Task Statement 6.1: Implement Techniques for Identity and Access Management at Scale. DOP-C02 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   In AWS IAM, how is RBAC typically implemented for human users?

   • ABy using session policies for each user.
   • BBy attaching resource-based policies to each user individually.
   • CBy using SCPs to define permissions for users.
   • DBy creating IAM groups that represent job functions and attaching policies to those groups, then adding users to the groups.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which AWS service provides centralized access management and single sign-on (SSO) across multiple AWS accounts and business applications?

   • AAWS Secrets Manager
   • BAWS Directory Service
   • CAWS IAM Identity Center
   • DAWS Organizations
   Reveal Solution Discussion Select an answer first
4. 18application · hard

   A company has a team of developers who need to create IAM roles for their applications. The developers should be able to create roles and attach policies, but they must not be able to grant themselves or others permissions beyond a predefined set of AWS services. What should the company implement?

   • AUse IAM permissions boundaries on the roles that developers create. The boundary should allow only the predefined services, and developers should be allowed to create roles but not attach policies that exceed the boundary.
   • BImplement attribute-based access control (ABAC) by tagging roles with a `Service` tag and using conditions in policies to allow only those services.
   • CAttach an IAM permissions boundary to the developers' IAM user or role that allows only the predefined services. Then allow them to create roles and attach policies.
   • DCreate a service control policy (SCP) at the organization level that restricts the allowed services for all roles.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company has a production IAM role that grants broad permissions to manage EC2 instances. A DevOps engineer needs to temporarily use this role to perform a specific maintenance task that only requires stopping and starting instances. The engineer wants to ensure that they cannot perform any other actions during this session. What is the most secure way to achieve this?

   • AUse AWS Organizations SCPs to temporarily restrict the role's permissions.
   • BCreate a new IAM role with only the required permissions and have the engineer assume that role instead.
   • CAssume the role and use the `--session-policy` parameter in the STS AssumeRole call to pass a policy that only allows stop and start actions.
   • DModify the role's trust policy to include a condition that only allows the engineer to assume the role when they are performing maintenance.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Where are service control policies (SCPs) applied in AWS Organizations?

   • ATo AWS accounts, organizational units (OUs), or the organization root
   • BTo AWS resources like S3 buckets
   • CTo IAM groups
   • DTo individual IAM users and roles
   Reveal Solution Discussion Select an answer first