What is the core idea behind role-based access control (RBAC) in AWS IAM?

Permissions are assigned to roles based on job functions, and users are placed in groups that map to those roles.

Permissions are assigned directly to each individual user based on their specific tasks.

Permissions are assigned based on resource tags.

Permissions are assigned based on the user's location or IP address.

A company uses AWS Organizations with multiple accounts. They want to ensure that no IAM user or role in any account can delete an S3 bucket that has a specific tag `Protected=true`. What is the most effective way to enforce this?

Attach a resource-based bucket policy to each protected bucket that denies `s3:DeleteBucket` for all principals.

Use AWS Config rules to detect bucket deletions and automatically restore them.

Create an SCP that denies `s3:DeleteBucket` when the request includes a condition that the bucket has the tag `Protected=true`.

Create an IAM policy for each account's root user that denies `s3:DeleteBucket` for tagged buckets.

AWSCertified DevOps Engineer - Professional

Domain 6Objective 1

Task Statement 6.1: Implement Techniques for Identity and Access Management at Scale. DOP-C02 Practice Questions (Page 7)

Part of the Content Domain 6: Security and Compliance domain, which accounts for 17% of the DOP-C02 exam. AWS does not publish an official question count, but from its 180-minute exam (~70–120 total, ~12–20 in this domain), expect 12–20 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

12concepts

17%of the exam

12 Concepts in This Objective

IAM entities for human and machine access
Identity-based vs. resource-based policies
Session policies
Identity federation with IAM Identity Center
IAM permissions boundaries
Organizational SCPs
Least privilege policy design
Role-based access control (RBAC)
Attribute-based access control (ABAC)
Automating credential rotation for machine identities
MFA enforcement for human and machine identities
AWS Security Token Service (STS) for temporary credentials

Questions 31–34

31foundation · easy
What is the core idea behind role-based access control (RBAC) in AWS IAM?
Select an answer first
32foundation · easy
A DevOps engineer needs to grant an AWS service (such as an EC2 instance) permission to call other AWS services. Which IAM entity is designed for this machine access use case?
Select an answer first
33application · medium
A company uses AWS Organizations with multiple accounts. They want to ensure that no IAM user or role in any account can delete an S3 bucket that has a specific tag `Protected=true`. What is the most effective way to enforce this?
Select an answer first
34foundation · easy
Which STS API call is used to obtain temporary credentials for a role?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to DOP-C02

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “DOP-C02” is a trademark of its owner, used for identification only.

Task Statement 6.1: Implement Techniques for Identity and Access Management at Scale. DOP-C02 Practice Questions (Page 7)

Questions 31–34

What is the core idea behind role-based access control (RBAC) in AWS IAM?

A DevOps engineer needs to grant an AWS service (such as an EC2 instance) permission to call other AWS services. Which IAM entity is designed for this machine access use case?

A company uses AWS Organizations with multiple accounts. They want to ensure that no IAM user or role in any account can delete an S3 bucket that has a specific tag `Protected=true`. What is the most effective way to enforce this?

Which STS API call is used to obtain temporary credentials for a role?

Keep studying — Content Domain 6: Security and Compliance