Quizzes · Service

IAM Identity Center

Level 0 questions on IAM Identity Center. Read about it first if it's new to you.

Works with: IAM (4), Control Tower (2), Organizations (2), CloudTrail (1), Config (1)

15 questions, from a pool of 19
1 correct answer of 4 each
Pass line 80%

Questions and answers come in a new order every time, and every choice is explained. Your answers feed your weak spots on the exam page; they don't change your exam score.

Question 1Todo.io hires five engineers who need access to both the Dev and Prod accounts, with less access in Prod. What is the recommended way to set this up?

Create each engineer once in IAM Identity Center, and assign permission sets per account: a broader one in Dev, a narrower one in Prod.Correct. Identity Center gives each person one sign-in for every account. A permission set becomes a role in each account it is assigned to.Create an IAM user for each engineer in each account.Not this one. That is ten users, ten passwords and ten sets of keys to manage. It works, but it is the older way.Create one shared admin IAM user in each account and give everyone the password.Not this one. Shared credentials hide who did what in CloudTrail, and give everyone more access than they need.Give the engineers the root user's MFA device, so access is still protected by MFA.Not this one. Root can do almost anything, and must not be used for daily work by anyone.

Learn it: IAM Identity Center · Permission set · Set up AWS: Day 0

Question 2A teammate says that once Todo.io uses Control Tower, it no longer uses AWS Organizations. Which statement is true?

Control Tower sets up and governs Organizations, IAM Identity Center, CloudTrail and Config. It doesn't replace them.Correct. The organization, the OUs and the SCPs are all still there. Control Tower manages them for you.Control Tower replaces Organizations with its own account system.Not this one. Control Tower runs on top of Organizations.Control Tower is only a dashboard; it changes nothing.Not this one. It creates accounts, applies controls and sets up logging and sign-in.Control Tower runs separately inside each member account.Not this one. It runs from the management account and governs the accounts below it.

Learn it: AWS Control Tower

Question 3Todo.io needs a new account for its data team. It must arrive with logging on, guardrails applied and sign-in through Identity Center already set up. What creates it?

Control Tower's Account Factory.Correct. Account Factory stamps out accounts from a template, already enrolled in the landing zone.Create the account in the Organizations console and configure everything afterwards.Not this one. You would then have to set up logging, guardrails and sign-in by hand, and enroll the account.Copy the Prod account.Not this one. Accounts can't be copied.IAM Identity Center.Not this one. Identity Center gives people access to accounts. It doesn't create them.

Learn it: Account Factory

Question 4An engineer signs in to the IAM Identity Center access portal and opens the Prod account. What credentials do they get in Prod?

Temporary credentials for a role that Identity Center created from their permission set.Correct. Signing in means assuming a role, so the credentials expire on their own. No long-lived keys exist to leak.The password of an IAM user in Prod.Not this one. Identity Center doesn't create IAM users in the accounts.Permanent access keys for Prod.Not this one. Nothing here is permanent. That's the point.The Prod root user's credentials.Not this one. Root is never handed out by Identity Center.

Learn it: IAM Identity Center · Temporary credentials

Question 5Todo.io assigns the ReadOnlyAccess permission set to an engineer in its Audit account. What does Identity Center create in the Audit account?

An IAM role with the ReadOnlyAccess policy, which the engineer can assume.Correct. A permission set becomes a role in each account it is assigned to.An IAM user for the engineer.Not this one. Identity Center uses roles, not IAM users.An IAM group called ReadOnlyAccess.Not this one. Groups hold IAM users. Identity Center doesn't use them.An SCP that makes the account read-only.Not this one. That would limit everyone in the account, not grant one person access.

Learn it: Permission set

Question 6Todo.io already manages its staff in Okta. It wants people to sign in to AWS with the same accounts, and leavers to lose AWS access when they are removed from Okta. What should it do?

Connect Okta to IAM Identity Center as its identity source.Correct. Identity Center can use an external directory instead of its own. One place to add and remove people.Create an IAM user in each account for every Okta user.Not this one. That duplicates every person, and removing someone from Okta wouldn't remove their IAM users.Use Amazon Cognito.Not this one. Cognito is for an app's own customers (Level 2), not for staff signing in to AWS.Share one AWS sign-in among everyone who is in Okta.Not this one. Shared sign-ins hide who did what, and can't be taken from one leaver.

