IAM

Following AWS best practices, how should the AWS account root user be managed?

1. A.Use the root user for all daily administrative work to keep things simple.
2. B.Enable MFA on the root user, lock away the credentials, and create separate IAM users for everyday tasks.✓ Correct
3. C.Share root user credentials with the team so everyone has full access when needed.
4. D.Delete the root user after creating an IAM user with AdministratorAccess.

Which statement about IAM Groups is correct?

1. A.Groups can contain other groups (nested groups).
2. B.An IAM user can belong to multiple groups, but groups cannot contain other groups.✓ Correct
3. C.Groups can contain both users and IAM roles.
4. D.A group must contain at least one user, otherwise it is automatically deleted.

An EC2 instance needs to read objects from an S3 bucket. What is the AWS-recommended way to grant this access?

1. A.Create an IAM user, generate an access key, and store it on the EC2 instance.
2. B.Use the AWS account root credentials in the application code.
3. C.Create an IAM role with the required S3 permissions and attach it to the EC2 instance.✓ Correct
4. D.Hard-code an access key and secret key into the application source code.

What does the principle of "Least Privilege" mean in IAM?

1. A.Granting AdministratorAccess to all users for convenience.
2. B.Granting only the permissions required to perform a task — no more, no less.✓ Correct
3. C.Granting permissions only to the root user.
4. D.Granting no permissions to anyone by default.

Which of the following are valid MFA device options supported by AWS IAM? (Select the most complete answer.)

1. A.Only hardware key fobs are supported; virtual MFA apps are not allowed.
2. B.MFA can only be enabled on the root user, not on IAM users.
3. C.Virtual MFA devices (Google Authenticator, Authy), U2F security keys (e.g., YubiKey), and hardware MFA devices (key fobs) are all supported.✓ Correct
4. D.MFA replaces the password — you no longer need to enter a password after enabling MFA.

Which statement best describes the difference between an IAM user and an IAM role?

1. A.Users and roles are identical and interchangeable.
2. B.An IAM user represents a specific person/service with long-term credentials, while an IAM role is assumed by trusted entities and provides temporary credentials.✓ Correct
3. C.Roles can only be used by AWS services, never by humans.
4. D.Users get temporary credentials, roles get permanent credentials.

In which region should you create IAM users, groups, and roles?

1. A.Only in the us-east-1 region.
2. B.In the region closest to your users.
3. C.IAM is a global service — IAM resources are not region-specific.✓ Correct
4. D.In every region you plan to use.

Which IAM policy element specifies whether the statement allows or denies access?

1. A.Action
2. B.Resource
3. C.Effect✓ Correct
4. D.Principal

What does an explicit Deny in an IAM policy do when there is also an explicit Allow for the same action?

1. A.The explicit Allow always overrides the Deny.
2. B.The explicit Deny always overrides any Allow — access is denied.✓ Correct
3. C.The most recent statement wins.
4. D.The two statements cancel out and a prompt is shown.

An auditor needs a report showing the status of all IAM users in the account, including their MFA status, password age, and access key usage. Which IAM feature should be used?

1. A.IAM Access Advisor
2. B.IAM Credentials Report✓ Correct
3. C.AWS Config
4. D.AWS CloudTrail

Which IAM tool helps you identify unused permissions on an IAM user, group, or role so you can apply Least Privilege?

1. A.IAM Access Advisor✓ Correct
2. B.IAM Credentials Report
3. C.AWS Trusted Advisor
4. D.AWS Inspector

A company wants users to log in using their existing corporate Active Directory accounts instead of creating IAM users. Which IAM concept enables this?

1. A.IAM Groups
2. B.Identity federation with IAM roles✓ Correct
3. C.Resource-based policies
4. D.Service Control Policies

Which two methods can an IAM user use to access AWS programmatically? (Select the most accurate answer.)

1. A.Email and SMS
2. B.Access Key ID + Secret Access Key (used by CLI/SDK), and the Console password (used in the browser)✓ Correct
3. C.Only the AWS Management Console password
4. D.Only access keys

Which of the following does an IAM password policy NOT allow you to configure?

