Timedora
Free Practice Quiz Question List

2 Users, Groups, and Roles Online Quiz Questions

Use this free practice quiz with 20 questions to review 2 Users, Groups, and Roles, test your knowledge, and prepare for your next test or exam.

20 questions
01
True or false
1 point

True or false: A newly created IAM user has no permissions by default.

  1. A

    True

  2. B

    False

02
Choose one
1 point

Several IAM users need the same permissions. Which identity type lets an administrator manage those shared permissions in one place?

  1. A

    An IAM role

  2. B

    An IAM user group

  3. C

    An IAM user

03
Fill in the blank
1 point

An IAM user can be a member of .

04
Written response
1 point

When federation or a role cannot meet a specific requirement, what IAM identity can provide an individual identity in one AWS account?

05
True or false
1 point

True or false: An IAM user group can contain IAM roles as members.

  1. A

    True

  2. B

    False

06
Choose one
1 point

An organization is planning human access to AWS. Which approach does AWS recommend where possible?

  1. A

    Create an IAM user with long-term credentials for every person.

  2. B

    Use an IAM group so people can sign in as the group.

  3. C

    Use federation and temporary credentials where possible.

  4. D

    Create an IAM role with a permanent password for each person.

07
Written response
1 point

A person needs temporary access to AWS for a task. Which IAM identity type is designed to be assumed for temporary access?

08
Fill in the blank
1 point

Complete the description of an IAM role: its trust policy says , and its permissions policy says .

09
Choose all
1 point

Select all statements that correctly describe an IAM role.

  1. A

    A role is not tied to one person.

  2. B

    A trusted entity can assume a role and receive temporary session credentials.

  3. C

    A role has standard long-term passwords and access keys.

  4. D

    A role cannot be assumed by an application.

10
Choose one
1 point

An application running on an AWS compute service needs to read a particular S3 bucket. When configuring its service role, what should you verify about the role's trust policy?

  1. A

    Verify that the service has permanent IAM user access keys.

  2. B

    Verify that the intended AWS service is trusted by the role.

  3. C

    Make the role's trust policy allow every AWS service.

  4. D

    Add the service to an IAM user group.

11
Choose all
1 point

Select all situations in which an IAM role is a commonly appropriate choice.

  1. A

    An AWS service needs access to another AWS service.

  2. B

    A person needs temporary or elevated access for a task.

  3. C

    A user or workload in another AWS account needs authorized access.

  4. D

    A federated user needs to access AWS.

  5. E

    A person needs an IAM identity with permanent credentials when federation is available.

12
Choose one
1 point

An employee changes jobs. Which action best follows IAM access-management guidance?

  1. A

    Keep all existing memberships and add the new job's group.

  2. B

    Delete the user and recreate them without reviewing access.

  3. C

    Remove unneeded group memberships, add appropriate ones, and review direct permissions and role access.

  4. D

    Replace the user's IAM identity with a group.

13
Choose one
1 point

A specific requirement calls for a console-only IAM user. Which credential choice follows the guidance to create only what the user needs?

  1. A

    Create both a console password and access keys in every case.

  2. B

    Create only the credentials required for console access.

  3. C

    Create access keys but no console password.

  4. D

    Give the user the group's credentials.

14
True or false
1 point

True or false: A newly created IAM user has permissions by default.

  1. A

    True

  2. B

    False

15
Choose one
1 point

Several IAM users need the same limited set of permissions. Which approach lets you manage those shared permissions in one place?

  1. A

    Create a separate IAM role for each person.

  2. B

    Put the IAM users in a group and attach the shared permissions policy to that group.

  3. C

    Give each user long-term access keys with the same permissions.

  4. D

    Create a group for the users and attach a policy that grants every AWS permission.

16
Written response
1 point

A user needs console access only. What credential type does this user not need?

17
Written response
1 point

Which IAM role policy specifies who or what is allowed to assume the role?

18
Choose one
1 point

An application running on an AWS compute service needs to read one S3 bucket. Which approach best provides that access?

  1. A

    Create an IAM group for the application and attach the bucket policy to it.

  2. B

    Create an IAM user with long-term access keys and embed them in the application.

  3. C

    Create a role trusted by the AWS service and grant only the required bucket access.

  4. D

    Create an IAM user without credentials and add it to a group.

19
Choose one
1 point

After an entity assumes an IAM role, which policy determines what actions its role session may perform?

  1. A

    The permissions policy

  2. B

    The trust policy

  3. C

    The IAM group membership list

  4. D

    The IAM user's console password policy

20
Open ended
1 point

A department wants to prepare its IAM access setup before its employee roster is finalized. Describe how it can prepare a group for the department’s job function and what happens when employees are added later.