Question 1 / 25
What does AWS STS (Security Token Service) primarily provide?
- A.Long-term IAM access keys.
- B.Temporary, limited-privilege security credentials for AWS users or services.✓ Correct
- C.Permanent S3 access tokens.
- D.MFA hardware devices.
ExplanationAWS STS issues temporary, time-limited credentials (typically 15 minutes to 36 hours). Used when assuming roles, federation, or generating short-lived API access.
Question 2 / 25
Which AWS service is BEST for managing user authentication for web/mobile applications, including sign-up, sign-in, and social identity providers?
- A.Amazon Cognito✓ Correct
- B.AWS IAM Identity Center
- C.AWS Directory Service
- D.AWS STS
ExplanationAmazon Cognito provides authentication and user management for web/mobile apps — user pools (sign-up/sign-in) and identity pools (federated identity for AWS access). Supports social login (Google, Facebook, Apple), SAML, OIDC.
Question 3 / 25
What is the difference between Cognito User Pools and Identity Pools?
- A.They are identical.
- B.User Pools handle authentication (sign-in/sign-up); Identity Pools provide AWS credentials to authenticated users (federated identities for accessing AWS resources).✓ Correct
- C.Identity Pools are deprecated.
- D.User Pools are only for B2B.
ExplanationCognito User Pools = user directory for sign-up/sign-in (returns JWT tokens). Cognito Identity Pools = exchange JWT/social/SAML tokens for temporary AWS credentials (so the app can call AWS services).
Question 4 / 25
Which AWS service provides a managed Microsoft Active Directory in the cloud?
- A.AWS Directory Service for Microsoft AD (AWS Managed Microsoft AD)✓ Correct
- B.AWS IAM
- C.Amazon Cognito
- D.AWS STS
ExplanationAWS Managed Microsoft AD is a fully managed AD service built on actual Microsoft AD. Supports trusts with on-prem AD, can be used by Windows EC2 instances, RDS for SQL Server, WorkSpaces, etc.
Question 5 / 25
Which Directory Service option is BEST for redirecting AD requests from your AWS resources to your existing on-premises AD?
- A.AWS Managed Microsoft AD
- B.AD Connector✓ Correct
- C.Simple AD
- D.Cognito
ExplanationAD Connector is a directory gateway / proxy that redirects requests to your existing on-premises AD without caching information in AWS. No on-prem replication needed.
Question 6 / 25
Which Directory Service option is a stand-alone, lightweight directory compatible with basic AD features for small (<5000 users) environments?
- A.Simple AD✓ Correct
- B.AD Connector
- C.AWS Managed Microsoft AD
- D.Cognito User Pools
ExplanationSimple AD is a lightweight, low-cost Samba-based directory compatible with most AD-aware applications. Good for small workloads. No trust support, no full MS AD features.
Question 7 / 25
What does "identity federation" mean in AWS?
- A.Creating IAM users for every external user.
- B.Allowing users authenticated by an external identity provider (corporate AD, SAML, social login) to access AWS without creating IAM users.✓ Correct
- C.Federating S3 buckets across regions.
- D.Replicating users across regions.
ExplanationIdentity federation lets external users (from Microsoft AD, SAML, OIDC, social IdPs) sign into AWS without an IAM user. They assume an IAM role via STS for temporary credentials.
Question 8 / 25
Which protocol is commonly used for enterprise SAML 2.0 federation with AWS (e.g., Active Directory Federation Services)?
- A.SAML 2.0✓ Correct
- B.OAuth 2.0
- C.Kerberos
- D.RADIUS
ExplanationEnterprise federation with AWS commonly uses SAML 2.0 (e.g., ADFS, Okta, Ping). Users authenticate to the IdP, get a SAML assertion, exchange it via STS for AWS temporary credentials.
Question 9 / 25
Which AWS service is the modern replacement for legacy AWS SSO and is recommended for managing access across multiple AWS accounts?
