2.3

Question 1
A company wants to follow AWS best practices for securing its AWS account. Which action should the company take to protect the AWS account root user?

A. Create an IAM user with administrator permissions and use that user for daily tasks.
B. Share the root user credentials with the security team only.
C. Enable multi-factor authentication (MFA) for the root user and store the credentials securely.
D. Generate a new set of access keys for the root user every 30 days.
Click to reveal answer Correct Answer: C

Explanation: AWS strongly recommends enabling MFA on the root user and locking away the root credentials. The root user should never be used for daily tasks. Instead, create an administrative user (preferably via IAM Identity Center) for everyday work.

Exam Tip / Trap: Watch for answers that suggest using or rotating root access keys regularly — AWS recommends deleting root access keys entirely if they exist. Keywords: “protect the root user”, “MFA”, “do not use for daily tasks”.
Question 2
Which of the following tasks can be performed only by the AWS account root user? (Select TWO.)

A. Change the AWS Support plan
B. Create an IAM user
C. Close the AWS account
D. Attach a policy to an IAM group
E. Launch an Amazon EC2 instance
Click to reveal answer Correct Answers: A and C

Explanation: Only the root user can change the Support plan and close the AWS account. Creating IAM users, attaching policies, and launching EC2 instances can (and should) be done by IAM users or roles with appropriate permissions.

Exam Tip / Trap: Memorize the short list of root-only tasks (change account settings, close account, change Support plan, restore IAM permissions if locked out, configure S3 MFA Delete, etc.). Anything related to normal resource management is NOT root-only.
Question 3
A solutions architect needs to grant a group of developers permission to start and stop Amazon EC2 instances only. Which approach follows the principle of least privilege?

A. Attach the AWS managed policy AdministratorAccess to the developers’ IAM group.
B. Create a custom IAM policy that allows ec2:StartInstances and ec2:StopInstances and attach it to the group.
C. Give each developer the AWS account root user credentials.
D. Attach the AWS managed policy PowerUserAccess to each developer’s IAM user.
Click to reveal answer Correct Answer: B

Explanation: The principle of least privilege means granting only the minimum permissions required. A custom policy limited to the two EC2 actions is the most restrictive correct option.

Exam Tip / Trap: “Least privilege” almost always points to a custom or tightly scoped managed policy rather than broad policies like AdministratorAccess or PowerUserAccess.
Question 4
What is the main difference between an IAM user and an IAM role?

A. An IAM user has permanent long-term credentials; an IAM role provides temporary security credentials.
B. An IAM role can be used only by AWS services; an IAM user can be used only by people.
C. IAM users support MFA; IAM roles do not.
D. IAM roles are billed hourly; IAM users are free.
Click to reveal answer Correct Answer: A

Explanation: IAM users have long-term credentials (password and/or access keys). IAM roles provide temporary credentials that are assumed by users, applications, or AWS services.

Exam Tip / Trap: Roles are preferred for applications, cross-account access, and federation because credentials are temporary and automatically rotated.
Question 5
A company wants to give temporary AWS credentials to mobile app users who sign in with their social media accounts or as guest users. Which AWS service should the company use?

A. AWS IAM Identity Center
B. Amazon Cognito identity pools
C. AWS Secrets Manager
D. AWS Directory Service
Click to reveal answer Correct Answer: B

Explanation: Amazon Cognito identity pools (federated identities) can issue temporary AWS credentials to both authenticated (social or Cognito user pool) and unauthenticated (guest) users.

Exam Tip / Trap: Cognito User Pools = user directory/authentication. Cognito Identity Pools = temporary AWS credentials. Do not confuse the two.
Question 6
Which AWS service or feature allows an administrator to centrally manage access to multiple AWS accounts and business applications using single sign-on?

A. AWS IAM
B. AWS IAM Identity Center
C. AWS Organizations Service Control Policies (SCPs)
D. Amazon Cognito
Click to reveal answer Correct Answer: B

Explanation: AWS IAM Identity Center (successor to AWS Single Sign-On) provides centralized workforce identity management and single sign-on access to multiple AWS accounts and cloud applications.

Exam Tip / Trap: IAM is per-account. IAM Identity Center is the multi-account / workforce identity solution. Keywords: “centrally manage”, “single sign-on”, “multiple accounts”.
Question 7
A security team needs to enforce a password policy that requires a minimum length of 14 characters, at least one number, and password expiration every 90 days for all IAM users. Where is this configured?