1. A.Minimum password length
2. B.Required character types (uppercase, lowercase, numbers, symbols)
3. C.Password expiration period
4. D.Automatic deletion of users with weak passwords✓ Correct

Under the AWS Shared Responsibility Model, who is responsible for managing IAM users, groups, roles, and policies inside an AWS account?

1. A.AWS — they fully manage IAM identities for customers.
2. B.The customer — IAM identity management is the customer's responsibility.✓ Correct
3. C.It is shared 50/50 between AWS and the customer.
4. D.An AWS Partner Network (APN) partner only.

What is the difference between an AWS managed policy and a customer managed policy?

1. A.AWS managed policies can be edited by the customer; customer managed policies cannot.
2. B.AWS managed policies are created and maintained by AWS; customer managed policies are created and maintained by the customer.✓ Correct
3. C.Customer managed policies cost extra, AWS managed policies are free.
4. D.There is no difference — both terms refer to the same thing.

Where are IAM access keys safely stored? (Choose the best practice.)

1. A.Embedded directly in application source code.
2. B.In a public Git repository for easy sharing.
3. C.Only displayed once at creation — store in a password manager or secrets manager and never share.✓ Correct
4. D.Emailed to all team members.

Which of the following BEST describes an inline policy?

1. A.A policy embedded directly into a single user, group, or role and not reusable elsewhere.✓ Correct
2. B.A policy created and maintained by AWS.
3. C.A policy that automatically denies all access.
4. D.A policy attached to multiple identities for reuse.

Which CLF-C02 statement about IAM Roles is FALSE?

1. A.Roles use temporary security credentials issued by STS.
2. B.Roles can be assumed by AWS services, IAM users, or federated users.
3. C.Roles have permanent access keys that must be rotated regularly.✓ Correct
4. D.Roles enable cross-account access without sharing long-term credentials.

A developer wants to grant a Lambda function permission to write to a DynamoDB table. What is the recommended approach?

1. A.Create an IAM user for the Lambda function and embed its access keys.
2. B.Attach an IAM execution role with DynamoDB write permissions to the Lambda function.✓ Correct
3. C.Use the AWS account root credentials in the function code.
4. D.Make the DynamoDB table public.

Which of the following is NOT a valid IAM policy type?

1. A.Identity-based policy
2. B.Resource-based policy
3. C.Permissions boundary
4. D.Region-based policy✓ Correct

An organization wants to set the maximum permissions that an IAM user can ever have, even if attached policies grant more. Which feature should they use?

1. A.Inline policy
2. B.Permissions boundary✓ Correct
3. C.Group policy
4. D.Trust policy

Which of the following is the recommended way to allow an application running outside of AWS (e.g., on-premises) to access AWS APIs?

1. A.Embed the AWS account root credentials in the application.
2. B.Create an IAM user with programmatic access and use access keys, or use IAM Roles Anywhere/identity federation for short-lived credentials.✓ Correct
3. C.Make all S3 buckets public.
4. D.Disable IAM entirely.

What happens if an IAM user has no policies attached at all?

1. A.They get full administrator access by default.
2. B.They get read-only access by default.
3. C.They have no permissions and cannot perform any AWS actions until a policy is attached.✓ Correct
4. D.They inherit the root user's permissions.

Which statement about IAM access keys is TRUE?

1. A.An IAM user can have up to 5 active access keys at once.
2. B.An IAM user can have a maximum of 2 access keys, which helps with seamless rotation.✓ Correct
3. C.Access keys never expire and never need to be rotated.
4. D.Access keys can only be used in the AWS Management Console.

What is the purpose of the Principal element in an IAM resource-based policy?

1. A.It specifies the AWS service being accessed.
2. B.It specifies who (which user, role, account, or service) is allowed or denied access to the resource.✓ Correct
3. C.It specifies the region the resource lives in.
4. D.It specifies the cost of the action.