AWS Certified Solutions Architect IAM Policies and User Roles 2

Question 1

Which IAM policy element is evaluated FIRST when AWS determines whether to allow or deny a request?

Accepted Answer

Explicit deny in any policy

Answer

Allow statements in identity-based policies

Answer

Service control policies (SCPs)

Answer

Resource-based policies

Question 2

A company wants to grant an EC2 instance access to S3 without embedding credentials. What is the recommended approach?

Accepted Answer

Attach an IAM role to the EC2 instance

Answer

Store IAM user credentials in the instance user data

Answer

Create an S3 bucket policy referencing the instance IP

Answer

Use environment variables to store the access key

Question 3

What does the IAM policy condition key 'aws:RequestedRegion' allow you to do?

Accepted Answer

Restrict actions to specific AWS regions

Answer

Allow access only from a specific VPC

Answer

Enforce MFA on specific regional endpoints

Answer

Tag resources in specific regions only

Question 4

Which type of IAM policy is attached directly to AWS resources such as S3 buckets and KMS keys?

Accepted Answer

Resource-based policy

Answer

Identity-based policy

Answer

Permission boundary

Answer

Session policy

Question 5

An IAM user in Account A needs to access resources in Account B. What must be configured in Account B?

Accepted Answer

A cross-account IAM role with a trust policy allowing Account A

Answer

An IAM user with the same username as Account A's user

Answer

An S3 bucket policy referencing Account A's ARN only

Answer

A VPC peering connection between both accounts

Question 6

What is the purpose of an IAM permissions boundary?

Accepted Answer

It sets the maximum permissions an IAM entity can have regardless of other policies

Answer

It grants additional permissions beyond what the identity-based policy allows

Answer

It replaces SCPs in AWS Organizations

Answer

It restricts access to specific VPC endpoints

Question 7

Which IAM feature allows you to test the effect of IAM policies before applying them in production?

Accepted Answer

IAM Policy Simulator

Answer

IAM Access Analyzer

Answer

AWS Config Rules

Answer

AWS Trusted Advisor