Quizzes · Service

IAM

Level 0 questions on IAM. Read about it first if it's new to you.

Works with: Lambda (8), DynamoDB (6), Organizations (4), IAM Identity Center (4), RDS (3), EC2 (3), ECS + Fargate (3), CloudWatch Logs (3), API Gateway (2), SQS (2), VPC (1), S3 (1), CloudTrail (1)

15 questions, from a pool of 56
1 correct answer of 4 each
Pass line 80%

Questions and answers come in a new order every time, and every choice is explained. Your answers feed your weak spots on the exam page; they don't change your exam score.

Question 1An SCP on Todo.io's Prod OU allows s3:*. A role in Prod has no IAM policies that mention S3, and the bucket has no bucket policy. Can the role read objects from a bucket in Prod?

No. SCPs only set the most an account can do; something must still grant the permission.Correct. An SCP never grants anything. With no identity policy and no bucket policy allowing it, the request is implicitly denied.Yes. The SCP allows s3:* for every role in the OU.Not this one. SCPs are a ceiling, not a grant. An Allow in an SCP only means "IAM may allow this here".Yes, but only for buckets in the same Region as the role.Not this one. Roles are global and Regions have nothing to do with it. Nothing grants the permission, so the answer is no.Only if the role was created through Control Tower.Not this one. How the role was created doesn't matter. Permissions come from policies, not from the tool that made the role.

Learn it: SCP (service control policy) · IAM (Identity and Access Management) · Set up AWS: Day 0

Question 2An SCP on the Prod OU denies a set of RDS actions. Which of these does the SCP NOT restrict?

Service-linked roles, such as the one RDS uses to manage its own network interfaces.Correct. SCPs never apply to service-linked roles, so AWS services can keep running what they manage for you.IAM users in the Prod account.Not this one. SCPs apply to every IAM user in a member account.IAM roles in the Prod account.Not this one. SCPs apply to every IAM role in a member account, except service-linked roles.The root user of the Prod account.Not this one. SCPs apply to root in member accounts.

Learn it: SCP (service control policy) · Service-linked role

Question 3Todo.io creates a new member account from its management account with AWS Organizations. Nobody knows a password for the new account. How does an administrator get in the first time?

From the management account, assume the OrganizationAccountAccessRole that Organizations created in the new account.Correct. Organizations creates that role in every account it creates, and trusts the management account to assume it. Borrowing a role means no new passwords or keys.Sign in to the new account as root with the management account's password.Not this one. Each account has its own root user and email address. The management account's password doesn't open it.Use the IAM user that Organizations creates for the administrator.Not this one. Organizations creates a role, not an IAM user.Wait for the new account to accept an invitation.Not this one. Invitations are for existing accounts that join. A new account created by the organization is a member at once.

Learn it: AWS Organizations · Set up AWS: Day 0 · IAM role

Question 4An engineer signs in to the IAM Identity Center access portal and opens the Prod account. What credentials do they get in Prod?

Temporary credentials for a role that Identity Center created from their permission set.Correct. Signing in means assuming a role, so the credentials expire on their own. No long-lived keys exist to leak.The password of an IAM user in Prod.Not this one. Identity Center doesn't create IAM users in the accounts.Permanent access keys for Prod.Not this one. Nothing here is permanent. That's the point.The Prod root user's credentials.Not this one. Root is never handed out by Identity Center.

Learn it: IAM Identity Center · Temporary credentials

Question 5Todo.io assigns the ReadOnlyAccess permission set to an engineer in its Audit account. What does Identity Center create in the Audit account?

An IAM role with the ReadOnlyAccess policy, which the engineer can assume.Correct. A permission set becomes a role in each account it is assigned to.An IAM user for the engineer.Not this one. Identity Center uses roles, not IAM users.An IAM group called ReadOnlyAccess.Not this one. Groups hold IAM users. Identity Center doesn't use them.An SCP that makes the account read-only.Not this one. That would limit everyone in the account, not grant one person access.

Learn it: Permission set

Question 6Roles named AWSReservedSSO_AdministratorAccess_… appear in Todo.io's Prod account. Where did they come from?

