2.3
Question 1
A company is managing several AWS accounts for development, testing, and production. The security team wants employees to sign in to a central portal by using the company’s existing corporate identities and assign permissions to AWS accounts without creating separate IAM users in each account. Which AWS service best meets these requirements?
A. AWS IAM Identity Center
B. AWS Secrets Manager
C. AWS Systems Manager
D. AWS Account Root User
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** AWS IAM Identity Center provides centralized workforce access to multiple AWS accounts and applications. It supports integration with an external identity provider and enables users to receive permissions through permission sets. * **Why distractors are incorrect:** * **B (AWS Secrets Manager):** Stores, manages, and can rotate secrets such as database credentials; it does not provide centralized workforce sign-in. * **C (AWS Systems Manager):** Helps manage and operate AWS resources, including storing configuration parameters in Parameter Store; it is not a workforce identity management service. * **D (AWS Account Root User):** The root user has full access to an AWS account and is not intended for routine workforce access.Question 2
A developer needs to deploy an application that reads objects from one Amazon S3 bucket. The developer should not be able to delete objects, modify bucket policies, or access other AWS services. Which IAM approach follows the principle of least privilege?
A. Attach the AdministratorAccess managed policy to the developer’s IAM user
B. Create a custom IAM policy that allows only the required read actions on the specific S3 bucket and attach it to the user or role
C. Provide the AWS account root user credentials to the application
D. Create an IAM group with full administrative permissions and add the developer to the group
Click to view Answer & Explanation
**Correct Answer:** B **Explanation:** * **Why B is correct:** A custom policy can grant only the required actions on the required resources. Limiting permissions reduces the potential impact of compromised credentials or application errors. * **Why distractors are incorrect:** * **A (`AdministratorAccess`):** Grants broad permissions that exceed the application’s requirements. * **C (AWS account root user credentials):** Root credentials provide unrestricted access and should not be used by applications or routine users. * **D (IAM group with full administrative permissions):** Grants excessive permissions and violates least privilege.Question 3
A company has an application running on an Amazon EC2 instance. The application must call AWS APIs, but the security team does not want to store long-term access keys in the application’s source code. Which solution should the company use?
A. Attach an IAM role with the required permissions to the EC2 instance
B. Store the AWS account root user access key in AWS Secrets Manager
C. Create an IAM user and hard-code its access key in the application
D. Store an IAM administrator access key in AWS Systems Manager Parameter Store
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** An IAM role provides temporary credentials to applications running on supported AWS resources, such as EC2 instances. This avoids embedding long-term access keys in source code. * **Why distractors are incorrect:** * **B (Root user access key in AWS Secrets Manager):** Root access keys are highly privileged and should not be used by applications. Storing them securely does not make their use appropriate. * **C (Hard-coded IAM user access key):** Long-term credentials in source code can be exposed and are difficult to manage securely. * **D (Administrator access key in AWS Systems Manager Parameter Store):** Storing an overly privileged long-term key does not follow least privilege and still requires the application to retrieve and use a long-term credential.Question 4
A security administrator is configuring an IAM user password policy for employees who sign in to the AWS Management Console. Which two settings improve the security of the IAM user passwords? (Select TWO)
A. Require a minimum password length
B. Require IAM users to share one password
C. Require at least one symbol in the password
D. Allow passwords to be reused indefinitely
E. Disable MFA for all IAM users
Click to view Answer & Explanation
**Correct Answers:** A and C **Explanation:** * **Why A is correct:** Requiring a minimum password length makes passwords more difficult to guess. * **Why C is correct:** Requiring password complexity, such as symbols, can strengthen IAM user passwords. * **Why distractors are incorrect:** * **B:** Sharing passwords prevents individual accountability and increases the risk of credential compromise. * **D:** Allowing indefinite password reuse weakens password security. * **E:** MFA provides an additional authentication factor and should generally be enabled rather than disabled.Question 5
An administrator is setting up protection for the AWS account root user. Which two actions are recommended? (Select TWO)
A. Enable MFA for the root user
B. Use the root user for daily administrative tasks
C. Delete root user access keys if they are not required
D. Add the root user to an IAM group with limited permissions
E. Create multiple root users for different administrators
Click to view Answer & Explanation
**Correct Answers:** A and C **Explanation:** * **Why A is correct:** MFA adds an additional authentication factor and helps protect the highly privileged root user account. * **Why C is correct:** Root access keys should not be created unless required. Unused root access keys should be deleted to reduce the risk of compromise. * **Why distractors are incorrect:** * **B:** The root user should not be used for daily administration. Administrators should use IAM roles, IAM users where appropriate, or IAM Identity Center. * **D:** The root user cannot be added to an IAM group, and IAM permissions do not restrict the root user in the same way they restrict IAM identities. * **E:** An AWS account has one root user. Separate administrators should receive their own identities and permissions.Question 6
A company’s security policy requires administrators in one AWS account to access resources in a second AWS account without creating permanent IAM users in the second account. Which solution meets this requirement?
