IAM - Identity and Access Management

Question 1

Mapped to a physical user, has a password for AWS Console

• Groups
• Policies
• Users
• AWS CLI

Answer 1

Users

Question 2

Contains users only

• Security
• Groups
• Access Keys
• AWS SDK

Answer 2

Groups

Question 3

JSON document that outlines permissions for users or groups

• Security
• Users
• Groups
• Policies

Answer 3

Policies

Question 4

MFA + Password Policy

• Audit
• AWS CLI
• Groups
• Security

Answer 4

Security

Question 5

Manage your AWS services using the command-line

Answer 5

AWS CLI

Question 6

Manage your AWS services using a programming language

Answer 6

AWS SDK

Question 7

Access AWS services using a programming language

Answer 7

Access Keys

Question 8

IAM Credential Reports & IAM Access Advisor

Answer 8

Audit

Question 9

What is a proper definition of IAM roles

• An IAM entity that defines a set of permissions for making AWS service requests, that will be used by AWS services
• IAM Users in multiple Groups
• A password policy
• Permissions assigned to Users to perform actions

Answer 9

An IAM entity that defines a set of permissions for making AWS service requests, that will be used by AWS services

Question 10

Which of the following is an IAM Security Tool?

• IAM Credentials Report
• IAM Root Account Manager
• IAM Services Report
• IAM Security Advisor

Answer 10

IAM Credentials Report

Note: IAM Credentials report lists all your account’s users and the status of their various credentials. The other IAM Security Tool is IAM Access Advisor. It shows the service permissions granted to a user and when those services were last accessed

Question 11

Which answer is INCORRECT regarding IAM Users?

• IAM Users can belong to multiple groups
• IAM Users don’t have to belong to a group
• IAM Users can have policies assigned to them
• IAM Users access AWS with the root account credentials

Answer 11

IAM Users access AWS with the root account credentials

NOTE: IAM Users access AWS using a username and password

Question 12

Which of the following is an IAM best practice?

• Don’t use the root user account
• Create several users for a physical person
• Share credentials so a colleague can perform a task for you
• Do not enable MFA for easier access

Answer 12

Don’t use the root user account

NOTE: You only want to use the root account to create your first IAM user, and for a few account and service management tasks. For every day and administration tasks, use an IAM user with permissions

Question 13

What are IAM Policies?

• AWS services performable actions
• JSON documents to define Users, Groups or Roles’ permissions
• Rules to set up a password for IAM Users

Answer 13

JSON documents to define Users, Groups or Roles’ permissions

NOTE: An IAM policy is an entity that, when attached to an identitiy or resource, defines their permissions

Question 14

Under the shared responsibility model, what is the customer responsible for in IAM?

• Infrastructure security
• Compliance validation
• Configuration and vulnerability analysis
• Assigning users proper IAM Policies

Answer 14

Assigning users proper IAM Policies

Question 15

Which of the following statements is TRUE

• The AWS CLI can interact with AWS using commands in your command-line shell, while the AWS SDK can interact with AWS programmatically
• The AWS SDK can interact with AWS using commands in your command-line shell, while the AWS CLI can interact with AWS programmatically

Answer 15

The AWS CLI can interact with AWS using commands in your command-line shell, while the AWS SDK can interact with AWS programmatically

Question 16

Which principle should you apply regarding IAM Permissions?

• Grant most privilege
• Grant least privilege
• Grant permissions if your employee asks you too
• Restrict root account permissions

Answer 16

Grant least privilege

Question 17

What should you do to increase your root account security?
- Enable Multi-Factor Authentication (MFA)
- Remove permissions from the root account
- Use AWS only through the Command Line Interface (CLI)

Answer 17

Enable Multi-Factor Authentication (MFA)