IAM Identity Center created them when a permission set was assigned in Prod.Correct. Identity Center was formerly called AWS SSO, hence the name. Change them through the permission set, not by hand.An attacker created them.Not this one. The AWSReservedSSO_ prefix is reserved for Identity Center.RDS created them as service-linked roles.Not this one. Service-linked roles are named AWSServiceRoleFor…Account Factory creates them in every account.Not this one. Account Factory sets up sign-in, but these roles come from permission set assignments.

Learn it: IAM Identity Center

Question 7In Todo.io's Prod account, a developer's role has an IAM policy that allows dynamodb:DeleteTable. An SCP attached to the Prod OU denies dynamodb:DeleteTable. The developer tries to delete a table. What happens?

The request is denied. An explicit Deny anywhere always wins.Correct. IAM checks every policy that applies. One explicit Deny, here in the SCP, overrides any number of Allows.The request is allowed, because the role's own policy is more specific than the SCP.Not this one. Specificity never matters in IAM. A Deny beats an Allow, wherever each one is written.The request is allowed, because SCPs only apply to the root user.Not this one. SCPs apply to every user and role in a member account, root included.The request is allowed, but AWS Config reports it afterwards.Not this one. Config is detective: it reports after the fact. This request never happens, because the SCP is preventive.

Learn it: IAM policy · SCP (service control policy) · Set up AWS: Wrong Region

Question 8Todo.io's founder signs in as the root user every day to manage everything. Which change best follows AWS security best practice?

Turn on MFA for the root user, stop using it day to day, and sign in through IAM Identity Center with only the access the job needs.Correct. The root user can do almost anything and only an SCP can limit it. Protect it with MFA and keep it for the few jobs that need it.Create access keys for the root user, so the founder can use the CLI instead of the console.Not this one. Root access keys are the most dangerous credentials in an account. AWS recommends never creating them.Share the root password with a second person as a backup.Not this one. Shared passwords hide who did what, and double the chances of a leak. Give each person their own sign-in.Rename the root user so attackers cannot guess it.Not this one. The root user can't be renamed. It's signed in with the account's email address.

Learn it: Root user · Set up AWS: Day 0

Question 9Todo.io creates a new IAM role and attaches no policies to it. What can something using the role do?

Nothing. Every request is denied until a policy allows it.Correct. IAM starts from deny. With no Allow anywhere, every request is implicitly denied.Read anything in the account, but not change it.Not this one. There is no built-in read-only default.Anything in its own account.Not this one. A role gets nothing by being in an account.Whatever the person who created it can do.Not this one. A role's permissions come from its own policies, not from its creator.

Learn it: IAM (Identity and Access Management) · IAM policy

Question 10Todo.io created an IAM role while the console was set to us-east-1. Can an app running in eu-west-1 use the role?

Yes. IAM is global, so roles aren't tied to a Region.Correct. A few services, IAM among them, are global. Most others, like RDS, are regional.No. The role only exists in us-east-1.Not this one. That's true of most services, but not of IAM.Only after the role is copied to eu-west-1.Not this one. There is nothing to copy; the same role works in every Region.Only if the app signs in through IAM Identity Center.Not this one. Apps use roles directly. Identity Center is for people.

Learn it: IAM (Identity and Access Management) · Region

Question 11A Todo.io Lambda function must write to a DynamoDB table. How should it get that permission?

Give the function an execution role whose policy allows writing to that table.Correct. Software gets AWS permissions from a role. Lambda hands the function the role's temporary credentials.Store an IAM user's access keys in the function's environment variables.Not this one. Long-lived keys in configuration can leak, and never expire.Add a resource-based policy to the function that allows DynamoDB.Not this one. A function's resource-based policy says who may call it, not what it may call.Open the table's security group to the function.Not this one. DynamoDB has no security group. IAM approves every call.

Learn it: IAM role · Lambda

Question 12Which statement describes a resource-based policy?

It is attached to a resource, such as a Lambda function or an S3 bucket, and says who may use that resource.Correct. It names the principal: "API Gateway may invoke this function". The opposite of an identity policy, which is attached to the caller.It is attached to a user, group or role, and says what they may do.Not this one. That is an identity-based policy.It sets the most any identity in an account may do.Not this one. That is an SCP.It decides which Region a resource is created in.Not this one. Policies allow or deny requests. The Region is chosen when you create the resource.