A. Create a cross-account IAM role in the second account and allow trusted administrators to assume it
B. Share the root user credentials of the second account with the administrators
C. Create one IAM user in the second account and distribute its access keys to all administrators
D. Store the second account’s root password in AWS Secrets Manager
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** A cross-account IAM role allows trusted identities to assume the role and receive temporary credentials. The role can be limited to the permissions needed in the target account. * **Why distractors are incorrect:** * **B:** Sharing root credentials is a serious security risk and prevents proper accountability. * **C:** Shared IAM user credentials are long-term credentials and do not provide individual accountability. * **D:** Storing root credentials in AWS Secrets Manager does not make sharing or using them an appropriate access-management practice.Question 7
A development team needs to store a database password used by an application. The password must be protected from being exposed in source code, and the company wants the option to automatically rotate the password. Which AWS service is most appropriate?
A. AWS Secrets Manager
B. AWS IAM Identity Center
C. AWS Account Root User
D. AWS Systems Manager Session Manager
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** AWS Secrets Manager securely stores secrets such as database credentials and supports secret rotation for supported resources and configurations. * **Why distractors are incorrect:** * **B (AWS IAM Identity Center):** Provides centralized workforce authentication and authorization, not application secret storage. * **C (AWS Account Root User):** Is an account identity, not a credential-storage service. * **D (AWS Systems Manager Session Manager):** Provides managed-node access without requiring inbound ports or SSH keys; it is not primarily a database-secret storage service.Question 8
A company wants employees to use their existing corporate usernames and passwords to access AWS. The company also wants users to receive temporary permissions without creating a separate IAM user for every employee. Which identity-management approach should the company use?
A. Federated access through AWS IAM Identity Center or an external identity provider
B. A shared IAM user account for all employees
C. The AWS account root user for all employees
D. Long-term access keys embedded in the corporate directory
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** Federated access allows users to authenticate with an existing identity provider and obtain temporary AWS access based on assigned permissions. AWS IAM Identity Center supports this centralized workforce access model. * **Why distractors are incorrect:** * **B:** Shared IAM users prevent individual accountability and make access reviews and credential management more difficult. * **C:** The root user has unrestricted account access and should never be used as a shared workforce identity. * **D:** Long-term access keys are not a suitable replacement for federated authentication and can be exposed or mismanaged.Question 9
A finance employee needs read-only access to billing information in an AWS account. The employee must not be able to launch resources or modify IAM permissions. Which option is the most appropriate way to grant this access?
A. Attach an AWS managed billing read-only policy to the employee’s IAM identity
B. Attach AdministratorAccess to the employee’s IAM identity
C. Grant the employee the AWS account root user credentials
D. Add the employee to a group with permissions for all AWS services
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** An AWS managed policy designed for billing read-only access provides predefined permissions appropriate for that use case. It avoids granting permissions to launch resources or change IAM configuration. * **Why distractors are incorrect:** * **B (`AdministratorAccess`):** Grants broad permissions far beyond the employee’s requirement. * **C:** Root credentials provide unrestricted access and should not be shared or used for routine tasks. * **D:** Permissions for all AWS services violate least privilege and expose the account to unnecessary risk.Question 10
An organization has lost access to the email address associated with its AWS account and needs to change the account’s email address. Which identity is required to perform this task?
