An application running on an Amazon EC2 instance needs to read objects from an Amazon S3 bucket. Which IAM construct is designed to grant the application temporary permissions without embedding long-term credentials in the instance?

An IAM user with an access key stored in the application code

An IAM group with an S3 read-only policy

An S3 bucket policy that allows all IAM users

An IAM role attached to the EC2 instance

What are AWS access keys used for?

Programmatic access to AWS services via the AWS CLI, SDKs, or APIs

Logging in to the AWS Management Console

A company has a team of developers who need to manage their own IAM users and groups. The security team wants to ensure that the developers can create and manage IAM resources, but they must NOT be able to delete the root user or modify the IAM password policy. What is the MOST appropriate way to grant these permissions?

Attach the AWS managed policy 'IAMFullAccess' to the developers' IAM group.

Create a custom IAM policy that allows all IAM actions except for the specific denied actions, and attach it to the developers' group.

Create an IAM role with the required permissions and have the developers assume it.

Use an SCP to restrict the developers' permissions in the organization.

A company has an AWS Organization with multiple accounts. The security team wants to ensure that no IAM user in any member account can launch EC2 instances with a public IP address. The team also wants to allow account administrators to manage their own IAM users. What is the MOST effective way to enforce this restriction?

Use a VPC with no internet gateway in every account.

Apply an SCP at the organization root that denies the ec2:RunInstances action when a public IP is requested.

Use AWS Config to automatically terminate any instance with a public IP.

Create an IAM policy for each account administrator that denies launching instances with public IPs.

A company is using AWS IAM Identity Center for SSO. The security team wants to add an extra layer of security by requiring all users to provide a one-time code from a mobile authenticator app in addition to their password. What is the MOST appropriate way to configure this?

Enable MFA in IAM Identity Center and configure the MFA method as 'Authenticator app'.

Use an SCP to require MFA for all users.

Configure the corporate identity provider to require MFA.

Enable MFA on each IAM user in the connected accounts.

AWSCertified Cloud Practitioner

Domain 2Objective 3

Task Statement 2.3: Identify AWS Access Management Capabilities. CLF-C02 Practice Questions (Page 4)

Part of the Security and Compliance domain, which makes up ~24% of our current practice bank. AWS does not publish an official question count, but from its 90-minute exam (~35–60 total, ~8–14 in this domain), expect 2–4 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

8concepts

Questions 16–20

16foundation · easy
An application running on an Amazon EC2 instance needs to read objects from an Amazon S3 bucket. Which IAM construct is designed to grant the application temporary permissions without embedding long-term credentials in the instance?
Select an answer first
17foundation · easy
What are AWS access keys used for?
Select an answer first
18expert · medium
A company has a team of developers who need to manage their own IAM users and groups. The security team wants to ensure that the developers can create and manage IAM resources, but they must NOT be able to delete the root user or modify the IAM password policy. What is the MOST appropriate way to grant these permissions?
Select an answer first
19expert · medium
A company has an AWS Organization with multiple accounts. The security team wants to ensure that no IAM user in any member account can launch EC2 instances with a public IP address. The team also wants to allow account administrators to manage their own IAM users. What is the MOST effective way to enforce this restriction?
Select an answer first
20application · medium
A company is using AWS IAM Identity Center for SSO. The security team wants to add an extra layer of security by requiring all users to provide a one-time code from a mobile authenticator app in addition to their password. What is the MOST appropriate way to configure this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CLF-C02

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “CLF-C02” is a trademark of its owner, used for identification only.

Task Statement 2.3: Identify AWS Access Management Capabilities. CLF-C02 Practice Questions (Page 4)

Questions 16–20

An application running on an Amazon EC2 instance needs to read objects from an Amazon S3 bucket. Which IAM construct is designed to grant the application temporary permissions without embedding long-term credentials in the instance?

What are AWS access keys used for?

A company is using AWS IAM Identity Center for SSO. The security team wants to add an extra layer of security by requiring all users to provide a one-time code from a mobile authenticator app in addition to their password. What is the MOST appropriate way to configure this?

Keep studying — Security and Compliance