- A.AWS IAM Identity Center (formerly AWS SSO)✓ Correct
- B.AWS Directory Service
- C.Amazon Cognito
- D.AWS STS
ExplanationAWS IAM Identity Center (formerly AWS Single Sign-On) is the recommended way to manage workforce access across AWS accounts and SaaS apps. Integrates with AWS Organizations and external IdPs.
Question 10 / 25
Which is true about IAM roles vs. IAM users?
- A.Users and roles are the same.
- B.Users have long-term credentials and represent a single person/service; roles have no credentials and are assumed by trusted entities to get temporary credentials.✓ Correct
- C.Roles are deprecated.
- D.Users provide temporary credentials.
ExplanationIAM users have long-term credentials (password / access keys) tied to a specific identity. Roles are assumable identities — trusted entities (users, services, federated identities) call AssumeRole to get temporary credentials.
Question 11 / 25
Which AWS feature simplifies cross-account access using IAM roles?
- A.Trust policy with role assumption (sts:AssumeRole)✓ Correct
- B.Resource-based S3 bucket ACLs
- C.VPC peering
- D.Direct Connect
ExplanationCross-account access uses IAM roles with a trust policy that allows another AWS account (or specific role) to call sts:AssumeRole — getting temporary credentials in the target account.
Question 12 / 25
Which AWS service helps you analyze IAM permissions and identify resources accessible from outside your account or organization?
- A.IAM Access Analyzer✓ Correct
- B.AWS CloudTrail
- C.AWS Trusted Advisor
- D.Amazon GuardDuty
ExplanationIAM Access Analyzer analyzes resource policies (S3 buckets, IAM roles, KMS keys, Lambda, SQS, Secrets Manager) and flags resources accessible from outside your account or organization — also helps generate least-privilege policies.
Question 13 / 25
What is a permissions boundary in IAM?
- A.A safety net that defines the MAXIMUM permissions an identity-based policy can grant to a user or role.✓ Correct
- B.A type of resource policy.
- C.A region-level restriction.
- D.A type of trust policy.
ExplanationA permissions boundary is a safety net — the EFFECTIVE permissions of a user/role are the intersection of attached policies AND the boundary. Cannot exceed the boundary.
Question 14 / 25
Which AWS service provides workforce identity management (federated SSO) for ENTERPRISE / B2E use cases?
- A.AWS IAM Identity Center✓ Correct
- B.Amazon Cognito
- C.AWS STS
- D.AWS Directory Service
ExplanationAWS IAM Identity Center is for workforce / employee access (B2E). Cognito is for customer-facing applications (B2C / B2B).
Question 15 / 25
Which AWS service provides customer-facing identity management (B2C / B2B) for mobile and web apps?
- A.Amazon Cognito✓ Correct
- B.AWS IAM Identity Center
- C.AWS Directory Service
- D.AWS Managed Microsoft AD
ExplanationAmazon Cognito is for customer-facing (B2C / B2B) identity in apps. IAM Identity Center is for workforce (B2E).
Question 16 / 25
Which is the BEST description of Web Identity Federation?
- A.Allowing users authenticated by web identity providers (Google, Facebook, Amazon, Apple) to access AWS via temporary credentials.✓ Correct
- B.Federating between two AWS accounts.
- C.Replicating users across regions.
- D.A type of VPN.
ExplanationWeb Identity Federation lets users authenticate with an external web IdP (Google, Facebook, Amazon, Apple, etc.) and exchange the token via STS / Cognito Identity Pools for temporary AWS credentials.
Question 17 / 25
Which AWS feature lets you grant access to AWS resources to users from external identity providers using OpenID Connect (OIDC)?
- A.OIDC Identity Provider in IAM (with sts:AssumeRoleWithWebIdentity)✓ Correct
- B.VPC Endpoint
- C.Direct Connect
- D.AWS Macie
ExplanationIAM supports OpenID Connect identity providers — users authenticated by an OIDC IdP (e.g., GitHub Actions, Auth0) can call AssumeRoleWithWebIdentity to get AWS temporary credentials.