A. An IAM user with the AdministratorAccess policy
B. An IAM role assumed through AWS IAM Identity Center
C. The AWS account root user
D. An IAM user in the ReadOnlyAccess group
Click to view Answer & Explanation
**Correct Answer:** C **Explanation:** * **Why C is correct:** Certain account-level tasks, including changing the email address associated with an AWS account, require the AWS account root user. The root user should be used only for such tasks and protected with MFA. * **Why distractors are incorrect:** * **A:** IAM administrators have extensive permissions within AWS services but cannot perform every account-level task reserved for the root user. * **B:** IAM Identity Center provides centralized access to AWS accounts but does not replace the root user for root-only account tasks. * **D:** Read-only permissions cannot modify account information or resources.Question 11
A company wants to protect its AWS account from unauthorized access. The security team wants to ensure that even if the root user password is compromised, an attacker cannot sign in without an additional authentication factor. Which action should the company take?
A. Enable multi-factor authentication (MFA) for the root user
B. Create an IAM group for the root user
C. Store the root user password in AWS Secrets Manager
D. Create an IAM access key for the root user
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** Enabling MFA for the root user adds an additional authentication factor and is a key recommendation for protecting the highly privileged root user account. * **Why distractors are incorrect:** * **B (Create an IAM group for the root user):** The root user cannot be added to IAM groups. * **C (Store the root user password in AWS Secrets Manager):** Secrets Manager can store application secrets, but storing the root password does not provide an additional sign-in factor. * **D (Create an IAM access key for the root user):** Root access keys increase risk and should not be created unless absolutely necessary.Question 12
A company has several developers who need the same read-only permissions in an AWS account. The security team wants to manage their permissions centrally and avoid assigning policies individually to each user. Which IAM capability should the company use?
A. IAM groups
B. IAM roles
C. IAM access keys
D. AWS account root user
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** IAM groups allow administrators to apply common permissions to multiple IAM users. Users in the group inherit the permissions from the group’s policies. * **Why distractors are incorrect:** * **B (IAM roles):** Roles provide temporary permissions that can be assumed by trusted identities or services, but they are not used to group IAM users for common permission management. * **C (IAM access keys):** Access keys are credentials for programmatic access and do not centrally manage permissions for multiple users. * **D (AWS account root user):** The root user has unrestricted account access and should not be used for routine user access.Question 13
A developer needs to access Amazon S3 from an application running on an Amazon EC2 instance. The security team does not want the developer to embed long-term access keys in the application code. Which solution should the company use?
A. Attach an IAM role to the EC2 instance
B. Create an IAM access key for the root user
C. Store an IAM user’s access key directly in the application code
D. Share the AWS account password with the application administrator
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** An IAM role attached to an EC2 instance provides temporary security credentials to applications running on the instance, avoiding the need to store long-term access keys in code. * **Why distractors are incorrect:** * **B (Create an IAM access key for the root user):** Root access keys create significant security risk and should not be used by applications. * **C (Store an IAM user’s access key directly in the application code):** Hard-coding long-term credentials can expose the credentials to unauthorized users. * **D (Share the AWS account password):** Sharing passwords violates security best practices and provides excessive access.Question 14
A company wants to allow employees to access multiple AWS accounts using their existing corporate credentials. Employees should sign in once and receive access only to the AWS accounts and permissions assigned to them. Which AWS service should the company use?
A. AWS IAM Identity Center
B. AWS Secrets Manager
C. AWS Systems Manager
D. Amazon Route 53
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** AWS IAM Identity Center provides centralized workforce access to multiple AWS accounts and applications. It can integrate with an organization’s existing identity provider and support single sign-on. * **Why distractors are incorrect:** * **B (AWS Secrets Manager):** Stores, manages, and retrieves secrets; it does not provide workforce single sign-on. * **C (AWS Systems Manager):** Helps manage AWS resources and operational tasks, not centralized employee authentication across accounts. * **D (Amazon Route 53):** Provides DNS and domain registration services, not identity management.Question 15
A security administrator is reviewing an IAM policy for a finance application. The application only needs to read objects from one specific Amazon S3 bucket. Which policy design follows the principle of least privilege?
