IAM Fundamentals, Principals, and Roles CSE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · medium

   Which of the following is a type of IAM principal?

   • AFirewall
   • BEncryption key
   • CVirtual network
   • DUser
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security audit reveals that many users have permissions they no longer need. The company wants to implement a process to regularly review and remove unnecessary permissions. What is the best practice to implement?

   • AGrant all users full administrator access and rely on logging to detect misuse.
   • BSet all permissions to expire automatically after 30 days.
   • CRemove all permissions and grant them back only when users complain.
   • DPerform periodic access reviews where managers confirm each user's permissions and remove any that are not needed.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A company wants to allow a third-party vendor to assume a role in their AWS account, but only if the vendor's identity is from a specific external IdP. The vendor also needs to access resources in a different region. What should the trust policy include?

   • AThe vendor's IAM user ARN as the principal.
   • BThe external IdP's ARN as the principal and a condition that restricts the vendor's account ID.
   • CThe S3 bucket ARN as the principal.
   • DThe region name as the principal.
   Reveal Solution Discussion Select an answer first
5. 29foundation · medium

   Which of the following is an IAM best practice?

   • ASharing root account credentials with all team members
   • BGranting users the minimum permissions necessary to perform their job
   • CGranting permissions directly to users instead of using roles
   • DUsing a single role for all users in the organization
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   An organization wants to allow its employees to assume a role that grants access to a partner's AWS account. The partner has provided an external ID for the trust policy. What is the purpose of the external ID in the trust policy?

   • AIt provides a second factor for MFA.
   • BIt prevents the confused deputy problem by ensuring the role is assumed only by the intended principal.
   • CIt encrypts the session tokens.
   • DIt authenticates the employee's password.
   Reveal Solution Discussion Select an answer first