Timedora
Free Practice Quiz Question List

3 Policies and Permissions Online Quiz Questions

Use this free practice quiz with 20 questions to review 3 Policies and Permissions, test your knowledge, and prepare for your next test or exam.

20 questions
01
Choose one
1 point

An identity-based policy allows s3:GetObject on objects beneath arn:aws:s3:::example-reports/quarterly/*. A principal then requests s3:ListBucket on arn:aws:s3:::example-reports. Does that statement allow the request?

  1. A

    Yes. An allow for s3:GetObject on objects under the bucket prefix also allows listing the bucket.

  2. B

    No. The request is for s3:ListBucket on the bucket ARN, but the policy allows s3:GetObject on object ARNs.

  3. C

    Yes. Any action on an object ARN also permits the corresponding action on its bucket.

  4. D

    No. IAM policies cannot grant access to S3 buckets.

02
True or false
1 point

A request matches both an applicable Allow statement and an applicable explicit Deny statement. Is the request allowed?

  1. A

    True

  2. B

    False

03
Choose one
1 point

A role’s identity-based policy allows an action on a resource, but its permissions boundary does not allow that action. Can the role use the identity-based permission?

  1. A

    The role can use the permission because an Allow in its identity policy is sufficient.

  2. B

    The role cannot use the identity-based permission because the boundary does not allow the action.

  3. C

    The boundary grants the action even though it does not allow it.

  4. D

    The role can use the permission unless the boundary explicitly denies it.

04
Choose all
1 point

Select all the request details that should be matched against applicable IAM policies when evaluating an access decision.

  1. A

    The principal making the request

  2. B

    The display name of the policy document

  3. C

    The requested action

  4. D

    The target resource

  5. E

    The policy’s creation date

  6. F

    Relevant conditions

05
Written response
1 point

What two-word term describes IAM’s default denial when no applicable Allow grants access?

06
Fill in the blank
1 point

In a resource-based policy, the field identifies the user, role, account, or other principal the policy addresses.

07
Written response
1 point

Which policy type can limit permissions for a session but does not grant permissions by itself?

08
Fill in the blank
1 point

Service control policies set permission limits for principals in organization accounts, but they do not permissions by themselves.

09
Choose all
1 point

For a same-account request, select all statements that accurately describe how identity-based and resource-based policies may affect access.

  1. A

    An identity-based policy and a resource-based policy can both contribute an Allow.

  2. B

    A resource-based Allow always overrides an applicable explicit Deny.

  3. C

    Applicable limits and explicit denies can still affect the result.

  4. D

    Every allow and boundary is evaluated identically regardless of the principal named in a resource policy.

10
Open ended
1 point

An AWS request returns AccessDenied even though one policy appears to allow it. Describe a systematic troubleshooting approach, including what to verify about the request, what policy controls to inspect, and how to use the policy simulator appropriately.

11
True or false
1 point

True or false: Because the IAM policy simulator tests selected policies and context values without sending a request to the service, a successful simulation proves that every real request with those inputs will succeed.

  1. A

    True

  2. B

    False

12
Choose one
1 point

A request is denied even though a policy attached to a role appears to allow the action. What should you verify first about the request’s identity?

  1. A

    Assume the role’s permissions are identical for every session and account.

  2. B

    Confirm whether the request uses the intended user or assumed-role session and the expected account.

  3. C

    Check only the resource owner’s policies because the principal is already known.

  4. D

    Ignore the session identity if an Allow appears in any policy.

13
Written response
1 point

For an ordinary AWS request, what is the default access decision when no applicable policy allows the requested action on the resource?

14
Choose one
1 point

An identity-based policy allows s3:GetObject on arn:aws:s3:::reports/quarterly/*. A user requests s3:GetObject on an object in the archive bucket. Why does this statement not allow the request?

  1. A

    The action does not match because the request uses s3:GetObject.

  2. B

    The resource does not match because the requested object is in a different bucket.

  3. C

    A Principal field is missing from the identity-based policy.

  4. D

    The policy needs to use s3:ListBucket for every S3 request.

15
Written response
1 point

What AWS action is normally required to list the contents of an S3 bucket?

16
True or false
1 point

True or false: An identity-based IAM policy omits the Principal field because the attached identity is implied.

  1. A

    True

  2. B

    False

17
Choose one
1 point

A role policy allows s3:GetObject on a matching resource only when the request context includes Project=Orion. The action and resource match, but the request has no Project tag. What follows from this statement?

  1. A

    The request is allowed because the action and resource match; conditions are informational.

  2. B

    The request is allowed if the user belongs to a group.

  3. C

    The Allow does not apply because the required Project tag is missing.

  4. D

    The request is denied only if the policy also names a Principal.

18
Choose one
1 point

A role's identity-based policy allows an action on a resource, but its permissions boundary does not allow that action. Can the role use the identity-based permission?

  1. A

    The request is allowed because an identity policy always takes precedence over a boundary.

  2. B

    The role cannot use that identity-based permission because the boundary does not allow the action.

  3. C

    The boundary grants the action if the resource policy also allows it.

  4. D

    The request is allowed unless the boundary explicitly denies the action.

19
Choose one
1 point

A request matches an applicable Allow and an applicable explicit Deny. What is the access decision?

  1. A

    The request is allowed because an Allow is present.

  2. B

    The result depends only on which statement appears first.

  3. C

    The request is denied because an applicable explicit Deny overrides an Allow.

  4. D

    The request is allowed unless the Deny is in a resource-based policy.

20
Choose one
1 point

An SCP allows an action, but the principal has no applicable identity-based or resource-based Allow for it. Does the SCP by itself grant access?

  1. A

    The request is allowed because the SCP allows the action.

  2. B

    The SCP alone does not grant the action; another applicable policy must provide an Allow.

  3. C

    The SCP automatically grants the action to every principal in the account.

  4. D

    The SCP applies only to resource-based policies.