A. Allow read access to objects in only the required S3 bucket
B. Allow all actions on all AWS resources
C. Allow administrator permissions for the entire AWS account
D. Allow access to every S3 bucket in the organization
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** Least privilege means granting only the permissions required to perform a task. Limiting read access to the required bucket and objects minimizes the potential impact of misuse. * **Why distractors are incorrect:** * **B (Allow all actions on all AWS resources):** This grants excessive permissions. * **C (Allow administrator permissions for the entire AWS account):** Administrator access is broader than the application requires. * **D (Allow access to every S3 bucket in the organization):** Access to unrelated buckets violates least privilege.Question 16
A company requires a user to authenticate to AWS using both a password and a hardware device that generates a temporary code. Which AWS security capability meets this requirement?
A. Multi-factor authentication (MFA)
B. IAM group membership
C. IAM access keys
D. An IAM managed policy
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** MFA requires an additional authentication factor, such as a hardware device or authenticator application, in addition to a password. * **Why distractors are incorrect:** * **B (IAM group membership):** Groups organize IAM users and permissions but do not provide an additional authentication factor. * **C (IAM access keys):** Access keys provide programmatic authentication and do not by themselves provide MFA. * **D (An IAM managed policy):** Policies define permissions and do not authenticate users.Question 17
A company wants to define a reusable set of permissions that can be attached to multiple IAM users, groups, and roles. The company also wants AWS to maintain and update the policy. Which option meets these requirements?
A. An AWS managed policy
B. An IAM password policy
C. An IAM access key
D. An AWS account root user credential
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** AWS managed policies are created and maintained by AWS. They can be attached to multiple IAM identities, including users, groups, and roles. * **Why distractors are incorrect:** * **B (An IAM password policy):** A password policy controls requirements for IAM user passwords but does not define service permissions. * **C (An IAM access key):** An access key is a programmatic credential, not a permissions policy. * **D (An AWS account root user credential):** Root credentials provide account-level access and are not reusable permission policies.Question 18
An organization wants its employees to use a corporate identity provider to access AWS without creating separate long-term IAM user credentials for every employee. Which identity management approach should the organization use?
A. Federated identity
B. Shared root user credentials
C. Individual root user access keys
D. Hard-coded IAM user passwords in applications
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** Federated identity allows users to authenticate through an existing corporate identity provider and receive access to AWS without requiring separate long-term IAM user credentials for each employee. * **Why distractors are incorrect:** * **B (Shared root user credentials):** Sharing root credentials is insecure and prevents individual accountability. * **C (Individual root user access keys):** Root access keys are highly privileged and should not be used for employee access. * **D (Hard-coded IAM user passwords in applications):** Storing credentials in application code is insecure and is not a federated identity solution.Question 19
A company needs to allow an administrator in Account A to perform a specific task in Account B. The company wants the administrator to receive temporary permissions rather than use permanent credentials from Account B. Which solution should the company use?
A. A cross-account IAM role
B. A shared IAM user password
C. An AWS account root user access key
D. An IAM group with no trust policy
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** A cross-account IAM role allows a trusted identity from another AWS account to assume the role and receive temporary credentials for the permitted actions. * **Why distractors are incorrect:** * **B (A shared IAM user password):** Shared passwords reduce accountability and do not provide controlled temporary access. * **C (An AWS account root user access key):** Root access keys provide excessive privilege and should not be shared. * **D (An IAM group with no trust policy):** Groups manage permissions for IAM users but cannot provide cross-account role assumption.Question 20
A company wants to improve the security of its IAM users’ console passwords. The security team wants to require a minimum password length, prevent reuse of previous passwords, and require special characters. Which IAM capability should the company configure?
