Cloud+ V3 IAM Roles and Policies Basics

1. What is policy evaluation logic in IAM?

An explicit deny always overrides any allow

The first policy statement always wins

All policies must agree for access to be granted

Deny statements are ignored if allow exists

2. Which practice helps prevent privilege escalation in IAM?

Regularly reviewing and removing unnecessary permissions

Granting all permissions upfront

Using shared credentials for convenience

Disabling audit logging

3. What is the benefit of using IAM policy conditions?

They allow more granular control based on context

They eliminate the need for roles

They encrypt all communications

They automatically backup data

4. How should cross-account IAM access be implemented securely?

Use role assumption with explicit trust relationships

Share root account credentials

Create identical users in both accounts

Disable all cross-account permissions

5. What is a trust policy in the context of IAM roles?

A policy defining who can assume the role

A backup strategy for critical data

A network security group rule

A encryption standard for data

6. Which tool helps monitor and audit IAM activity in cloud environments?

Cloud Access Logs and CloudTrail

DNS servers

Load balancers

Virtual private networks only

7. What should you do if an IAM access key is accidentally exposed?

Continue using it; exposure is unlikely to cause harm

Rotate or delete it immediately and audit its usage

Change the key's name only

Notify the user but take no action

8. Why is MFA important in IAM security?

It encrypts all data automatically

It adds a second authentication factor beyond password

It increases network bandwidth

It eliminates the need for strong passwords

9. What is the 'Action' element in an IAM policy statement?

The specific API operations or actions allowed or denied

The user's job title

The date the policy takes effect

The notification method for policy changes

10. How can you implement temporary elevated permissions securely?

Use long-term access keys for all operations

Assume a role with higher privileges for limited duration

Share admin credentials with team members

Disable MFA for convenience

11. What is the primary purpose of an IAM role in cloud environments?

To define permissions and grant temporary access to resources

To store user passwords securely

To monitor network traffic between services

To encrypt data at rest

12. Which scenario demonstrates proper least privilege implementation?

Granting s3:* permissions to read one specific bucket

Granting s3:GetObject only for the specific bucket needed

Granting full admin access to all services

Creating a role with no restrictions for flexibility

13. What is the 'Resource' element in an IAM policy?

The ARN (Amazon Resource Name) of the cloud resource being accessed

The user's resource allocation quota

The backup location for data

The service region where the policy applies

14. How should sensitive IAM policies be protected?

Store them in plain text files

Use version control and require approval for changes

Share them with all team members

Keep them in public repositories

15. What is the difference between an IAM role and an IAM user?

Roles are temporary, users are permanent identities

Users cannot be assigned to resources

Roles require passwords, users do not

There is no difference; terms are interchangeable

16. Which of the following is a best practice for managing IAM roles?

Create one role with all permissions for simplicity

Regularly audit and remove unused roles and permissions

Use the same role for all team members

Grant permanent admin access to all services

17. Role-based access control (RBAC) assigns permissions based on what?

User's job function or role within the organization

User's IP address

Time of day the user logs in

User's email domain

18. What does the 'Effect' element in an IAM policy statement specify?

Whether the statement allows or denies the action

The time period for which access is valid

The user who created the policy

The region where the resource is located

19. An IAM policy document typically contains which elements?

Version, Statement, Effect, Action, Resource

Username, password, encryption key

Firewall rules, IP addresses, ports

Database credentials, connection strings

20. Which principle should guide IAM policy design in cloud security?

Grant all permissions by default

Least privilege access

Equal access for all users

Deny all administrative functions

Cloud+ V3 IAM Roles and Policies Basics Quiz