AWS IAM Assessment

Single answer

What is the principle of least privilege in AWS IAM?

Every IAM user should have administrator access by default and permissions should be removed as needed

Grant only the permissions required to perform a task, and no more

All services should share a single IAM role for simplicity

Permissions should be granted at the account level rather than per resource

Single answer

What is the difference between an IAM Role and an IAM User?

IAM Users have permanent credentials; IAM Roles provide temporary credentials assumed by trusted entities

IAM Roles are for human users; IAM Users are for AWS services

IAM Users can be assumed by EC2 instances; IAM Roles cannot

There is no difference; Roles and Users are interchangeable

Multiple answers

Which of the following can assume an IAM Role?

An EC2 instance

An AWS Lambda function

An IAM User from another AWS account

An on-premises application using STS

Single answer

What does an IAM policy's Effect: Deny statement do when it conflicts with an Effect: Allow statement?

The Allow takes precedence

The Deny takes precedence — explicit Deny always overrides Allow

The most recently attached policy takes precedence

The conflict results in a runtime error

Single answer

What is an IAM Permission Boundary?

A hard limit on the number of IAM policies that can be attached to a user or role

A managed policy that sets the maximum permissions an IAM entity can have, regardless of other attached policies

A firewall rule that prevents certain API calls from specific IP ranges

A Service Control Policy applied at the AWS Organization level

Single answer

What is the purpose of AWS STS (Security Token Service)?

To store and rotate long-term credentials for IAM users

To issue temporary, limited-privilege credentials for AWS resources

To audit all API calls made within an AWS account

To manage MFA device registration for IAM users

Multiple answers

Which of the following are best practices for the AWS account root user?

Enable MFA on the root user

Use the root user for day-to-day administrative tasks

Do not create access keys for the root user

Share root user credentials with the security team for emergency access

Single answer

An IAM policy with no explicit Allow or Deny defaults to allowing the action.

True

False

Single answer

What is an AWS Service Control Policy (SCP)?

A policy attached to an IAM role that restricts which services it can call

A policy applied at the AWS Organizations level that sets maximum permission guardrails for all accounts in an OU or the entire organisation

A resource-based policy attached to an S3 bucket

A network policy that restricts which AWS services are reachable from a VPC

Multiple answers

Which of the following are valid components of an IAM policy statement?

Effect (Allow or Deny)

Action (e.g. s3:GetObject)

Resource (e.g. ARN of a bucket)

Priority (numeric value determining evaluation order)