Practice Test

True or False: The Principle of Least Privilege (POLP) suggests that a user should be given the bare minimum level of access required to accomplish their task.

  • True
  • False

Answer: True

Explanation: The principle of least privilege advocates for minimal user profile privileges, based on users’ job necessities. It applies to user accounts, but also to processes, systems, and devices.

In AWS IAM, what is the primary way to control access to AWS services and resources?

  • A. User groups
  • B. Managed policies
  • C. Custom policies
  • D. Both B and C

Answer: D. Both B and C

Explanation: In AWS, you control access to services and resources through policies, which can be either managed policies provided by AWS (B) or custom policies that you define yourself (C).

True or False: It is not possible to attach multiple policies to a single IAM user in AWS.

  • True
  • False

Answer: False

Explanation: In AWS IAM, you can attach multiple policies to a single user. This allows you to provide the necessary permissions based on the user’s role and responsibilities.

What is a user group in AWS IAM?

  • A. A collection of IAM users
  • B. A collection of IAM policies
  • C. A collection of AWS resources
  • D. A specific AWS service

Answer: A. A collection of IAM users

Explanation: In AWS IAM, a user group is simply a collection of IAM users. Groups let you specify permissions for multiple users, which can make it easier to manage the permissions for those users.

Which type of AWS IAM policy allows you to choose specific permissions from a list?

  • A. Managed policies
  • B. Group policies
  • C. Custom policies
  • D. User policies

Answer: C. Custom policies

Explanation: Custom policies in AWS IAM allow you to create your own set of permissions. This way, you can choose specific permissions from a list, providing the most granular level of control.

True or False: It is a best practice to assign loose permissions and then remove unnecessary privileges.

  • True
  • False

Answer: False

Explanation: As per the Principle of Least Privilege, it’s a best practice to grant only the necessary access to perform a task, and not to start with liberal permissions.

What is the main advantage of using managed policies in AWS IAM?

  • A. You can create custom permissions
  • B. They are automatically updated by AWS
  • C. You can assign them to multiple users
  • D. They reduce the number of IAM users

Answer: B. They are automatically updated by AWS

Explanation: Managed policies are maintained and automatically updated by AWS, providing a secure and convenient way to grant permissions.

When creating custom IAM policies, how do you define the permissions?

  • A. By selecting from a list
  • B. By writing JSON documents
  • C. By assigning to a user group
  • D. By choosing an AWS service

Answer: B. By writing JSON documents

Explanation: When you create custom IAM policies, you define the permissions in those policies by writing JSON (JavaScript Object Notation) policy documents.

True or False: You can apply multiple managed policies to a single IAM group.

  • True
  • False

Answer: True

Explanation: Just like with individual users, you can attach multiple managed policies to a single IAM group.

What is the main difference between a managed policy and a custom policy in AWS IAM?

  • A. Managed policies are maintained by AWS, while custom policies are defined by the user
  • B. Managed policies are defined by the user, while custom policies are maintained by AWS
  • C. Managed policies can be assigned to multiple users, while custom policies can only be assigned to one user
  • D. Managed policies can only be assigned to one user, while custom policies can be assigned to multiple users

Answer: A. Managed policies are maintained by AWS, while custom policies are defined by the user

Explanation: Managed policies are maintained and updated by AWS, while custom policies allow you to define your own set of permissions in a JSON document.

Interview Questions

What is the Principle of Least Privilege in AWS?

The Principle of Least Privilege (POLP) in AWS is a computer security concept where a user is given the minimum levels of access necessary to complete his/her job functions. This implies that granting only necessary permissions limits the permissions that potentially can be abused.

What is a group in AWS?

In AWS, a group is a collection of IAM users. Groups let you specify permissions for multiple users, which can make it easier to manage the permissions for those users.

How do you define a user in AWS?

A user in AWS is an identity (within an AWS account) with unique security credentials that can be used to access AWS services. AWS assigns a set of permissions to a user that determine what the identity can and can’t do in AWS.

What is a custom policy in AWS IAM?

A custom policy is a policy that you create in AWS IAM. You can use it to provide a specific set of permissions. Custom policy types include identity-based policies, resource-based policies, permissions boundaries, and organizations SCPs.

What are Managed Policies in AWS IAM?

Managed policies are IAM policies that you can attach to multiple users, groups, and roles in your AWS account. They offer more precise control than AWS-managed policies because you can tailor the policy to meet specific requirements.

How do you apply the Principle of Least Privilege to IAM policies in AWS?

To apply the Principle of Least Privilege to IAM policies in AWS, you create policies that allow only the necessary permissions for a specific task, user, or resource and avoid granting broad access rights whenever possible.

How do Managed Policies and Inline Policies differ in AWS IAM?

Managed Policies are standalone identity policies that you can attach to multiple entities (users, groups, and roles) in your AWS account. Inline Policies are policies that you create and manage and are embedded directly into a single user, group or role.

What is the purpose of IAM roles in AWS?

IAM roles in AWS provide a way to delegate permissions to AWS services or users to assume certain permissions. It allows resources and users in your account to make AWS service requests without needing to manage and maintain security access keys.

What is the process of granting a user permissions to an AWS service?

The process involves creating an IAM policy that defines the permissions, and then attaching that policy to the IAM user. According to the Principle of Least Privilege, this policy should grant only the minimum required permissions to the user.

Can AWS IAM policies restrict access based on IP addresses?

Yes, AWS IAM policies support restricting access to AWS based on the source IP, which provides an additional level of security control.

Can permissions be granted at the granularity of AWS service operations in AWS IAM?

Yes, permissions can be configured at the granularity of AWS service operations (actions), resources, and request conditions in AWS IAM.

Can you modify the permissions of an existing AWS IAM group?

Yes, you can modify the permissions of an existing IAM group by attaching, updating, or detaching policies associated with that group.

Is it possible to assign permissions directly to AWS resources?

Yes, you can assign permissions directly to AWS resources by using resource-based policies. However, not all services support resource-based policies.

How can you make sure IAM policies follow the Principle of Least Privilege?

By regularly auditing and reviewing IAM policies, removing unnecessary permissions, and using policy validation to identify potential errors, you can ensure that IAM policies follow the Principle of Least Privilege.

Can I share my AWS resources with another AWS account?

Yes, you can share your AWS resources with another AWS account by using Resource Access Manager (RAM). You’ll need to create a resource share, specify the resources you want to share, and invite the other AWS account(s) to join your resource share.

Leave a Reply

Your email address will not be published. Required fields are marked *