A. AWS IAM Identity Center
B. IAM account settings (password policy)
C. AWS Organizations
D. Amazon Cognito user pool
Click to reveal answer Correct Answer: B

Explanation: IAM password policies are set at the account level under IAM account settings and apply to all IAM users in that account.

Exam Tip / Trap: Password policies apply only to IAM users, not to the root user or to federated/IAM Identity Center users (those use their own IdP policies).
Question 8
Which of the following are recommended ways to protect the AWS account root user? (Select TWO.)

A. Enable multi-factor authentication (MFA)
B. Create access keys for the root user and rotate them weekly
C. Do not use the root user for everyday administrative tasks
D. Share the root password with only the security and finance teams
E. Attach the AdministratorAccess policy to the root user
Click to reveal answer Correct Answers: A and C

Explanation: Best practices are: enable MFA, lock away credentials, never create access keys for the root user if possible, and never use the root user for daily tasks.

Exam Tip / Trap: Any answer that encourages creating, sharing, or regularly using root credentials is wrong.
Question 9
An application running on Amazon EC2 needs to access objects in an Amazon S3 bucket. What is the MOST secure way to grant the required permissions?

A. Store IAM user access keys in the application code.
B. Create an IAM role with S3 permissions and attach it to the EC2 instance.
C. Embed the AWS account root user access keys in environment variables.
D. Create an IAM user, generate access keys, and store them in AWS Systems Manager Parameter Store.
Click to reveal answer Correct Answer: B

Explanation: Using an IAM instance profile/role provides temporary credentials automatically rotated by AWS — no long-term keys to manage or risk exposure.

Exam Tip / Trap: “MOST secure” + EC2/S3 almost always = IAM role. Never hard-code keys.
Question 10
What is the purpose of the IAM policy simulator?

A. To generate least-privilege policies automatically from CloudTrail logs
B. To test and troubleshoot the effects of IAM and resource-based policies
C. To rotate access keys and passwords on a schedule
D. To enforce MFA for all IAM users
Click to reveal answer Correct Answer: B

Explanation: The IAM policy simulator lets you evaluate which actions are allowed or denied for a given principal and resource based on existing policies.

Exam Tip / Trap: Know the difference between policy simulator (testing) and Access Analyzer / IAM Access Advisor (recommendations and last-used info).
Question 11
A company has two AWS accounts. An IAM user in Account A needs to access an Amazon S3 bucket in Account B. What is the recommended approach?

A. Create an IAM user in Account B and share the access keys with the user in Account A.
B. Use a cross-account IAM role in Account B that the user in Account A can assume.
C. Make the S3 bucket public.
D. Copy the objects from Account B to Account A daily.
Click to reveal answer Correct Answer: B

Explanation: Cross-account IAM roles provide temporary, auditable access without sharing long-term credentials.

Exam Tip / Trap: Keywords “cross-account” → think IAM roles + trust policy, not shared access keys.
Question 12
Which statement about AWS managed policies versus customer managed policies is correct?

A. Only AWS managed policies can be attached to IAM roles.
B. AWS managed policies are created and updated by AWS; customer managed policies are created and managed by the customer.
C. Customer managed policies cannot be edited once created.
D. AWS managed policies are free; customer managed policies incur a charge.
Click to reveal answer Correct Answer: B

Explanation: AWS managed policies are maintained by AWS (e.g., AmazonS3ReadOnlyAccess). Customer managed policies are created and fully controlled by you.

Exam Tip / Trap: Inline policies are embedded directly in a single user/group/role; managed policies are standalone and reusable.
Question 13
A company wants to store database credentials and automatically rotate them. Which AWS service is designed for this use case?

A. AWS Systems Manager Parameter Store (standard parameters)
B. AWS Secrets Manager
C. Amazon S3 with encryption
D. AWS IAM credential report
Click to reveal answer Correct Answer: B

Explanation: AWS Secrets Manager is purpose-built for storing, rotating, and retrieving secrets (database credentials, API keys, etc.). Parameter Store can store secrets but rotation is more limited/native to Secrets Manager.

Exam Tip / Trap: Secrets Manager = rotation + secrets. Parameter Store = configuration and simpler secrets (cheaper).
Question 14
Which authentication method provides an additional layer of security beyond a username and password for IAM users and the root user?

A. Access keys
B. Multi-factor authentication (MFA)
C. IAM groups
D. Service control policies (SCPs)
Click to reveal answer Correct Answer: B

Explanation: MFA requires a second factor (virtual or hardware token) in addition to the password.

