AWS Security Specialty IAM Authorization Strategies

1. Which element specifies the actions that are allowed or denied in an IAM policy?

Principal

Resource

Action

Condition

2. The NotAction element in an IAM policy denies all actions except those specified. True or false?

True

False

3. An IAM access policy and a resource policy both grant access to an S3 bucket. Which is required?

Both must allow the action

Only the access policy matters

Only the resource policy matters

Either one can grant access

4. Which condition operator allows matching multiple values in an IAM policy condition?

StringEquals

StringLike

StringLikeIfExists

StringEqualsIfExists

5. What is the purpose of the 'Resource' element in an identity-based IAM policy?

Specifies which AWS resources the policy applies to

Defines which principals can access the policy

Sets conditions for policy evaluation

Determines the policy's expiration date

6. IAM roles can be assumed by users, services, and external identities. True or false?

True

False

Submit

8. Which AWS service should you use to audit and monitor IAM policy changes?

AWS CloudTrail

AWS Config

IAM Access Analyzer

All of the above

9. What is the maximum size of an IAM policy document?

2 KB

5 KB

10 KB

20 KB

10. Session policies are temporary policies applied when assuming a role via STS. True or false?

True

False

11. Which IAM policy type is attached directly to a user, group, or role?

Resource-based policy

Identity-based policy

Session policy

Boundary policy

12. What does the AssumeRole action allow in IAM?

A principal to temporarily use permissions of another role

A role to create new users

A user to modify resource policies

A service to delete other roles

13. An explicit Deny in an IAM policy always overrides any Allow statements. True or false?

True

False

14. Which condition key restricts IAM actions based on the source IP address?

Aws:SourceArn

Aws:SourceIp

Aws:IpAddress

Aws:RequestedRegion

15. What is the correct format for an IAM policy Principal element in a resource-based policy?

"Principal": "arn:aws:iam::123456789012:user/name"

"Principal": {"AWS": "arn:aws:iam::123456789012:role/name"}

"Principal": "123456789012"

"Principal": "*"

16. Which AWS service allows you to define trust relationships for cross-account access?

IAM policies and role trust policies

AWS Organizations only

VPC security groups

AWS Config

17. In IAM policy evaluation, what is the default behavior when no explicit Allow exists?

Allow the action

Deny the action

Request approval from administrator

Allow with conditions

18. What does the 'Effect' element in an IAM policy determine?

Which principal can assume the role

Whether the policy allows or denies actions

The time period for which the policy is valid

The AWS region where the policy applies

19. Which statement best describes the principle of least privilege?

Grant all permissions by default, then restrict

Grant only the minimum permissions needed to perform a task

Deny all cross-account access

Use wildcards for all resource ARNs

20. What is the primary purpose of a permission boundary in IAM?

Grant permissions to cross-account resources

Set the maximum permissions an identity can receive

Enforce MFA for all API calls

Log all IAM policy changes

AWS Security Specialty IAM Authorization Strategies Quiz

1. Which element specifies the actions that are allowed or denied in an IAM policy?

2.

What first name or nickname would you like us to use?

2. The NotAction element in an IAM policy denies all actions except those specified. True or false?

3. An IAM access policy and a resource policy both grant access to an S3 bucket. Which is required?

4. Which condition operator allows matching multiple values in an IAM policy condition?

5. What is the purpose of the 'Resource' element in an identity-based IAM policy?

6. IAM roles can be assumed by users, services, and external identities. True or false?

7. A resource-based policy can grant access to principals in different AWS____.

8. Which AWS service should you use to audit and monitor IAM policy changes?

9. What is the maximum size of an IAM policy document?

10. Session policies are temporary policies applied when assuming a role via STS. True or false?

11. Which IAM policy type is attached directly to a user, group, or role?

12. What does the AssumeRole action allow in IAM?

13. An explicit Deny in an IAM policy always overrides any Allow statements. True or false?

14. Which condition key restricts IAM actions based on the source IP address?

15. What is the correct format for an IAM policy Principal element in a resource-based policy?

16. Which AWS service allows you to define trust relationships for cross-account access?

17. In IAM policy evaluation, what is the default behavior when no explicit Allow exists?

18. What does the 'Effect' element in an IAM policy determine?

19. Which statement best describes the principle of least privilege?

20. What is the primary purpose of a permission boundary in IAM?