Task Statement 6.1: Implement Techniques for Identity and Access Management at Scale. DOP-C02 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   When a user assumes a role and passes a session policy, what is the effective permission for the session?

   • AThe role's permissions only, because session policies are ignored.
   • BThe intersection of the role's permissions and the session policy permissions.
   • CThe session policy permissions only, because the role's permissions are overridden.
   • DThe union of the role's permissions and the session policy permissions.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company has a fleet of EC2 instances that need to access AWS services. The instances are managed by an automated deployment system. The security team wants to ensure that the instances cannot use long-term access keys. What is the most effective way to achieve this?

   • AUse AWS Systems Manager to push temporary credentials to the instances.
   • BUse AWS Secrets Manager to store access keys and have the instances retrieve them at startup.
   • CUse AWS KMS to encrypt the access keys and store them on the instances.
   • DUse IAM roles for the EC2 instances and ensure that no long-term access keys are stored on the instances.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the purpose of an IAM permissions boundary?

   • ATo define the maximum permissions that an identity-based policy can grant.
   • BTo define the trust policy for a role.
   • CTo replace the need for identity-based policies.
   • DTo grant additional permissions to a role beyond its permissions policy.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company has an application that uses a database username and password stored in a configuration file. The security team wants to automate the rotation of these credentials without changing the application code. What should they use?

   • AAWS Systems Manager Parameter Store with automatic rotation.
   • BUse IAM roles for the application to access the database, eliminating the need for passwords.
   • CAWS Secrets Manager with automatic rotation configured for the database.
   • DStore the credentials in AWS KMS and use automatic key rotation.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A company uses AWS Organizations with a management account and several member accounts. They want to allow developers in member accounts to create IAM roles, but they want to ensure that no role can access the management account's resources. What is the most effective way to achieve this?

   • ACreate an IAM policy in the management account that denies access to its resources for all roles from member accounts.
   • BUse AWS Organizations to create a resource-based policy in the management account that denies access to its resources for all principals from member accounts.
   • CEnsure that the management account does not have any resource-based policies that allow access from member accounts, and use SCPs to deny the `sts:AssumeRole` action for roles in the management account.
   • DCreate an SCP in the organization that denies all actions on the management account's resources for all member accounts.
   Reveal Solution Discussion Select an answer first