to the EC2 instance profile.

Answer

Create an IAM user with S3 access permissions and store the access keys securely on the EC2 instance.

Answer

Generate a pre-signed URL for each object in the S3 bucket and embed them in the application code.

Answer

Configure the S3 bucket policy to allow public read access for the EC2 instance's public IP address.

Question 2

A developer is part of an IAM group that has an attached policy allowing `s3:GetObject` on a specific S3 bucket. The bucket also has a resource-based policy. In which of the following scenarios would the developer be DENIED access to an object in the bucket?

Accepted Answer

The resource-based policy contains a statement with `"Effect": "Deny"` for the developer's user ARN and the `s3:GetObject` action.

Answer

The resource-based policy explicitly allows the developer's IAM user ARN for the `s3:GetObject` action.

Answer

The resource-based policy does not mention the developer's account but allows access from a trusted AWS Organization.

Answer

The identity-based policy attached to the developer's group is the only policy in effect.

Question 3

A company has two AWS accounts: Account A for development and Account B for production resources, including a critical Amazon S3 bucket. A Solutions Architect needs to allow an IAM user in Account A to have read-only access to the S3 bucket in Account B. What is the most secure and scalable way to achieve this?

Accepted Answer

In Account B, create an IAM role with read-only permissions to the S3 bucket. The role's trust policy should specify Account A as the trusted principal.

Answer

Create an IAM user in Account B with read-only permissions to the S3 bucket and share the access keys with the developer in Account A.

Answer

Make the S3 bucket in Account B public and provide the bucket name to the developer in Account A.

Answer

Configure cross-origin resource sharing (CORS) on the S3 bucket in Account B to allow GET requests from Account A.

Question 4

Which of the following policy types is attached directly to a resource, such as an S3 bucket or an SQS queue, and specifies which principals are allowed or denied access?

Accepted Answer

Resource-based policy

Answer

Identity-based policy

Answer

Permissions boundary

Answer

Service control policy (SCP)

Question 5

An organization wants to enforce a rule that no developer, regardless of their other IAM permissions, can terminate production EC2 instances. Which IAM feature should be used to set the maximum permissions that an identity-based policy can grant to a user or role?

Accepted Answer

Permissions Boundary

Answer

IAM Group

Answer

IAM Role Trust Policy

Answer

Service Control Policy (SCP)

Question 6

What is the primary purpose of an IAM Role in AWS?

Accepted Answer

To provide a way to grant temporary access to AWS resources without using long-term credentials.

Answer

To organize multiple IAM users into a single manageable unit.

Answer

To define a set of permissions in a JSON document.

Answer

To enforce a strict password policy for all IAM users in an account.

A company runs an application on an Amazon EC2 instance that needs to access objects in an Amazon S3 bucket.To adhere to security best practices, how should the Solutions Architect grant the necessary permissions?

A company runs an application on an Amazon EC2 instance that needs to access objects in an Amazon S3 bucket.
To adhere to security best practices, how should the Solutions Architect grant the necessary permissions?