Identify AWS access management capabilities.

Objective 2.3 sits in Security and Compliance, which carries 30% of the Cloud Practitioner exam. The questions below are original, written from the official objective title above, and each explanation cites the Amazon Web Services (AWS) page it rests on.

Objective title verbatim from the official objectives. Amazon Web Services (AWS) exam page ↗

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

2-3Security and ComplianceModerate

An application running on an EC2 instance must call Amazon S3. The team wants no long-term credentials stored on the instance. Which identity fits?

The AWS account root user credentialsRoot sign-in is reserved for the few account tasks nothing else can perform, and it cannot be scoped down.

An IAM user with access keys on diskAccess keys are long-term credentials. A key written to an instance has to be rotated by hand and survives the instance being compromised.

An IAM role that the instance assumesCorrect · your answerCorrect. The instance assumes the role and works with temporary session credentials.

An IAM user group with an attached policyGroups collect human users and hold their permissions. Nothing assumes a group, so an instance cannot get credentials from one.

Correct.

Checked against docs.aws.amazon.com, August 2026

Concept

Compute that calls AWS APIs still needs an identity. Credentials issued per session and expiring on their own remove the work of storing, rotating and revoking a secret on every host.

Why C

A role has no password or access key of its own. Assuming one hands the workload short-lived security credentials for that session, so nothing durable sits on the file system for an attacker to read.

Source

Also, a role does not have standard long-term credentials such as a password or access keys associated with it. Instead, when you assume a role, it provides you with temporary security credentials for your role session.

AWS Docs: How IAM works, users, groups, roles, policies, checked August 2026

#iam#iam-roles#temporary-credentials

Now you: objective 2.3 questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

2-3Security and ComplianceEasy

An employee splits her time between the finance team and the audit team, and each team has its own IAM user group. How does IAM group membership handle that?

Sample question 2 of 3

2-3Security and ComplianceModerate

An external auditing firm with its own AWS account needs read access to your resources for one week. Which approach does AWS treat as the primary one?

Sample question 3 of 3

2-3Security and ComplianceHard

A user's request is allowed by one permissions policy and denied by another that also applies. How does IAM resolve it?

That’s 3 of the full Cloud Practitioner bank.

Keep going free: 10 questions per certification in bank practice, with no account.

Continue practicing

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

A worked example

Now you: objective 2.3 questions

Read the sources

More objectives in Security and Compliance