Learn it: IAM policy

Question 13A developer may create Lambda functions, but gets AccessDenied when choosing an existing execution role for a new function. What is missing?

Permission for iam:PassRole on that execution role.Correct. Giving a role to a service is "passing" it. PassRole stops people giving a service more power than they have themselves.Permission for lambda:InvokeFunction.Not this one. That is for calling a function, not creating one.Only the root user can give a role to a function.Not this one. Anyone with iam:PassRole on the role can.The role's trust policy must name the developer.Not this one. The trust policy must trust lambda.amazonaws.com, because Lambda is what assumes the role.

Learn it: iam:PassRole

Question 14Which part of an IAM role decides who is allowed to assume it?

Its trust policy.Correct. The trust policy names who may wear the role, such as ec2.amazonaws.com. The permissions policy says what the wearer can do.Its permissions policy.Not this one. That says what the role can do once assumed, not who may assume it.An SCP on the account.Not this one. An SCP caps what the role can do. It doesn't name who may assume it.The role's ARN.Not this one. The ARN is only the role's name.

Learn it: IAM role

Question 15Todo.io's report job only reads items from the Todos table. Which policy follows the principle of least privilege?

Allow dynamodb:GetItem and dynamodb:Query on the Todos table's ARN.Correct. Only the actions the job uses, only on the one table it reads.Allow dynamodb:* on every resource.Not this one. That lets the job delete every table in the account.Attach AdministratorAccess.Not this one. That lets the job do anything in the account.Allow every action on the Todos table's ARN.Not this one. Right table, but it could also delete it.

Learn it: IAM policy

Question 16In the ARN arn:aws:dynamodb:us-east-1:111122223333:table/Todos, what is 111122223333?

The AWS account ID that owns the table.Correct. An ARN reads: partition, service, Region, account ID, then the resource.The table's own ID.Not this one. The table is named at the end: table/Todos.The ID of the user who created the table.Not this one. ARNs never say who created something.The Availability Zone the table lives in.Not this one. ARNs name the Region (us-east-1), never an Availability Zone.

Learn it: ARN (Amazon Resource Name)

Question 17Todo.io's API Gateway invokes its Lambda function. In Todo.io's setup, which policy says that API Gateway may invoke the function?

A resource-based policy on the function.Correct. It lives on the function and names the caller (apigateway.amazonaws.com): who may use this resource.The function's execution role.Not this one. The execution role says what the function may do, not who may call it.An SCP on the account.Not this one. SCPs only cap permissions; they never grant them.A security group on the function.Not this one. Security groups filter network traffic. Invoking a function is an AWS API call, decided by IAM.

Learn it: API Gateway · IAM policy · Lambda

Question 18Todo.io's Lambda function tries to push a message to a browser by POSTing to the WebSocket API's @connections URL, and gets AccessDenied. What fixes it?

Allow execute-api:ManageConnections in the function's execution role.Correct. Pushing to a connection is an AWS API call, so IAM must allow it like any other.Open port 443 in the function's security group.Not this one. AccessDenied is an IAM answer. A network problem would time out instead.Enable CORS on the API.Not this one. CORS is about browsers calling across websites. This call comes from Lambda.Give the browser an IAM role.Not this one. The browser is the receiver here, and app users are never IAM principals.

Learn it: WebSocket (API Gateway WebSocket API) · IAM policy

Question 19The Todo.io app runs on an EC2 instance and must write to a DynamoDB table. What is the most secure way to give it AWS credentials?

Attach an IAM role to the instance through an instance profile.Correct. The SDK fetches temporary credentials for the role from the instance itself, and they rotate automatically. There are no long-lived keys to leak.Create an IAM user's access keys and put them in the app's config file.Not this one. Long-lived keys in a file get copied, committed to Git and forgotten. Anyone who finds them has the access.Pass access keys to the instance in its user data.Not this one. User data is readable by anything on the instance and isn't secret. It's no safer than a config file.Use the root user's access keys, because they never expire.Not this one. Never expiring is the problem. Root keys should not exist at all.

