Task Statement 6.1: Implement Techniques for Identity and Access Management at Scale. DOP-C02 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A company wants to enforce MFA for all IAM users who access the AWS Management Console. They also want to ensure that users cannot perform any actions until they have configured MFA. What is the most effective way to achieve this?

   • AEnable MFA on the root account and require all users to use the root account credentials.
   • BConfigure the IAM password policy to require MFA for all users.
   • CCreate an IAM policy that denies all actions unless `aws:MultiFactorAuthPresent` is true, and attach it to all IAM users.
   • DUse AWS Organizations SCPs to require MFA for all users.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which AWS service is designed to automate the rotation of secrets, such as database credentials, for machine identities?

   • AAWS Key Management Service (KMS)
   • BAWS IAM
   • CAWS Secrets Manager
   • DAWS Systems Manager Parameter Store
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the key difference between attribute-based access control (ABAC) and role-based access control (RBAC)?

   • AABAC is used for machine identities, while RBAC is used for human users.
   • BABAC requires the use of SCPs, while RBAC does not.
   • CABAC is more secure than RBAC.
   • DABAC grants permissions based on attributes (like tags), while RBAC grants permissions based on roles or job functions.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the purpose of a session policy when using AWS STS to assume a role?

   • ATo grant additional permissions beyond what the role allows.
   • BTo limit the permissions of the temporary credentials for that session.
   • CTo define the trust relationship between the role and the entity assuming it.
   • DTo specify the duration of the temporary credentials.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A developer creates an S3 bucket and attaches a bucket policy that grants `s3:GetObject` to the IAM role used by an application. The application's IAM role has an identity-based policy that grants `s3:*` on the specific bucket ARN. The application still receives an Access Denied error when trying to read objects. What is the most likely cause?

   • AThe bucket policy does not include a Principal element that matches the role's account.
   • BThe bucket policy is missing an explicit `Allow` for the role, and the role's identity-based policy is not sufficient because S3 requires both policies to allow access.
   • CThe bucket is in a different account, and the bucket policy does not grant access to the role's account.
   • DThe role's identity-based policy does not explicitly allow `s3:GetObject`; it only allows `s3:*` on the bucket, which does not cover object-level actions.
   Reveal Solution Discussion Select an answer first