Free Practice Quiz Question List

5 Shared Responsibility and IAM Practice Online Quiz Questions

Use this free practice quiz with 20 questions to review 5 Shared Responsibility and IAM Practice, test your knowledge, and prepare for your next test or exam.

20 questions

True or false

1 point

True or false: Protecting AWS data-center facilities is AWS's responsibility.

A
True
B
False

Written response

1 point

In the example policy, which exact S3 action allows listing the contents of the bucket?

Fill in the blank

1 point

A role's trust policy states .

Choose one

1 point

A team runs an EC2 instance and needs to patch its guest operating system. Who is responsible for that task?

A
AWS, because it operates the EC2 service
B
The customer, because it manages the guest operating system
C
AWS and the customer equally in every case
D
Neither, because guest operating systems are patched automatically

Written response

1 point

If IAM users are used for human access, what identity type should each person have instead of sharing credentials?

Fill in the blank

1 point

In the example policy, the resource ARN for the object-level action s3:GetObject ends with .

True or false

1 point

True or false: If an applicable policy explicitly denies a requested action, an Allow in another applicable policy does not make the request succeed.

A
True
B
False

Choose one

1 point

A user has MFA enabled, but their policies allow only s3:GetObject. They need to delete an object for their job. What is the appropriate conclusion?

A
Enable MFA again; MFA adds delete access after sign-in
B
Change the s3:GetObject permission to a broader wildcard action
C
Add an applicable Allow for s3:DeleteObject if the job requires deletion
D
No policy change is needed because reading permission includes deletion

Choose one

1 point

An application on EC2 needs to read from one S3 bucket and currently stores a long-term IAM user access key locally. Which is the safer approach?

A
Keep the long-term access key, but store it in a different local configuration file
B
Use an IAM role for the EC2 workload and grant only the required bucket permissions
C
Give the application s3:* on * so it can obtain temporary credentials
D
Share a human user's access key with the application

Choose one

1 point

Which practice best follows the guidance for an AWS account's root identity?

A
Reserve it for tasks that require it and protect it with MFA
B
Use it for routine work so all account actions have one identity
C
Share it among administrators, but enable MFA on one device
D
Disable MFA whenever a task requires elevated access

Choose all

1 point

When reviewing an access request, which checks should be performed? Select all that apply.

A
Identify the principal making the request.
B
Match the requested action to the relevant service action.
C
Check that the resource matches the intended resource.
D
Review applicable identity-based and resource-based policies, the role trust policy, and any applicable permissions boundary, session policy, or AWS Organizations policy.
E
Review only identity-based policies and ignore other applicable controls.
F
Assume that a policy's Allow is sufficient without checking other applicable policies.

Choose all

1 point

A developer needs to read objects from one project bucket, but their IAM user has s3:* on *. Which changes follow least privilege? Select all that apply.

A
Replace s3:* with the specific read actions the task requires
B
Keep s3:* on * because the developer may need other access later
C
Limit the resources to the intended bucket and its objects
D
Add upload and delete actions even though the task requires only reading

Open ended

1 point

Explain the difference between a role's trust policy and its permissions policy, and why both must be configured appropriately.

True or false

1 point

An IAM user has MFA enabled, but the applicable permissions policy allows only s3:GetObject. The user can delete an object because MFA is enabled.

A
True
B
False

Choose one

1 point

A team runs an application on an EC2 instance and needs to patch the instance’s guest operating system. Under the shared responsibility model, who is responsible for that patching?

A
AWS patches the guest operating system because EC2 runs on AWS infrastructure.
B
The customer patches the guest operating system inside its EC2 instance.
C
AWS and the customer each patch half of the guest operating system.
D
The hardware vendor patches the guest operating system.

Written response

1 point

An application running on EC2 needs access to AWS resources. What AWS identity type should be used to provide the workload with temporary credentials instead of storing a long-term access key?

Choose one

1 point

A developer needs to list and read objects in one project bucket, but currently has s3:* on *. Which change best follows least privilege?

A
Keep s3:* on * because the task is limited to one project.
B
Allow s3:GetObject on * and deny all other S3 actions.
C
Allow only the necessary read actions and scope them to the project bucket and its objects.
D
Allow s3:* on the project bucket and all its objects.

Choose one

1 point

A role’s permissions are appropriately limited, but an unintended principal can assume it. Which change addresses the problem, and what does that policy control?

A
The trust policy lists the resources the role can access; the permissions policy identifies who may assume it.
B
The trust policy identifies who may assume the role; the permissions policy defines what the role can do.
C
Both policies define only which users can sign in to the AWS account.
D
The trust policy grants MFA, and the permissions policy grants temporary credentials.

Written response

1 point

In the example policy for read-only access to one S3 bucket, what exact IAM action is used to list the bucket?

Choose one

1 point

A user’s policy allows an action on a resource, but another applicable policy explicitly denies that same action. What is the result?

A
The request is denied; an applicable explicit Deny overrides an Allow.
B
The request is allowed because any Allow takes precedence over a Deny.
C
The request is allowed if the user has MFA enabled.
D
The request is denied only if the resource-owning account also has an explicit Deny.

5 Shared Responsibility and IAM Practice Online Quiz Questions

Related study packs and tools