Learn it: EC2 (Elastic Compute Cloud) · Temporary credentials · IAM role · Design Todo.io on EC2

Question 20Todo.io's app on EC2 has a role attached through an instance profile. Where does the AWS SDK get the role's credentials from?

From the instance metadata service at 169.254.169.254, on the instance's host.Correct. The SDK asks for temporary credentials and refreshes them before they expire. Nothing is stored in a file.From a file the team uploads to the instance.Not this one. That would be long-lived keys on disk, which roles exist to avoid.From an S3 bucket.Not this one. Credentials are never fetched from a bucket.From the IAM Identity Center access portal.Not this one. The portal is for people. Software on EC2 uses its instance profile.

Learn it: Temporary credentials · IAM role

Question 21Code inside Todo.io's ECS task must send messages to SQS. Which role should be allowed sqs:SendMessage?

The task role.Correct. The task role is what your code may do. Its credentials are served inside the task.The task execution role.Not this one. That is what ECS itself needs to start the task: pull the image and ship logs.An instance profile on an EC2 host.Not this one. On Fargate there is no host of yours, and the task role keeps permissions per task.A service-linked role.Not this one. Those belong to AWS services, and you can't add permissions to them.

Learn it: ECS and Fargate · IAM role

Question 22A Fargate task fails to start because ECS can't pull the container image or create its log stream. Which role is missing permissions?

The task execution role.Correct. ECS uses the execution role to pull the image and send logs on your behalf, before your code runs.The task role.Not this one. The task role is only used by your code once the task is running.The root user.Not this one. Root is never involved in starting tasks.The developer's IAM Identity Center role.Not this one. The task starts long after the developer clicked deploy, using its own roles.

Learn it: ECS and Fargate

Question 23How does output from Todo.io's containers on Fargate reach CloudWatch Logs?

Through the awslogs log driver set in the task definition, using the task execution role.Correct. Each container's output goes to a log stream in a log group you choose.Through CloudTrail.Not this one. CloudTrail records AWS API calls, not container output.By installing the CloudWatch agent on the host.Not this one. With Fargate you have no host to install anything on.By connecting to each task and copying the files.Not this one. There is no need; the log driver ships output as it happens.

Learn it: ECS and Fargate · CloudWatch Logs

Question 24How many execution roles does a Lambda function have?

Exactly one. Its permissions are everything the function's code can do in AWS.Correct. Give that one role only what the function needs.One per caller.Not this one. Who may call the function is set by its resource-based policy, not by extra roles.One per run.Not this one. Every run uses the same role.None. Functions get permissions from the account.Not this one. Nothing gets permissions just by being in an account.

Learn it: Lambda · IAM role

Question 25Todo.io's Lambda function prints log lines, but nothing appears in CloudWatch Logs. What is the most likely cause?

Its execution role doesn't allow writing logs (such as logs:CreateLogStream and logs:PutLogEvents).Correct. Lambda sends output to CloudWatch Logs automatically, using the function's own role.Lambda can't send logs anywhere.Not this one. It sends them to CloudWatch Logs by default.The CloudWatch agent isn't installed.Not this one. The agent is for EC2. Lambda needs nothing installed.CloudTrail is turned off.Not this one. CloudTrail records API calls; it isn't where function output goes.

Learn it: Lambda · CloudWatch Logs

Question 26Todo.io moves its API to Lambda. Which of these is still Todo.io's job?

The function's code and the permissions in its execution role.Correct. AWS runs the servers, the operating system and the scaling. What your code does, and what it is allowed to do, stay yours.Patching the operating system.Not this one. With Lambda there is no operating system for you to patch.Adding servers when traffic grows.Not this one. Lambda scales by itself.Replacing failed hardware.Not this one. Hardware is always AWS's job.

Learn it: Lambda

Question 27After Todo.io created its first RDS database, a role named AWSServiceRoleForRDS appeared. What is it?

A service-linked role that RDS uses to manage things like network interfaces for your databases.Correct. The service owns it: you can't change its permissions, and it only trusts RDS.A role someone created by mistake, which should be deleted.Not this one. RDS needs it. You can only delete it once RDS no longer uses it.The role the app uses to connect to the database.Not this one. The app connects with a database username and password.A role from IAM Identity Center.Not this one. Those are named AWSReservedSSO_…

Learn it: Service-linked role

Question 28A developer can create RDS databases, but creating one with an Enhanced Monitoring role fails with AccessDenied. What is missing?