Exam Tip / Trap: MFA is repeatedly mentioned for root user protection and is a best-practice keyword on the exam.
Question 15
An administrator accidentally deleted an object from an Amazon S3 bucket. To prevent unauthorized permanent deletion of objects in the future, what should be enabled? (Select TWO.)

A. S3 Versioning
B. MFA Delete
C. S3 Object Lock in Governance mode only
D. Bucket policy that denies all delete actions
E. Cross-Region Replication
Click to reveal answer Correct Answers: A and B

Explanation: MFA Delete requires versioning to be enabled first and then requires MFA to permanently delete object versions.

Exam Tip / Trap: MFA Delete is a root-user (or MFA-authenticated) configuration and is a classic exam topic paired with versioning.
Question 16
What type of identity management allows users from an external identity provider (such as a corporate Active Directory or social identity) to access AWS resources without creating individual IAM users?

A. Root user access
B. Federated access
C. Inline policy access
D. Resource-based access only
Click to reveal answer Correct Answer: B

Explanation: Federation (via IAM Identity Center, Cognito, or SAML/OIDC) lets external identities assume IAM roles for temporary access.

Exam Tip / Trap: “Federated” or “external identity provider” = temporary credentials via roles, no permanent IAM users needed.
Question 17
Which of the following can be used to grant cross-account access to an Amazon S3 bucket? (Select TWO.)

A. Bucket policy
B. IAM user policy in the bucket owner’s account only
C. ACL (Access Control List)
D. IAM role with a trust policy
E. AWS managed policy AdministratorAccess attached to the root user
Click to reveal answer Correct Answers: A and D

Explanation: Resource-based bucket policies and IAM roles (assumed cross-account) are the two primary modern methods. ACLs are legacy and not recommended for new setups.

Exam Tip / Trap: Prefer bucket policies and roles over ACLs. Exam often tests “bucket policy vs user policy”.
Question 18
A Cloud Practitioner is reviewing IAM best practices. Which statement correctly describes IAM groups?

A. Groups can contain other groups (nested groups).
B. Groups are used to assign permissions to multiple IAM users at once.
C. Groups provide temporary credentials.
D. Groups can be used for cross-account access only.
Click to reveal answer Correct Answer: B

Explanation: IAM groups are collections of IAM users and are the simplest way to manage permissions for multiple users with the same needs. Groups cannot be nested and do not provide credentials themselves.

Exam Tip / Trap: Groups = permission management convenience. Roles = temporary credentials / services / federation / cross-account.
Question 19
Which of the following are characteristics of the AWS account root user? (Select TWO.)

A. It is created when the AWS account is opened and has full unrestricted access.
B. It should be used for all daily administrative tasks.
C. It can be deleted and replaced with an IAM user.
D. Access keys for the root user should be deleted if not absolutely required.
E. It is the only identity that can use AWS IAM Identity Center.
Click to reveal answer Correct Answers: A and D

Explanation: The root user is the original identity with complete access. Best practice is to delete root access keys and not use the root user daily.

Exam Tip / Trap: Root user cannot be deleted. Never choose answers that encourage daily root usage.
Question 20
A company wants to require MFA for console sign-in and also wants to manage fine-grained permissions for developers working across multiple AWS accounts. Which combination of services should they use?

A. IAM users with MFA + AWS IAM Identity Center for multi-account access
B. Root user only + Amazon Cognito
C. Access keys stored in Secrets Manager + S3 bucket policies
D. AWS Directory Service + inline policies only
Click to reveal answer Correct Answer: A

Explanation: MFA can be enforced on IAM users (and is mandatory for root). AWS IAM Identity Center is the recommended service for centralized, multi-account workforce access with fine-grained permission sets.

Exam Tip / Trap: For multi-account human access → IAM Identity Center. For single-account or service permissions → classic IAM. MFA is a recurring security best-practice keyword.

```

Summary of Coverage (for your study notes)
These 20 questions comprehensively cover Task Statement 2.3:

  • Root user protection & root-only tasks
  • Principle of least privilege
  • IAM users, groups, roles, policies (managed vs customer)
  • MFA, password policies, access keys
  • IAM Identity Center
  • Federation & temporary credentials (Cognito, roles)
  • Cross-account access
  • Secrets Manager / credential storage
  • Policy simulator, S3 bucket policies & MFA Delete

All questions are written at CLF-C02 foundational difficulty and mirror official AWS exam style.