A developer is launching an Amazon EC2 instance that must read from an Amazon DynamoDB table. The developer does not want to store long-term credentials on the instance. What is the MOST secure way to grant the EC2 instance the necessary permissions?

Create an IAM role with a policy that allows DynamoDB read access, and attach the role to the EC2 instance as an instance profile.

Create an IAM user with programmatic access, generate an access key, and configure the AWS CLI on the instance with that key.

Create an IAM group with a DynamoDB read policy and add the EC2 instance to the group.

Embed the DynamoDB read policy directly into the EC2 instance's operating system configuration.

Which feature of AWS IAM Identity Center allows users to access multiple AWS accounts and applications with a single set of credentials?

Multi-factor authentication (MFA)

Service control policies (SCPs)

A company has multiple AWS accounts managed through AWS Organizations. Employees need to access resources in several of these accounts using their existing corporate credentials. The company wants to avoid creating separate IAM users in each account. What is the MOST appropriate solution?

Create IAM users in each account and give them the same password.

Use AWS Organizations to automatically replicate IAM users across all member accounts.

Create an IAM role in each account and share the role's credentials with employees.

Set up IAM Identity Center and connect it to the company's identity provider for single sign-on.

What is the primary purpose of enabling Multi-Factor Authentication (MFA) on an AWS account root user?

To add an extra layer of security by requiring a second form of authentication in addition to the password

To automatically rotate the root user password on a schedule

To provide a backup login method if the password is forgotten

To allow multiple users to share the same password

AWSCertified Cloud Practitioner

Domain 2Objective 3

Task Statement 2.3: Identify AWS Access Management Capabilities. CLF-C02 Practice Questions (Page 3)

Part of the Security and Compliance domain, which makes up ~24% of our current practice bank. AWS does not publish an official question count, but from its 90-minute exam (~35–60 total, ~8–14 in this domain), expect 2–4 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

8concepts

Questions 11–15

11application · medium
A developer is launching an Amazon EC2 instance that must read from an Amazon DynamoDB table. The developer does not want to store long-term credentials on the instance. What is the MOST secure way to grant the EC2 instance the necessary permissions?
Select an answer first
12foundation · easy
Which type of IAM policy is a standalone policy that can be attached to multiple users, groups, or roles, and is managed independently?
Select an answer first
13foundation · easy
Which feature of AWS IAM Identity Center allows users to access multiple AWS accounts and applications with a single set of credentials?
Select an answer first
14application · medium
A company has multiple AWS accounts managed through AWS Organizations. Employees need to access resources in several of these accounts using their existing corporate credentials. The company wants to avoid creating separate IAM users in each account. What is the MOST appropriate solution?
Select an answer first
15foundation · easy
What is the primary purpose of enabling Multi-Factor Authentication (MFA) on an AWS account root user?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CLF-C02

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “CLF-C02” is a trademark of its owner, used for identification only.