Permission for iam:PassRole on the monitoring role.Correct. Handing a role to RDS is passing it, which needs iam:PassRole.The root user must create databases that have roles.Not this one. Root isn't needed; PassRole is.An SCP that allows RDS.Not this one. SCPs never grant anything.An inbound rule in the database's security group.Not this one. That is about network traffic, not about creating the database.

Learn it: iam:PassRole

Question 29How does Todo.io's app read and write DynamoDB?

With HTTPS API calls such as GetItem and PutItem, each signed and checked by IAM.Correct. There is no server and no connection to open: every request is an AWS API call.Over a long-lived database connection on port 3306.Not this one. That is MySQL. DynamoDB has no connections.By mounting the table as a disk.Not this one. Tables are reached through the API, never mounted.Through a security group rule on the table.Not this one. DynamoDB has no security groups; IAM decides.

Learn it: DynamoDB

Question 30Todo.io's app gets AccessDeniedException when it calls PutItem on the Todos table. What should be fixed?

The app's role needs a policy allowing dynamodb:PutItem on the Todos table's ARN.Correct. IAM checks every DynamoDB request, and AccessDenied means no policy allowed it.The table's security group.Not this one. DynamoDB has no security groups.The database password.Not this one. DynamoDB has no passwords; requests are signed with IAM credentials.The table is full and must be resized.Not this one. A full-table problem wouldn't be AccessDenied.

Learn it: DynamoDB · IAM policy

Question 31A Lambda function that isn't attached to a VPC writes to DynamoDB. Which security group is involved?

None. With no VPC there are no security groups, and DynamoDB has none either; IAM decides.Correct. Security groups only exist on network interfaces in a VPC.The VPC's default security group.Not this one. The function isn't in the VPC.The DynamoDB table's security group.Not this one. Tables have no security groups.The NAT gateway's security group.Not this one. There is no NAT gateway on this path, and NAT gateways don't take security groups.

Learn it: DynamoDB · Security group

Question 32A teammate asks what controls who can read objects in an S3 bucket. Which answer is right?

IAM policies on the caller, and the bucket policy on the bucket itself (a resource-based policy).Correct. The bucket policy names who may use the bucket. Block Public Access can override any rule that would make it public.A security group on the bucket.Not this one. Buckets have no security groups.The subnet the bucket is in.Not this one. Buckets aren't in subnets.IAM Identity Center.Not this one. Identity Center gives people roles in accounts; it doesn't set bucket permissions.

Learn it: S3 (Simple Storage Service) · IAM policy

Question 33Todo.io's app gets AccessDenied when it calls SendMessage on its queue. What should be fixed?

The app's role needs a policy allowing sqs:SendMessage on the queue's ARN.Correct. Sending to a queue is an AWS API call, approved by IAM.The queue's security group.Not this one. Queues have no security groups.The queue is full and must be emptied.Not this one. A full queue isn't the cause of AccessDenied.The visibility timeout.Not this one. That affects receiving, not sending.

Learn it: SQS (Simple Queue Service) · IAM policy

Question 34Someone tried to delete Todo.io's audit bucket, and IAM denied it. Does CloudTrail record the attempt?

Yes. CloudTrail records failed calls too, with the error.Correct. Denied attempts are often the most interesting events in an investigation.No. Only successful calls are recorded.Not this one. Failed calls are recorded too.Only if the attempt was made in the console.Not this one. Console, CLI and SDK calls are all recorded.Only if the caller used MFA.Not this one. Every call is recorded, with or without MFA.

Learn it: CloudTrail

Question 35Todo.io's app on EC2 writes log files, but nothing shows up in CloudWatch Logs. What is needed?

Install the CloudWatch agent on the instance, and allow the instance's role to write logs.Correct. EC2 doesn't send logs by itself. Lambda and Fargate do, but an instance is your server.Nothing; EC2 sends every file automatically.Not this one. It sends nothing until the agent is set up.Turn on CloudTrail.Not this one. CloudTrail records API calls, not files on an instance.Open an inbound port on the instance.Not this one. The agent sends logs out; nothing needs to come in.

