FirstTry
Objective 2.3CLF-C02

2.3 Identify AWS access management capabilities.

Objective 2.3 sits in Security and Compliance, which carries 30% of the Cloud Practitioner exam. The questions below are original, written from the official objective title above, and each explanation cites the Amazon Web Services (AWS) page it rests on.

Objective title verbatim from the official objectives. Amazon Web Services (AWS) exam page ↗

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

2-3Security and ComplianceModerate

An application running on an EC2 instance must call Amazon S3. The team wants no long-term credentials stored on the instance. Which identity fits?

An IAM user with access keys on diskAccess keys are long-term credentials. A key written to an instance has to be rotated by hand and survives the instance being compromised.
An IAM role that the instance assumesCorrect · your answerCorrect. The instance assumes the role and works with temporary session credentials.
The AWS account root user credentialsRoot sign-in is reserved for the few account tasks nothing else can perform, and it cannot be scoped down.
An IAM user group with an attached policyGroups collect human users and hold their permissions. Nothing assumes a group, so an instance cannot get credentials from one.

Correct.

Concept

Compute that calls AWS APIs still needs an identity. Credentials issued per session and expiring on their own remove the work of storing, rotating and revoking a secret on every host.

Why B

A role has no password or access key of its own. Assuming one hands the workload short-lived security credentials for that session, so nothing durable sits on the file system for an attacker to read.

Source

#iam#iam-roles#temporary-credentials

Now you: objective 2.3 questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

2-3Security and ComplianceEasy

Which statement is true of IAM user groups?

Sample question 2 of 3

2-3Security and ComplianceModerate

An external auditing firm with its own AWS account needs read access to your resources for one week. Which approach does AWS treat as the primary one?

Sample question 3 of 3

2-3Security and ComplianceHard

A user's request is allowed by one permissions policy and denied by another that also applies. How does IAM resolve it?

That’s 3 of the full Cloud Practitioner bank.

Keep going free: 10 questions per certification in bank practice, with no account.

Continue practicing

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

More objectives in Security and Compliance