4. [H] IAM, Accounts and AWS Organisations

An engineer is designing an IAM policy. Which of the following elements is optional but recommended for each statement within the policy?

An IAM policy contains two statements: one allowing full access to S3 and another denying all actions on a specific S3 bucket. What is the effective permission for actions on that specific bucket?

In an IAM policy, what component is used to define whether the policy will allow or deny access to specified resources and actions?

You are tasked with granting temporary permissions to an application running on an EC2 instance to access an S3 bucket. The security team requires that the credentials used should automatically rotate and not be stored directly. Which IAM construct should you use?

A company wants to give a third-party application access to specific AWS resources, but the number of principals accessing AWS is high and unidentified. Which IAM entity is best suited for this use case?

Which AWS service provides a secure method to grant access to AWS resources leveraging security best practices, like temporary credentials, but still allowing for cross-account access?

You need to allow a workload running inside of your AWS account to be assumed by an external identity, which two types of policies would you need to have configured?

A security engineer is setting up IAM permissions for a new project. They need to ensure that no matter what permissions are added in the future, developers can never terminate EC2 instances. What approach should they take?

An application running on EC2 needs to access S3. Which identity should be used avoid hardcoding static credentials?

A company is designing its IAM strategy. They want to ensure that they follow the principle of least privilege while minimizing administrative overhead. The company has a team dedicated to access management. Which AWS IAM capability allows for the separation of who creates roles from who can assume them?

A company uses AWS Organizations with multiple accounts. They need to prevent developers from using specific resource types in all accounts. What is the MOST effective way to achieve this?

A large organization with thousands of employees wants to integrate their existing on-premises Active Directory with AWS to manage access to AWS resources. Which approach should they use to avoid exceeding IAM limits, like the limit on total number of users?

Your company is implementing IAM roles within their AWS environment in order to leverage security best practices and are unsure where to start. Which one of the following AWS documented IAM reference architectures is the correct one to choose?

You want to create a mechanism that creates cloud infrastructure in your different AWS accounts which is very common that many organizations do. You decide to enforce a common account creation solution for developers that is designed to standardize the creation of new accounts with a pre-defined baseline. Which one of the following tools is most appropriate?

You are a security engineer setting up AWS Control Tower. You need to ensure that all S3 buckets are encrypted by default and that no user can disable this encryption. What type of guardrail should you implement?

An organization is setting up AWS Control Tower. They require a centralized location to perform security audits across all accounts in their Landing Zone. Which action best supports their requirement?

When creating a service-linked role, what is typically the format of the resource element at the end of the AWS ARN?

What is the primary distinction between a service-linked role and a regular IAM role?

What is the effect of attaching a service control policy with an explicit deny statement to the root of an AWS Organization?

A company wants to enforce a policy that all new S3 buckets created in any of their AWS accounts be in the us-east-1 region. The company wants to use a central configuration across all accounts. Given these requirements, which is the BEST way for the company to enforce this policy?

In AWS Organizations, how does consolidated billing affect the individual billing methods of member accounts?

A security engineer is tasked with implementing centralized logging and auditing across all AWS accounts in an AWS Organization. Which AWS service is MOST suited for collecting a comprehensive record of all API calls made within each account?

You have configured a CloudTrail trail to send logs to an S3 bucket. However, you're missing log data for global services like IAM. What do you need to do to ensure that a trail is picking up the global events?

You need to audit and secure your AWS infrastructure, what is the tool within the AWS ecosystem that would give you insight if someone were performing an ec2:RunInstances call?

CloudTrail has just been configured to deliver to cloudwatch logs. You’ve noticed that every log group is being flagged as non-compliant. Which tool should be incorporated for security compliance checks?

An organization has implemented CloudTrail for logging API activity. They want to set up real time alerting. How can the alerts be accomplished?

What does a CloudTrail trail configured for all regions provide?

IAM, STS, and CloudFront are global services; where are their logged data captured?

Your company has recently set up a new AWS multi-account environment using AWS Organizations. The company also has a requirement to restrict all existing and new AWS regions which are to be set in the environment, which one of the following AWS services is best used in such circumstance?

You are setting up Control Tower in your organization to better manage multi-account environments. When completing a Control Tower setup, which accounts are implemented inside the foundational units?

Now that you've gone ahead and enabled AWS organizations and you wanted to set an implicit denier for an S3 bucket, which list would apply?

Given an environment where AWS Organizations and SCPs are in place, which action is NOT permissible?

The most effective technique for maintaining governance and account access management at scale is to set a landing zone; what are two examples of things that are included?

You are a security engineer in an AWS environment using Control Tower. What is a key consideration when designing preventative and detective controls in AWS?

You need to setup an organization configuration and need all accounts to use the same networking setup. What tool should you use?

What is the purpose of the AWS account root user?

What level of access management is offered to specific or special rights?

Why would you want to use IAM user accounts instead of AWS roles within your applications?

You have an emergency or out of usual state scenario. In your security structure, what is another situation where roles might be useful and helpful?

You want to allow some of your identities in one AWS account to access a certain object in another AWS account. Which statement best facilitates a simple architecture for setting up credentials to interact with objects in another AWS account?

You want to reuse your on-premise identities to assume other AWS roles in such a manner as to not require further authentication prompts. What is this process known as?

Which are the best services to integrate into your applications that have millions of users for permissioning?

To store data into a CloudWatch Log group from a Linux operating system, which of the following configuration steps are required?

In AWS IAM, what determines if a statement will grant or deny access to the specified resources and actions?

When multiple IAM policies apply to a single AWS identity, and one policy allows an action while another explicitly denies it, which policy takes precedence?

How does AWS evaluate IAM policies when a user attempts to access a resource, and multiple policies apply?