Learn it: EC2 (Elastic Compute Cloud) · CloudWatch Logs

Question 36What does "MFA (multi-factor authentication)" mean?

A second proof of identity, like a code from an app or a security key, on top of a password.Correct. Think of it as: A PIN on top of the key card.The identity you sign in as with the account's email address. It can do almost anything; only an SCP can limit it.Not this one. That describes Root user.Groups many AWS accounts under one management account, with one bill and shared guardrails.Not this one. That describes AWS Organizations.A container for AWS resources, with its own identities and its own bill.Not this one. That describes AWS account.

Learn it: MFA (multi-factor authentication)

Question 37Which term is this? "A second proof of identity, like a code from an app or a security key, on top of a password."

MFA (multi-factor authentication)Correct. Yes. Think of it as: A PIN on top of the key card.Root userNot this one. Root user is: The identity you sign in as with the account's email address. It can do almost anything; only an SCP can limit it.AWS OrganizationsNot this one. AWS Organizations is: Groups many AWS accounts under one management account, with one bill and shared guardrails.AWS accountNot this one. AWS account is: A container for AWS resources, with its own identities and its own bill.

Learn it: MFA (multi-factor authentication)

Question 38Which AWS term is described by this analogy? "A PIN on top of the key card."

MFA (multi-factor authentication)Correct. Yes: A second proof of identity, like a code from an app or a security key, on top of a password.Root userNot this one. Root user is: The identity you sign in as with the account's email address. It can do almost anything; only an SCP can limit it. Its analogy: The master key to the whole building.AWS OrganizationsNot this one. AWS Organizations is: Groups many AWS accounts under one management account, with one bill and shared guardrails. Its analogy: The building management company that owns every flat.AWS accountNot this one. AWS account is: A container for AWS resources, with its own identities and its own bill. Its analogy: A flat in an apartment building. Separate locks, separate meter.

Learn it: MFA (multi-factor authentication)

Question 39What does "IAM (Identity and Access Management)" mean?

Decides who can do what to which AWS resource.Correct. Think of it as: The building's security office that issues every badge.An identity with permissions that something can "wear" temporarily. No password.Not this one. That describes IAM role.A JSON document listing allowed (or denied) actions on resources.Not this one. That describes IAM policy.The unique full name of an AWS resource.Not this one. That describes ARN (Amazon Resource Name).

Learn it: IAM (Identity and Access Management)

Question 40Which term is this? "Decides who can do what to which AWS resource."

IAM (Identity and Access Management)Correct. Yes. Think of it as: The building's security office that issues every badge.IAM roleNot this one. IAM role is: An identity with permissions that something can "wear" temporarily. No password.IAM policyNot this one. IAM policy is: A JSON document listing allowed (or denied) actions on resources.ARN (Amazon Resource Name)Not this one. ARN (Amazon Resource Name) is: The unique full name of an AWS resource.

Learn it: IAM (Identity and Access Management)

Question 41Which AWS term is described by this analogy? "The building's security office that issues every badge."

IAM (Identity and Access Management)Correct. Yes: Decides who can do what to which AWS resource.IAM roleNot this one. IAM role is: An identity with permissions that something can "wear" temporarily. No password. Its analogy: A visitor badge that's handed out at the door and expires.IAM policyNot this one. IAM policy is: A JSON document listing allowed (or denied) actions on resources. Its analogy: The list of rooms printed on the back of a badge.ARN (Amazon Resource Name)Not this one. ARN (Amazon Resource Name) is: The unique full name of an AWS resource. Its analogy: A full postal address, down to the flat number.

Learn it: IAM (Identity and Access Management)

Question 42What does "IAM role" mean?

An identity with permissions that something can "wear" temporarily. No password.Correct. Think of it as: A visitor badge that's handed out at the door and expires.Decides who can do what to which AWS resource.Not this one. That describes IAM (Identity and Access Management).A JSON document listing allowed (or denied) actions on resources.Not this one. That describes IAM policy.The unique full name of an AWS resource.Not this one. That describes ARN (Amazon Resource Name).