Question 18 / 25
Which is true about IAM roles for AWS services (e.g., EC2 instance role)?
- A.The service must be given long-term access keys.
- B.Trusted AWS services assume the role and receive temporary credentials via the instance metadata service or STS.✓ Correct
- C.Roles for services are deprecated.
- D.Only humans can assume roles.
ExplanationAWS service roles allow services like EC2, Lambda, ECS to assume an IAM role, getting temporary credentials (no long-term keys). For EC2, credentials are auto-rotated and accessible via the instance metadata service.
Question 19 / 25
What is IAM Roles Anywhere?
- A.Lets workloads outside AWS (on-prem servers, other clouds) obtain temporary AWS credentials by using X.509 certificates as their identity.✓ Correct
- B.Roles that work in all AWS regions.
- C.A free trial of IAM.
- D.A backup service for IAM users.
ExplanationIAM Roles Anywhere allows workloads outside AWS (on-prem, other clouds) to use X.509 certificates issued by your CA to obtain temporary AWS credentials — no need for long-lived access keys.
Question 20 / 25
Which AWS service is BEST for managing app secrets like database passwords, with automatic rotation?
- A.AWS Secrets Manager✓ Correct
- B.AWS Systems Manager Parameter Store
- C.AWS KMS
- D.AWS IAM
ExplanationAWS Secrets Manager stores secrets and supports automatic rotation (via Lambda). Parameter Store is also for config/secrets but lacks built-in auto-rotation.
Question 21 / 25
Which is true about IAM policies and STS in cross-account access?
- A.Each account is independent and has no interaction.
- B.The trusting account creates a role with a trust policy allowing the other account; the other account's user calls AssumeRole and gets temporary credentials.✓ Correct
- C.Users share access keys directly.
- D.Cross-account access is impossible.
ExplanationCross-account: account A creates a role whose trust policy allows account B's principals to assume it. Account B's user/role calls sts:AssumeRole, gets temporary creds, and acts in account A.
Question 22 / 25
Which Cognito feature provides social identity provider integration?
- A.Cognito Identity Pool federated identities (Facebook, Google, Apple, Twitter, Amazon, OIDC, SAML).✓ Correct
- B.Cognito User Pool only.
- C.AWS STS only.
- D.AWS IAM only.
ExplanationCognito Identity Pools support federated identities from many IdPs (social: Facebook, Google, Apple, Twitter, Amazon; enterprise: SAML / OIDC).
Question 23 / 25
Which AWS feature is recommended for granting temporary AWS access to GitHub Actions / GitLab CI workflows without using long-term keys?
- A.OIDC Identity Provider + IAM role with AssumeRoleWithWebIdentity✓ Correct
- B.Hard-coded access keys in repository secrets
- C.Sharing the root credentials
- D.Email-based authentication
ExplanationConfigure GitHub Actions (or GitLab CI) as an OIDC IdP in IAM, create a role with a trust policy allowing the OIDC provider, and the CI assumes the role for temporary credentials. No long-term keys.
Question 24 / 25
Which AWS feature allows authenticated users (via AD or social) to access an EC2 instance with their identity, without an SSH key?
- A.EC2 Instance Connect
- B.AWS Systems Manager Session Manager
- C.Both A and B can avoid SSH keys✓ Correct
- D.Manually distributing keys
ExplanationEC2 Instance Connect (browser-based SSH using IAM) and SSM Session Manager (browser/CLI shell using IAM, no inbound port) both let authenticated AWS users connect without managing SSH keys.
Question 25 / 25
Which is true about AWS STS GetSessionToken?
- A.Returns a permanent access key.
- B.Returns temporary credentials (typically including MFA-validated credentials) — used for users needing temporary elevated access.✓ Correct
- C.Returns an IAM role ARN.
- D.Deletes the user.
ExplanationGetSessionToken returns temporary credentials for an IAM user, often used to validate MFA before allowing sensitive operations. Different from AssumeRole (used to switch identities).