Learn it: IAM Identity Center

Question 7An engineer leaves Todo.io. They had access to all six accounts through IAM Identity Center. What is the quickest way to remove their access everywhere?

Disable or delete their user once: in Identity Center, or in the company directory it is connected to.Correct. One identity, one place to remove it. Sessions already open run out when their temporary credentials expire.Delete their IAM user in each of the six accounts.Not this one. They don't have IAM users; Identity Center gives them roles.Change the root password of every account.Not this one. They never had root, so this changes nothing for them.Delete the permission sets they used.Not this one. That removes access for everyone else who uses those permission sets too.

Learn it: IAM Identity Center

Question 8An engineer needs full access in Dev but must only be able to look, not change, in Prod. How should Todo.io set this up in IAM Identity Center?

Assign an administrator permission set in Dev and a read-only permission set in Prod.Correct. Assignments are per account, so each account gets exactly the access it needs: least privilege.Assign the administrator permission set in both accounts and trust the engineer to be careful in Prod.Not this one. Least privilege means not relying on care. Give only what the job needs.Assign the administrator permission set in both, and add an SCP to Prod that denies all changes.Not this one. That SCP would stop everyone in Prod making changes, including deployments.Create an IAM user in Prod with read-only access as well.Not this one. Two identities for one person is harder to manage and to remove.

Learn it: Permission set

Question 9Todo.io expects 50,000 people to sign up to manage their todos. Should those customers be created in IAM Identity Center?

No. Identity Center and IAM are for people and software that manage or call AWS. App customers belong to the app.Correct. Customer sign-up and login is the app's job; Amazon Cognito does it in Level 2.Yes. Identity Center is built for large numbers of users.Not this one. It's built for staff who sign in to AWS accounts, not for an app's customers.Yes, as IAM users, so each customer has their own permissions.Not this one. Customers should never be IAM principals.Yes, with one permission set per customer.Not this one. Customers don't sign in to AWS accounts at all.

Learn it: IAM Identity Center · IAM

Question 10Roles named AWSReservedSSO_AdministratorAccess_… appear in Todo.io's Prod account. Where did they come from?

IAM Identity Center created them when a permission set was assigned in Prod.Correct. Identity Center was formerly called AWS SSO, hence the name. Change them through the permission set, not by hand.An attacker created them.Not this one. The AWSReservedSSO_ prefix is reserved for Identity Center.RDS created them as service-linked roles.Not this one. Service-linked roles are named AWSServiceRoleFor…Account Factory creates them in every account.Not this one. Account Factory sets up sign-in, but these roles come from permission set assignments.

Learn it: IAM Identity Center

Question 11Todo.io wants every member of staff to use MFA when they sign in to AWS. Staff sign in through IAM Identity Center. Where should MFA be required?

In IAM Identity Center's sign-in settings, for all of its users.Correct. Staff sign in to AWS in one place, so MFA is required in one place.On the root user of each account.Not this one. Root needs MFA too, but that does nothing for staff signing in.On an IAM user in each account.Not this one. Staff don't have IAM users; they sign in through Identity Center.Nowhere, as long as passwords are long.Not this one. A long password can still be phished. MFA means a stolen password alone isn't enough.

Learn it: MFA (multi-factor authentication)

Question 12What does an engineer see after signing in to the IAM Identity Center access portal?

The accounts they are assigned to, and the permission sets they can use in each.Correct. They pick an account and a permission set, and land in the console as that role.Every account in the organization, with administrator access to each.Not this one. They see only what has been assigned to them.Only the management account.Not this one. Staff rarely need the management account at all.A list of IAM users to sign in as.Not this one. There are no IAM users; access is through roles.

Learn it: IAM Identity Center

Question 13Todo.io's founder signs in as the root user every day to manage everything. Which change best follows AWS security best practice?

Turn on MFA for the root user, stop using it day to day, and sign in through IAM Identity Center with only the access the job needs.Correct. The root user can do almost anything and only an SCP can limit it. Protect it with MFA and keep it for the few jobs that need it.Create access keys for the root user, so the founder can use the CLI instead of the console.Not this one. Root access keys are the most dangerous credentials in an account. AWS recommends never creating them.Share the root password with a second person as a backup.Not this one. Shared passwords hide who did what, and double the chances of a leak. Give each person their own sign-in.Rename the root user so attackers cannot guess it.Not this one. The root user can't be renamed. It's signed in with the account's email address.