A. An IAM password policy
B. An IAM managed policy
C. An IAM role trust policy
D. AWS IAM Identity Center permission sets
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** An IAM password policy defines requirements for IAM user passwords, including length, complexity, expiration, and reuse settings. * **Why distractors are incorrect:** * **B (An IAM managed policy):** Managed policies define permissions for AWS resources and actions, not password complexity requirements. * **C (An IAM role trust policy):** A trust policy defines which principals can assume a role. * **D (AWS IAM Identity Center permission sets):** Permission sets assign AWS permissions to workforce users and groups but do not define IAM user password complexity.Question 21
A company runs an application that requires a database password. The password must be encrypted at rest and retrieved by the application when needed. The company also wants the ability to rotate the password automatically. Which AWS service should the company use?
A. AWS Secrets Manager
B. AWS Systems Manager
C. IAM groups
D. AWS IAM Identity Center
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** AWS Secrets Manager securely stores sensitive information such as database credentials and supports secret rotation for supported services. * **Why distractors are incorrect:** * **B (AWS Systems Manager):** Systems Manager Parameter Store can store configuration data and parameters, including sensitive values, but Secrets Manager is designed specifically for secret management and rotation. * **C (IAM groups):** IAM groups manage permissions for IAM users and do not store application database passwords. * **D (AWS IAM Identity Center):** IAM Identity Center provides workforce access management and does not store application database credentials.Question 22
A development team needs a centralized location to store application configuration values and retrieve them at runtime. Some values are sensitive, but automatic secret rotation is not required. Which AWS service is suitable for this requirement?
A. AWS Systems Manager Parameter Store
B. AWS Account Root User
C. IAM groups
D. Amazon Route 53
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** AWS Systems Manager Parameter Store provides centralized storage for configuration data and parameters. It can also store secure string parameters for sensitive values. * **Why distractors are incorrect:** * **B (AWS Account Root User):** The root user is an identity with unrestricted account permissions, not a configuration storage service. * **C (IAM groups):** IAM groups organize users and permissions but do not store application configuration values. * **D (Amazon Route 53):** Route 53 provides DNS and domain services, not parameter storage.Question 23
A company uses an IAM user for a third-party application that requires programmatic access to AWS. The security team wants to reduce the risk from compromised credentials. Which actions should the security team take? (Select TWO)
A. Grant the IAM user only the permissions required by the application
B. Rotate the IAM access keys regularly
C. Create an access key for the root user instead
D. Grant the IAM user administrator permissions
E. Share the IAM access key with other applications
Click to view Answer & Explanation
**Correct Answers:** A and B **Explanation:** * **Why A is correct:** Limiting permissions reduces the potential impact if the application credentials are compromised. * **Why B is correct:** Regularly rotating access keys limits the time during which an exposed key can be used. * **Why distractors are incorrect:** * **C (Create an access key for the root user instead):** Root access keys are highly privileged and should be avoided. * **D (Grant the IAM user administrator permissions):** Administrator permissions violate least privilege for an application that needs only specific actions. * **E (Share the IAM access key with other applications):** Sharing credentials makes tracking usage and revoking access more difficult.Question 24
A company has 50 employees who need access to AWS accounts. The security team wants a centralized solution that assigns permissions based on job function and makes it easy to remove an employee’s access when the employee leaves. Which solution should the company use?
A. AWS IAM Identity Center with users or groups and permission sets
B. One shared IAM user for all employees
C. The AWS account root user for all employees
D. An IAM access key embedded in each employee’s workstation
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** IAM Identity Center provides centralized workforce access management. Administrators can assign permission sets to users or groups and remove access centrally. * **Why distractors are incorrect:** * **B (One shared IAM user for all employees):** Shared identities prevent individual accountability and make access removal difficult. * **C (The AWS account root user for all employees):** The root user has unrestricted access and must not be used for routine employee access. * **D (An IAM access key embedded in each employee’s workstation):** Long-term credentials on workstations are difficult to manage securely and do not provide centralized workforce access.Question 25
An administrator accidentally removed all permissions from an IAM user who manages the company’s billing settings. Which identity may be required to restore the user’s permissions?
