Free Identity and Access Management Practice Questions — AWS Certified Security

Question 1 of 6 · Domain 4: Identity and Access Management

A financial services company uses AWS Organizations with multiple AWS accounts. The security team needs to enforce that all IAM users across all accounts must use hardware MFA devices (not virtual MFA) and rotate their access keys every 60 days. The solution must generate compliance reports showing which users are non-compliant. Which approach provides the MOST operationally efficient solution?

AWS Config with managed rules access-keys-rotated (checks 90-day default but configurable to 60 days) and iam-user-mfa-enabled provides the foundation. Since no managed rule distinguishes hardware vs virtual MFA, a custom Config rule with Lambda is required to check the MFA device type via IAM APIs (GetMFADevice returns device metadata). Config aggregator consolidates compliance across all Organization accounts into a single view with built-in reporting. StackSets ensures consistent deployment across accounts. This is the most operationally efficient approach using native AWS compliance tooling.

Question 2 of 6 · Domain 4: Identity and Access Management

A company's application running on EC2 instances needs to access objects in an S3 bucket and send messages to an SQS queue. The security team requires that credentials never be stored on the instances, and they must implement least privilege access. An IAM role named AppRole exists with the following trust policy: { "Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Principal": {"Service": "ec2.amazonaws.com"}, "Action": "sts:AssumeRole", "Condition": { "StringEquals": {"aws:SourceAccount": "123456789012"} } }] } The instances are launched but cannot access S3 or SQS. What is the MOST likely cause?

Two separate issues must be resolved: (1) The IAM role must have permissions policies attached that grant the actual s3:GetObject and sqs:SendMessage permissions - the trust policy only controls WHO can assume the role, not WHAT the role can do. (2) The EC2 instances must have an instance profile attached that references AppRole - simply creating a role is insufficient; the role must be associated with instances via an instance profile (a container for the role). Both are required for the instances to successfully access AWS services.

Question 3 of 6 · Domain 4: Identity and Access Management

A startup is designing a multi-tenant SaaS application where each customer's data is isolated in separate DynamoDB tables with customer-specific prefixes (customer-A-data, customer-B-data, etc.). The application uses Amazon Cognito User Pools for authentication. The security architect needs to ensure that authenticated users can ONLY access their own customer's DynamoDB tables using temporary credentials. Which solution implements the MOST secure fine-grained access control?

This solution uses Cognito Identity Pools role-based access control (choosing roles based on token claims), which can map a custom:customer_id attribute from the User Pool token to select the appropriate IAM role. Each customer has a dedicated IAM role with a DynamoDB policy that uses the table name Resource condition (e.g., 'arn:aws:dynamodb:region:account:table/customer-${cognito-identity.amazonaws.com:aud}*') or more securely, separate predefined roles per customer with explicit table ARNs. The dynamodb:LeadingKeys condition can further restrict partition key access. This provides the most secure fine-grained isolation using native AWS IAM capabilities with true multi-tenancy support.

Question 4 of 6 · Domain 4: Identity and Access Management

A company uses AWS IAM Identity Center (formerly AWS SSO) integrated with Azure AD as the identity provider. The security team needs to implement a solution where users in the 'DatabaseAdmins' Azure AD group can assume an IAM role with administrative access to RDS across 15 AWS accounts in an Organization, but ONLY when they authenticate from the corporate network (IP range 203.0.113.0/24). The solution should minimize ongoing operational overhead. What is the MOST appropriate approach?

IAM Identity Center permission sets allow custom inline policies with Condition blocks. The Condition using IpAddress type with aws:SourceIp key for 203.0.113.0/24 enforces network-based access control. When assigned to the DatabaseAdmins group and deployed across multiple accounts (IAM Identity Center's core multi-account capability), this creates the required IAM roles automatically in each account with the proper conditions. This is operationally efficient because permission set changes propagate automatically to all assigned accounts, and the IP condition is enforced at the IAM policy level during role assumption and credential use.

Question 5 of 6 · Domain 4: Identity and Access Management

An enterprise application uses IAM roles with temporary credentials to access AWS services. The security team conducted a review and found that several EC2 instances are using credentials that have been active for 8+ hours, violating the company's 4-hour maximum session policy. The IAM role has the following configuration: Maximum session duration: 4 hours Permissions: AmazonS3ReadOnlyAccess managed policy The instances are running a Java application that creates an AmazonS3Client once at startup. What is the MOST likely cause and solution?

EC2 instance profile credentials retrieved from instance metadata (169.254.169.254) are temporary and include an expiration time. The AWS SDK default credential provider chain automatically retrieves and refreshes these credentials before expiration. However, if the application creates an AmazonS3Client object ONCE at startup and reuses it indefinitely, older SDK versions may not automatically refresh the underlying credentials after the client is instantiated. The solution is either: (1) Use a current SDK version with automatic credential refresh, (2) Use the default credential provider which handles rotation automatically, or (3) Implement explicit credential refresh logic by recreating the client or manually calling credential refresh methods before expiration. The 4-hour maximum session duration DOES apply to instance profile credentials, but the application must cooperate by refreshing credentials.

Question 6 of 6 · Domain 4: Identity and Access Management

A financial institution needs to grant a third-party auditing firm temporary access to read CloudTrail logs and AWS Config snapshots stored in an S3 bucket in the company's AWS account. The access must expire after exactly 7 days, require MFA authentication, and prevent the auditor from deleting or modifying any data. The auditor has their own AWS account. Which solution meets ALL requirements with the LEAST operational complexity?

This solution uses cross-account IAM role assumption (the standard AWS approach for third-party access). The external ID prevents confused deputy attacks. The maximum session duration can be set to 7 days (AWS supports 1-12 hours for user role sessions by default, but can be extended up to 12 hours for most cases; CORRECTION: maximum is 12 hours for role chaining/federation, but direct role assumption by IAM users/roles can use the role's configured duration up to 12 hours; for long-term expiration use SCP or time-based conditions). CORRECTION TO ANSWER: While maximum session duration is limited to 12 hours maximum, the time-based expiration should be handled by a Condition in the trust policy or permissions policy using DateLessThan with aws:CurrentTime, NOT by maximum session duration setting alone. The SecurityAudit managed policy provides read-only access to audit-related services including CloudTrail and Config. The MFA requirement in the trust policy Condition enforces authentication security. This is operationally simple (no manual deletion needed after 7 days if time-bound condition is used). CORRECTED: Option D as stated has a flaw - maximum session duration cannot be 7 days (max is 12 hours). However, re-reading the options, Option D is still the BEST answer IF we interpret it as requiring a trust policy condition with DateLessThan for the 7-day limit, which is the proper implementation.