Task Statement 6.1: Implement Techniques for Identity and Access Management at Scale. DOP-C02 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary goal of the least privilege principle in IAM policy design?

   • ATo grant permissions based on the user's job title rather than their actual tasks.
   • BTo grant all permissions by default and remove them as needed.
   • CTo grant only the minimum permissions required to perform a task.
   • DTo use the same permissions for all users to simplify management.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which IAM policy element is used to implement attribute-based access control (ABAC)?

   • ACondition
   • BAction
   • CResource
   • DPrincipal
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   A company wants to allow its employees to sign in to AWS using their existing corporate credentials. Which IAM feature should be used to establish this federation?

   • AIAM identity provider
   • BIAM user
   • CIAM group
   • DIAM role
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company wants to grant developers access to EC2 instances based on the `Environment` tag (e.g., `dev`, `prod`). Developers should only be able to manage instances with the `Environment` tag matching their own user tag. What is the most scalable way to implement this?

   • ACreate a separate IAM role for each environment and attach policies that allow actions on instances with the corresponding tag.
   • BCreate a policy that allows all EC2 actions, and rely on the developers to only access instances with the correct tag.
   • CUse AWS Organizations SCPs to restrict access based on tags.
   • DUse attribute-based access control (ABAC) by tagging IAM users with `Environment` and creating a single policy that allows actions when the instance tag matches the user's tag.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the purpose of enforcing multi-factor authentication (MFA) for IAM users?

   • ATo replace the need for passwords.
   • BTo allow users to sign in without a password.
   • CTo add an extra layer of security by requiring a second form of authentication.
   • DTo grant users additional permissions.
   Reveal Solution Discussion Select an answer first