AWS Authentication and Cloud Services GCPN Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security engineer is reviewing IAM policies and finds that a user has a policy that allows 'iam:CreateAccessKey' on their own user. What is the primary security concern?

   • AThe user can change their own password.
   • BThe user can create additional access keys, which may not be rotated or monitored.
   • CThe user can delete their own IAM user.
   • DThe user can attach a new policy to their user.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security team discovers that an IAM role in their AWS account has a trust policy that allows 'sts:AssumeRole' from 'Principal': {'AWS': 'arn:aws:iam::123456789012:root'}. The external account 123456789012 is not a partner or vendor. What is the primary risk?

   • AThe role can be assumed by any AWS account because the principal is set to root.
   • BAny user in the external account can assume the role if they can guess the role name.
   • CThe external account can modify the trust policy to grant itself additional permissions.
   • DThe role's permissions are automatically inherited by all users in the external account.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security auditor is reviewing an IAM policy that allows 'ec2:RunInstances' and 'iam:PassRole' on all resources. The auditor wants to prevent a user from launching an EC2 instance with a role that has administrative privileges. Which additional policy statement would achieve this?

   • ADeny 'ec2:RunInstances' on all resources.
   • BDeny 'iam:PassRole' when the role name is 'AdminRole'.
   • CDeny 'ec2:RunInstances' when the instance has an instance profile.
   • DDeny 'iam:PassRole' on all roles.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which AWS authentication method is most appropriate for an external identity provider (IdP) such as Okta or Active Directory to grant users access to AWS resources?

   • AEC2 instance profile
   • BAWS account root user
   • CFederated identity using IAM roles and SAML 2.0
   • DIAM user with a long-lived access key
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which AWS authentication mechanism is specifically designed to grant temporary, scoped access to a user or application without requiring the creation of a long-lived IAM user?

   • AAWS account root user
   • BIAM user with a password and MFA
   • CAccess key pair for an IAM user
   • DIAM role with a session policy
   Reveal Solution Discussion Select an answer first