Federated Identity, Roles, and Cross-Account Access: 10 practice questions

Question 1 of 10

What credentials do federated human users receive when they assume an IAM role?

1. ALong-term IAM user access keys created in every account
2. BAn SCP that directly grants access to the requested service
3. CTemporary AWS credentials limited by the assigned role
4. DPermanent root credentials for the destination AWS account

Question 2 of 10

Which IAM Identity Center instance type can manage access to AWS accounts?

1. AA destination-account IAM user created for every workforce member
2. BA role session created by calling AWS STS AssumeRole
3. CAn organization instance deployed through the AWS Organizations management account
4. DAn account instance bound to an isolated application deployment

Question 3 of 10

What does the AWS STS AssumeRole API return?

1. ATemporary security credentials for the requested role session
2. BA new IAM user in the account that owns the role
3. CA permanent access key attached to the caller's IAM identity
4. DA resource-based policy attached to the destination resource

Question 4 of 10

What happens to a console user's original permissions while the user has switched to a role?

1. AThey remain active and are added simultaneously to the role permissions for the session.
2. BThey are replaced by the role permissions until the user exits the role.
3. CThey remain active only for resources in the originating account.
4. DThey are permanently deleted from the user's originating identity.

Question 5 of 10

Where is a role normally created to delegate access to resources in another AWS account?

1. AIn both accounts as two identical roles with the same credentials
2. BIn the originating account, with trust for the destination resources
3. CIn the AWS Organizations management account as an SCP
4. DIn the destination account, with trust for the originating account

Question 6 of 10

A company wants to reuse users and groups from its existing workforce directory in AWS. Which federation path is supported?

1. ARepresent each directory group as the Principal in a resource policy.
2. BCreate a separate AWS account root user for each directory group and share those long-term credentials.
3. CAttach an SCP to the directory so it issues temporary credentials.
4. DConnect the identity provider to IAM Identity Center and synchronize directory identities.

Question 7 of 10

Which mechanism fits an application that needs programmatic cross-account access without long-term credentials?

1. ACreate a permanent root access key in the destination account.
2. BCall AWS STS AssumeRole and use the returned temporary credentials.
3. CAttach an SCP that returns credentials when the application starts.
4. DUse console Switch Role and keep the browser session as an application secret.

Question 8 of 10

A company already federates workforce access to AWS accounts through IAM. It now needs centralized access to AWS managed applications, but account teams cannot change their current sign-in workflow this quarter. What should it do?

1. AReplace every existing federation path immediately with separate long-term destination-account IAM users for the workforce.
2. BIntroduce IAM Identity Center for application access and keep the existing IAM federation for accounts.
3. CUse AWS STS alone as the directory and managed-application access portal.
4. DCreate Identity Center account instances and use them to centrally assign all AWS accounts.

Question 9 of 10

Developers in an originating account need temporary write access to one bucket in a destination account, while analysts from the same origin must fail. No duplicate destination users are allowed. Which design satisfies the constraints?

1. ACreate one destination IAM user with shared long-term keys for both teams.
2. BGrant both teams the destination role and rely on their original permissions during switching.
3. CTrust the originating account in the destination role and omit all origin-side AssumeRole permissions.
4. DCreate a limited destination role, trust the origin, and allow only developers to assume it.

Question 10 of 10

An operator switches to a production role for a narrow task and must not retain development privileges during that session. After the task, the operator needs the original privileges back. What behavior provides this?

1. ARole switching keeps development permissions active and adds only denied production actions.
2. BRole switching activates only production-role permissions, then restores the original set on exit.
3. CRole switching combines the full development and production permission sets until both sessions expire together.
4. DRole switching permanently replaces the operator's originating permissions.