Learn it: Root user · Set up AWS: Day 0

Question 14What does "IAM Identity Center" mean?

One place for people to sign in and get access to many AWS accounts.Correct. Think of it as: The front desk that hands you a temporary key card for whichever flat you're cleared for.An organization-wide guardrail that sets the most any identity in an account may do.Not this one. That describes SCP (service control policy).A reusable bundle of permissions that Identity Center turns into a role in each account you assign it to.Not this one. That describes Permission set.Groups many AWS accounts under one management account, with one bill and shared guardrails.Not this one. That describes AWS Organizations.

Learn it: IAM Identity Center

Question 15Which term is this? "One place for people to sign in and get access to many AWS accounts."

IAM Identity CenterCorrect. Yes. Think of it as: The front desk that hands you a temporary key card for whichever flat you're cleared for.SCP (service control policy)Not this one. SCP (service control policy) is: An organization-wide guardrail that sets the most any identity in an account may do.Permission setNot this one. Permission set is: A reusable bundle of permissions that Identity Center turns into a role in each account you assign it to.AWS OrganizationsNot this one. AWS Organizations is: Groups many AWS accounts under one management account, with one bill and shared guardrails.

Learn it: IAM Identity Center

Question 16Which AWS term is described by this analogy? "The front desk that hands you a temporary key card for whichever flat you're cleared for."

IAM Identity CenterCorrect. Yes: One place for people to sign in and get access to many AWS accounts.SCP (service control policy)Not this one. SCP (service control policy) is: An organization-wide guardrail that sets the most any identity in an account may do. Its analogy: The building's rules. Your lease can't give you permission to break them.Permission setNot this one. Permission set is: A reusable bundle of permissions that Identity Center turns into a role in each account you assign it to. Its analogy: A job description that comes with the right keys in every building.AWS OrganizationsNot this one. AWS Organizations is: Groups many AWS accounts under one management account, with one bill and shared guardrails. Its analogy: The building management company that owns every flat.

Learn it: IAM Identity Center

Question 17What does "Permission set" mean?

A reusable bundle of permissions that Identity Center turns into a role in each account you assign it to.Correct. Think of it as: A job description that comes with the right keys in every building.One place for people to sign in and get access to many AWS accounts.Not this one. That describes IAM Identity Center.Sets up and governs a multi-account AWS environment (a landing zone) for you.Not this one. That describes AWS Control Tower.An organization-wide guardrail that sets the most any identity in an account may do.Not this one. That describes SCP (service control policy).

Learn it: Permission set

Question 18Which term is this? "A reusable bundle of permissions that Identity Center turns into a role in each account you assign it to."

Permission setCorrect. Yes. Think of it as: A job description that comes with the right keys in every building.IAM Identity CenterNot this one. IAM Identity Center is: One place for people to sign in and get access to many AWS accounts.AWS Control TowerNot this one. AWS Control Tower is: Sets up and governs a multi-account AWS environment (a landing zone) for you.SCP (service control policy)Not this one. SCP (service control policy) is: An organization-wide guardrail that sets the most any identity in an account may do.

Learn it: Permission set

Question 19Which AWS term is described by this analogy? "A job description that comes with the right keys in every building."

Permission setCorrect. Yes: A reusable bundle of permissions that Identity Center turns into a role in each account you assign it to.IAM Identity CenterNot this one. IAM Identity Center is: One place for people to sign in and get access to many AWS accounts. Its analogy: The front desk that hands you a temporary key card for whichever flat you're cleared for.AWS Control TowerNot this one. AWS Control Tower is: Sets up and governs a multi-account AWS environment (a landing zone) for you. Its analogy: A developer who builds the whole apartment complex to code, then inspects it regularly.SCP (service control policy)Not this one. SCP (service control policy) is: An organization-wide guardrail that sets the most any identity in an account may do. Its analogy: The building's rules. Your lease can't give you permission to break them.

Learn it: Permission set

IAM Identity Center

Worth another look

Your weak spots

Services

Concepts