Every IAM user should have administrator access by default and permissions should be removed as needed

Grant only the permissions required to perform a task, and no more

All services should share a single IAM role for simplicity

Permissions should be granted at the account level rather than per resource

IAM Users have permanent credentials; IAM Roles provide temporary credentials assumed by trusted entities

IAM Roles are for human users; IAM Users are for AWS services

IAM Users can be assumed by EC2 instances; IAM Roles cannot

There is no difference; Roles and Users are interchangeable

An EC2 instance

An AWS Lambda function

An IAM User from another AWS account

An on-premises application using STS

The Allow takes precedence

The Deny takes precedence — explicit Deny always overrides Allow

The most recently attached policy takes precedence

The conflict results in a runtime error

A hard limit on the number of IAM policies that can be attached to a user or role

A managed policy that sets the maximum permissions an IAM entity can have, regardless of other attached policies

A firewall rule that prevents certain API calls from specific IP ranges

A Service Control Policy applied at the AWS Organization level

To store and rotate long-term credentials for IAM users

To issue temporary, limited-privilege credentials for AWS resources

To audit all API calls made within an AWS account

To manage MFA device registration for IAM users

Enable MFA on the root user

Use the root user for day-to-day administrative tasks

Do not create access keys for the root user

Share root user credentials with the security team for emergency access

True

False

A policy attached to an IAM role that restricts which services it can call

A policy applied at the AWS Organizations level that sets maximum permission guardrails for all accounts in an OU or the entire organisation

A resource-based policy attached to an S3 bucket

A network policy that restricts which AWS services are reachable from a VPC

Effect (Allow or Deny)

Action (e.g. s3:GetObject)

Resource (e.g. ARN of a bucket)

Priority (numeric value determining evaluation order)