A. The AWS account root user
B. Any user in the IAM group
C. An AWS IAM Identity Center user without assigned permissions
D. An application using AWS Secrets Manager
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** The root user can be required to restore permissions for an IAM user when no other identity with sufficient permissions can perform the recovery. * **Why distractors are incorrect:** * **B (Any user in the IAM group):** Group membership does not automatically give a user permission to modify another user’s policies. * **C (An AWS IAM Identity Center user without assigned permissions):** An Identity Center user cannot perform actions without appropriate assigned permissions. * **D (An application using AWS Secrets Manager):** Secrets Manager stores and retrieves secrets; it does not restore IAM permissions.Question 26
A company is closing an AWS account and wants to complete the account closure process. Which identity should the company use?
A. The AWS account root user
B. An IAM user with read-only permissions
C. An IAM group
D. An AWS Systems Manager parameter
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** Closing an AWS account is an account-level task that must be performed by the root user. * **Why distractors are incorrect:** * **B (An IAM user with read-only permissions):** Read-only permissions cannot close an AWS account. * **C (An IAM group):** Groups contain users and permissions but cannot sign in or perform account closure. * **D (An AWS Systems Manager parameter):** A parameter is stored configuration data, not an AWS identity.Question 27
A company wants to allow an employee to access AWS resources only during a specific project. The employee should not retain long-term permissions after the project ends. Which option is most appropriate?
A. Assign temporary access through an IAM role
B. Create a root user access key and delete it later
C. Give the employee a shared administrator password
D. Store an IAM password in AWS Systems Manager Parameter Store
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** IAM roles provide temporary credentials and can be configured with only the permissions required for the project. * **Why distractors are incorrect:** * **B (Create a root user access key and delete it later):** Root access keys are excessively privileged and should not be used for temporary employee access. * **C (Give the employee a shared administrator password):** Shared administrator credentials create security and accountability risks. * **D (Store an IAM password in AWS Systems Manager Parameter Store):** Storing a password does not establish appropriate temporary authorization.Question 28
A company wants to protect the root user account. The company does not want to use the root user for daily tasks and wants to reduce the risk of credential exposure. Which actions should the company take? (Select TWO)
A. Enable MFA for the root user
B. Avoid creating root user access keys
C. Use the root user for all administrative tasks
D. Share the root user password with the security team
E. Add the root user to an IAM group
Click to view Answer & Explanation
**Correct Answers:** A and B **Explanation:** * **Why A is correct:** MFA adds an additional authentication factor to protect the root user sign-in. * **Why B is correct:** Root access keys provide programmatic access with extensive privileges. Avoiding their creation reduces the risk of credential compromise. * **Why distractors are incorrect:** * **C (Use the root user for all administrative tasks):** Routine work should be performed using IAM users, roles, or IAM Identity Center access with least-privilege permissions. * **D (Share the root user password with the security team):** Root credentials should never be shared. * **E (Add the root user to an IAM group):** The root user cannot be added to IAM groups.Question 29
A company’s security team is creating permissions for an application. The team wants to write a policy that grants access to only the required AWS actions and resources instead of using a broad existing policy. Which type of policy should the team create?
A. A customer managed policy
B. An AWS managed policy
C. An IAM password policy
D. An AWS account root user policy
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** A customer managed policy is created and managed by the customer. It can be customized to grant only the specific actions and resources required by the application. * **Why distractors are incorrect:** * **B (An AWS managed policy):** AWS managed policies are created and maintained by AWS and might grant broader permissions than the application needs. * **C (An IAM password policy):** Password policies control IAM user password requirements and do not grant resource permissions. * **D (An AWS account root user policy):** The root user is not managed through an IAM policy in this way.Question 30
A company wants to provide developers with console access to AWS accounts using their corporate identities. Developers in the testing team should receive access to testing accounts, while developers in the production team should receive limited access to production accounts. Which AWS IAM Identity Center capability should the company use?
A. Permission sets assigned to users or groups for specific AWS accounts
B. A single shared root user credential
C. A single IAM access key distributed to all developers
D. An AWS Systems Manager document assigned to each developer