Learn it: IAM role

Question 43Which term is this? "An identity with permissions that something can "wear" temporarily. No password."

IAM roleCorrect. Yes. Think of it as: A visitor badge that's handed out at the door and expires.IAM (Identity and Access Management)Not this one. IAM (Identity and Access Management) is: Decides who can do what to which AWS resource.IAM policyNot this one. IAM policy is: A JSON document listing allowed (or denied) actions on resources.ARN (Amazon Resource Name)Not this one. ARN (Amazon Resource Name) is: The unique full name of an AWS resource.

Learn it: IAM role

Question 44Which AWS term is described by this analogy? "A visitor badge that's handed out at the door and expires."

IAM roleCorrect. Yes: An identity with permissions that something can "wear" temporarily. No password.IAM (Identity and Access Management)Not this one. IAM (Identity and Access Management) is: Decides who can do what to which AWS resource. Its analogy: The building's security office that issues every badge.IAM policyNot this one. IAM policy is: A JSON document listing allowed (or denied) actions on resources. Its analogy: The list of rooms printed on the back of a badge.ARN (Amazon Resource Name)Not this one. ARN (Amazon Resource Name) is: The unique full name of an AWS resource. Its analogy: A full postal address, down to the flat number.

Learn it: IAM role

Question 45What does "IAM policy" mean?

A JSON document listing allowed (or denied) actions on resources.Correct. Think of it as: The list of rooms printed on the back of a badge.An identity with permissions that something can "wear" temporarily. No password.Not this one. That describes IAM role.The unique full name of an AWS resource.Not this one. That describes ARN (Amazon Resource Name).Decides who can do what to which AWS resource.Not this one. That describes IAM (Identity and Access Management).

Learn it: IAM policy

Question 46Which term is this? "A JSON document listing allowed (or denied) actions on resources."

IAM policyCorrect. Yes. Think of it as: The list of rooms printed on the back of a badge.IAM roleNot this one. IAM role is: An identity with permissions that something can "wear" temporarily. No password.ARN (Amazon Resource Name)Not this one. ARN (Amazon Resource Name) is: The unique full name of an AWS resource.IAM (Identity and Access Management)Not this one. IAM (Identity and Access Management) is: Decides who can do what to which AWS resource.

Learn it: IAM policy

Question 47Which AWS term is described by this analogy? "The list of rooms printed on the back of a badge."

IAM policyCorrect. Yes: A JSON document listing allowed (or denied) actions on resources.IAM roleNot this one. IAM role is: An identity with permissions that something can "wear" temporarily. No password. Its analogy: A visitor badge that's handed out at the door and expires.ARN (Amazon Resource Name)Not this one. ARN (Amazon Resource Name) is: The unique full name of an AWS resource. Its analogy: A full postal address, down to the flat number.IAM (Identity and Access Management)Not this one. IAM (Identity and Access Management) is: Decides who can do what to which AWS resource. Its analogy: The building's security office that issues every badge.

Learn it: IAM policy

Question 48What does "Temporary credentials" mean?

Short-lived AWS keys handed out for a role, which expire automatically.Correct. Think of it as: A wristband that's only valid for today.The unique full name of an AWS resource.Not this one. That describes ARN (Amazon Resource Name).A role an AWS service creates and owns so it can act in your account on its own behalf.Not this one. That describes Service-linked role.A JSON document listing allowed (or denied) actions on resources.Not this one. That describes IAM policy.

Learn it: Temporary credentials

Question 49Which term is this? "Short-lived AWS keys handed out for a role, which expire automatically."

Temporary credentialsCorrect. Yes. Think of it as: A wristband that's only valid for today.ARN (Amazon Resource Name)Not this one. ARN (Amazon Resource Name) is: The unique full name of an AWS resource.Service-linked roleNot this one. Service-linked role is: A role an AWS service creates and owns so it can act in your account on its own behalf.IAM policyNot this one. IAM policy is: A JSON document listing allowed (or denied) actions on resources.

Learn it: Temporary credentials

Question 50Which AWS term is described by this analogy? "A wristband that's only valid for today."

