Task Statement 6.1: Implement Techniques for Identity and Access Management at Scale. DOP-C02 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the primary purpose of AWS Security Token Service (STS)?

   • ATo issue temporary, limited-privilege credentials for IAM users or federated users.
   • BTo manage long-term access keys for IAM users.
   • CTo provide single sign-on for AWS accounts.
   • DTo encrypt data at rest in S3.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company has an application running on an EC2 instance that needs to access an S3 bucket in the same account. The application currently uses long-term access keys stored on the instance. What is the most secure way to provide the application with access?

   • AUse AWS Systems Manager Parameter Store to store the access keys and have the application retrieve them.
   • BCreate an IAM role and attach it to the EC2 instance. The application can then retrieve temporary credentials from the instance metadata service.
   • CStore the access keys in AWS Secrets Manager and have the application retrieve them at startup.
   • DCreate an IAM user with programmatic access and embed the keys in the application code.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   A DevOps engineer wants to allow developers to create IAM roles but prevent them from granting themselves or others full administrator access. Which IAM feature should be used?

   • AIAM permissions boundary
   • BAWS Organizations SCP
   • CIAM password policy
   • DIAM group
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company is using AWS IAM Identity Center with an external identity provider (IdP). They want to enforce MFA for all users accessing the AWS console. The IdP currently does not support MFA. What is the most effective way to enforce MFA?

   • ACreate an IAM policy that denies all actions unless `aws:MultiFactorAuthPresent` is true, and attach it to all permission sets.
   • BUse AWS Organizations SCPs to require MFA for all users.
   • CConfigure MFA in IAM Identity Center and require it for all users.
   • DAsk the IdP to enable MFA and wait for them to implement it.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company wants to implement role-based access control (RBAC) for its AWS environment. They have defined job functions such as 'Developer', 'Operations', and 'Security'. What is the most effective way to implement RBAC?

   • AUse AWS Organizations SCPs to define job functions.
   • BCreate an IAM group for each job function and attach policies that grant the necessary permissions. Assign IAM users to the appropriate groups.
   • CAttach policies directly to each IAM user based on their job function.
   • DCreate an IAM role for each job function and have users assume the role when they need to perform tasks.
   Reveal Solution Discussion Select an answer first