Identity and access management
Practise only this domain. 54 questions with explanations, 20 at a time.
Start this domainSample questions
- A partner's integration generates a presigned download link using its own IAM role. The partner downloads over plain HTTP and receives AccessDenied. The link has not expired, and the role holds s3:GetObject permission. What explains the denial?Hard
- Auditors require that privileged administrators who make sensitive IAM changes, whether from the console or the CLI, must have authenticated with a second factor. Which control enforces this across administrative roles?Easy
- A vendor's consultant needs read access and a few narrow write actions in one application account for about two weeks. Security wants access to end automatically, MFA required for every session, and no long-lived credentials. Which design fits?Medium
- An application on an EC2 instance needs to read from an S3 bucket. Which credential approach should be used?Easy
- Developers should be able to manage only the EC2 instances tagged with their own department. Which condition setup expresses that?Hard
- Which statement correctly describes the second factors that can be registered for an IAM user in AWS?Easy