Temporary credentialsCorrect. Yes: Short-lived AWS keys handed out for a role, which expire automatically.ARN (Amazon Resource Name)Not this one. ARN (Amazon Resource Name) is: The unique full name of an AWS resource. Its analogy: A full postal address, down to the flat number.Service-linked roleNot this one. Service-linked role is: A role an AWS service creates and owns so it can act in your account on its own behalf. Its analogy: A contractor's own access badge, issued and controlled by the contractor's company.IAM policyNot this one. IAM policy is: A JSON document listing allowed (or denied) actions on resources. Its analogy: The list of rooms printed on the back of a badge.

Learn it: Temporary credentials

Question 51What does "Service-linked role" mean?

A role an AWS service creates and owns so it can act in your account on its own behalf.Correct. Think of it as: A contractor's own access badge, issued and controlled by the contractor's company.Short-lived AWS keys handed out for a role, which expire automatically.Not this one. That describes Temporary credentials.The permission to hand an existing role to an AWS service.Not this one. That describes iam:PassRole.The unique full name of an AWS resource.Not this one. That describes ARN (Amazon Resource Name).

Learn it: Service-linked role

Question 52Which term is this? "A role an AWS service creates and owns so it can act in your account on its own behalf."

Service-linked roleCorrect. Yes. Think of it as: A contractor's own access badge, issued and controlled by the contractor's company.Temporary credentialsNot this one. Temporary credentials is: Short-lived AWS keys handed out for a role, which expire automatically.iam:PassRoleNot this one. iam:PassRole is: The permission to hand an existing role to an AWS service.ARN (Amazon Resource Name)Not this one. ARN (Amazon Resource Name) is: The unique full name of an AWS resource.

Learn it: Service-linked role

Question 53Which AWS term is described by this analogy? "A contractor's own access badge, issued and controlled by the contractor's company."

Service-linked roleCorrect. Yes: A role an AWS service creates and owns so it can act in your account on its own behalf.Temporary credentialsNot this one. Temporary credentials is: Short-lived AWS keys handed out for a role, which expire automatically. Its analogy: A wristband that's only valid for today.iam:PassRoleNot this one. iam:PassRole is: The permission to hand an existing role to an AWS service. Its analogy: Being allowed to lend your colleague's key card to a contractor.ARN (Amazon Resource Name)Not this one. ARN (Amazon Resource Name) is: The unique full name of an AWS resource. Its analogy: A full postal address, down to the flat number.

Learn it: Service-linked role

Question 54What does "iam:PassRole" mean?

The permission to hand an existing role to an AWS service.Correct. Think of it as: Being allowed to lend your colleague's key card to a contractor.A role an AWS service creates and owns so it can act in your account on its own behalf.Not this one. That describes Service-linked role.Short-lived AWS keys handed out for a role, which expire automatically.Not this one. That describes Temporary credentials.The unique full name of an AWS resource.Not this one. That describes ARN (Amazon Resource Name).

Learn it: iam:PassRole

Question 55Which term is this? "The permission to hand an existing role to an AWS service."

iam:PassRoleCorrect. Yes. Think of it as: Being allowed to lend your colleague's key card to a contractor.Service-linked roleNot this one. Service-linked role is: A role an AWS service creates and owns so it can act in your account on its own behalf.Temporary credentialsNot this one. Temporary credentials is: Short-lived AWS keys handed out for a role, which expire automatically.ARN (Amazon Resource Name)Not this one. ARN (Amazon Resource Name) is: The unique full name of an AWS resource.

Learn it: iam:PassRole

Question 56Which AWS term is described by this analogy? "Being allowed to lend your colleague's key card to a contractor."

iam:PassRoleCorrect. Yes: The permission to hand an existing role to an AWS service.Service-linked roleNot this one. Service-linked role is: A role an AWS service creates and owns so it can act in your account on its own behalf. Its analogy: A contractor's own access badge, issued and controlled by the contractor's company.Temporary credentialsNot this one. Temporary credentials is: Short-lived AWS keys handed out for a role, which expire automatically. Its analogy: A wristband that's only valid for today.ARN (Amazon Resource Name)Not this one. ARN (Amazon Resource Name) is: The unique full name of an AWS resource. Its analogy: A full postal address, down to the flat number.

Learn it: iam:PassRole

IAM

Worth another look

Your weak spots

Services

Concepts