IAM Principals, Policies, and Least Privilege: 10 practice questions

Question 1 of 10

What does least privilege require when an IAM policy is written?

1. AGrant only required actions on specific resources under required conditions.
2. BGrant broad actions on every resource and rely on later monitoring.
3. CGrant permissions through an SCP because an SCP creates user access.
4. DGrant every action recorded in the account regardless of the task.

Question 2 of 10

What is an IAM user group?

1. AA collection of IAM users that can receive permissions from an attached policy
2. BA container that can include nested IAM user groups
3. CAn authenticated principal that can be named directly in any resource-based policy
4. DA temporary credential session assumed by an application

Question 3 of 10

Which IAM identity is designed to supply temporary credentials to an AWS workload?

1. AAn IAM user with a long-term access key embedded in the workload
2. BAn IAM role associated with the workload
3. CAn IAM user group attached directly to the compute resource
4. DA resource policy that generates a new access key at startup

Question 4 of 10

A break-glass process requires use of the AWS account root user. Which added sign-in control is recommended?

1. AMembership of the root user in an IAM user group
2. BMFA requiring the root credentials and a device-generated response
3. CA console role switch performed from the root user into a temporary administration role
4. DA resource policy naming an IAM group as the root Principal

Question 5 of 10

A legacy tool cannot use roles and requires an IAM user's long-term access key. What maintenance practice is supported?

1. AConvert the IAM user key into permanent AWS account root credentials for simpler recovery.
2. BLeave the key unchanged because long-term credentials cannot be updated.
3. CUpdate the key when needed and use last-used information to remove it safely.
4. DPlace the key in an IAM group so every member shares the credential.

Question 6 of 10

A team starts with an AWS managed policy but needs permissions tailored to one mature workload. What is the next step?

1. AKeep the broad AWS managed policy because it is automatically least privilege.
2. BMove the workload into an IAM group and remove every attached policy.
3. CDefine a customer managed policy reduced to the workload's actual use case.
4. DReplace the policy with an SCP that directly grants the workload access.

Question 7 of 10

A service resource must grant access directly to an authenticated identity in another account within the same AWS partition. Which policy placement fits?

1. AAttach an identity-based policy to an IAM group and name the group as Principal.
2. BAttach a resource-based policy to the resource and name the permitted principal.
3. CCreate a resource policy in another AWS partition and expect delegation to cross partitions.
4. DAttach an SCP to the resource so it grants the cross-account permission.

Question 8 of 10

A build service on AWS needs temporary credentials, while five human operators need the same permission set managed together. No long-term key may be embedded in the build. Which combination fits?

1. AUse a role for the build and a user group with an identity policy for the operators.
2. BUse one IAM user key for the build and share that user across the operators.
3. CUse a root session for the build and let every operator switch from root to a role.
4. DUse an IAM group for the build and separate resource policies with each group as Principal.

Question 9 of 10

Access Analyzer shows that a production role used only three actions on one resource. The current policy grants many services, and the team must preserve the observed task while reducing exposure. What should it do?

1. AKeep the broad policy and attach another organization-wide managed policy with additional services for redundancy.
2. BRemove every permission because the role should receive access from an SCP instead.
3. CGrant the three actions on every resource without testing the generated policy.
4. DGenerate and test a fine-grained policy from access activity, then deploy the narrowed policy.

Question 10 of 10

A bucket policy names an IAM user group in another AWS partition. The design needs direct resource access and must preserve the group as the named identity. Can it work as written?

1. ANo; a group is not a Principal, and resource-policy delegation cannot cross partitions.
2. BNo; resource policies can never grant cross-account access even within one partition.
3. CYes; groups are authenticated principals and partition boundaries do not affect policies.
4. DYes; a resource policy converts the group into a temporary role in the destination.