You are managing IAM permissions for a new application and need to restrict access to a particular S3 bucket, in which the objects themselves should also be secured, which ARN will apply?

What is the significance of using a double colon (::) in an ARN within AWS IAM policies?

Which of the following statements accurately describes the relationship between IAM users and IAM groups?

Which of the following statements correctly differentiates between IAM users and IAM roles within AWS?

In the context of AWS IAM, which of the following is a key benefit of using roles over IAM users?

When should you use an inline policy?

What is a primary difference between AWS-managed policies and customer-managed policies?

What is the maximum number of IAM users allowed per AWS account?

An application error reporting that it has failed login attempts on million different users, when the architecture uses IAM to specify each individual user. What is the next appropriate action?

What condition must be present for external on-premise services to interact with resources in an AWS account?

Can IAM groups be considered a true identity from a resource based permissions perspective?

What is the maximum number of IAM groups that an IAM user can be a member of?

You are tasked to design a scalable solution for managing permissions in AWS for a large organization. How should you apply the permissions model, if your goal is least privilege?

What are the two aspects needed to effectively implement an IAM role?

Consider a scenario where you need to log into one AWS account, without login into them again. Which product within the AWS ecosystem will allow you to log into one account in that organization?

In a multi-account AWS environment, your organization decides to implement a role-based access strategy to allow developers in a central 'Developer' account to manage resources in various 'Application' accounts. Which configuration steps must be taken?

Which AWS service is best capable of generating short term credentials required to assume an IAM role?

When designing a secure architecture for applications running on EC2 what is the most relevant step?

When working with multi-account permissions, what action needs to first occur before AWS services can act on you behalf?

You work with a business service desk team, and want to give them read-only access to your AWS account to maintain performance and stop/start instances. What IAM action can you use?

What are possible examples of when Roles are useful to implement in your application?

You are integrating AWS with an existing corporate environment, each of which the existing logins has access to a variety of systems. What AWS product will allow staff single sign-on?

When designing a popular mobile application with millions of users, what tool can be leveraged to allow users to sign in using web identity.

You have a partner organization wanting to offer an application to process scientific data, and you need to store data inside an S3 bucket. Instead of your partner creating IAM users, what can your developers do to upload objects?

What statements below are true regarding a service-linked role?

Can one member configure service links on one role, and another can edit that Role, but not create a role?

You are the lead of cloudformation, and do not want to manage certain IAM configurations. How can developer implement IAM configurations?

How can AWS Organizations be used?

What statement listed below is true about a standard AWS account?

What are the two requirements needed to create a new organizational account with a single email?

When creating an AWS account and adding it to your organization, what action is required from the pre-existing account/invite process?

You are working on the organizational unit with an environment. Why would you prefer IAM roles vs. a single AWS account?

What AWS Organization product lets you enforce requirements with set policies?

You are designing a production environment with multi-account capabilities. Should you manage the AWS management account yourself and not used for AWS resources?

What is the two-part process for setting a service control policy?

When CloudTrail is configured but the data is not being received from the tool, what should the user consider?

When utilizing CloudTrail, you want to look everything in CloudTrail right as it occurs, how can this goal be achieved?

Where is the default trail configured on AWS?

For CloudWatch Logs, the log endpoint is housed on AWS public zone, but is considered outside of AWS. What tool is commonly used to solve this?

Which AWS service does AWS Control Tower utilize for multi-account structure?

When implementing AWS Control Tower, which product has limited control?

Which statement appropriately describes a guardrail?

Which scenario represents the MOST secure and operationally efficient method for granting AWS Lambda functions access to other AWS resources?

Given a scenario where an organization wants to enforce granular restrictions on which AWS services and actions can be used within their accounts, even by the root user, which AWS Organizations feature should they leverage?

An organization with a diverse set of AWS accounts needs a unified solution for identifying and addressing misconfigurations related to security and compliance. Which strategy offers the MOST comprehensive visibility and remediation capabilities?

A security engineer is tasked with setting up long-term storage and analysis of AWS account activity logs. Which approach provides the MOST comprehensive solution while optimizing for cost and security?

An organization needs to provide its security team with the ability to investigate unusual API activity across all AWS accounts. Which logging and monitoring configuration would support the near real-time assessment of unusual patterns?

Which AWS Organizations feature offers the MOST direct method to centrally manage and enforce the regions in which AWS resources can be provisioned across all accounts?

In an environment managed by AWS Control Tower, how can you programmatically create new accounts that automatically conform to the organization's established security and networking baselines?

When using AWS Organizations, what is the impact of applying a Service Control Policy (SCP) that explicitly denies access to a specific service to the root of the organization?

An organization with a large number of existing on-premises identities wants to enable seamless AWS access without duplicating users in IAM or requiring them to re-authenticate. What architectural approach offers the MOST scalable and secure solution?

A company is designing a mobile application that will be used by millions of users. What is the MOST appropriate method for authenticating these users with AWS resources?

A company needs to grant access to resources in their AWS account to a partner organization. The partner organization has its own AWS accounts and IAM users. How can this be achieved MOST securely?

What is the KEY factor that determines whether an all-regions AWS CloudTrail trail captures global service events, such as those produced by IAM?

A company wants to implement a policy that automatically encrypts all S3 buckets created in their AWS environment and prevents users from disabling this encryption. Which AWS service and feature would BEST meet this requirement?

An organization has several AWS accounts organized using AWS Organizations and requires a centralized, immutable record of all API calls made within each account for compliance purposes. Which of the following services would BEST support this requirement?

An administrator is tasked with troubleshooting an application error and needs to determine which IAM role was used by an EC2 instance when making calls to DynamoDB. Which AWS service provides the MOST detailed information about the identity used for each API call?