Which of the following willwhen executed on its

3. Which of the following will—when executed on its own—prevent an IAM user with no
existing policies from launching an EC2 instance? (Choose three.)
A. Attach no policies to the user.
B. Attach two policies to the user, with one policy permitting full EC2 access and the
other permitting IAM password changes but denying EC2 access.
C. Attach a single policy permitting the user to create S3 buckets.
D. Attach the AdministratorAccess policy.
E. Associate an IAM action statement blocking all EC2 access to the user’s account.
4. Which of the following are important steps for securing IAM user accounts? (Choose two.) 5. To reduce your exposure to possible attacks, you’re auditing the active access keys associ-
ated with your account. Which of the following AWS CLI commands can tell you whether a
specified access key is still being used?

180
Chapter 6
■
Authentication and Authorization—AWS Identity and Access Management
C. aws iam get-access-key-last-used access-last-key-id <key_ID>
D. aws iam get-access-key-last-used --access-key-id <key_ID>
6. You’re looking to reduce the complexity and tedium of AWS account administration. Which
of the following is the greatest benefit of organizing your users into groups?
7. During an audit of your authentication processes, you enumerate a number of identity types
and want to know which of them might fit the category of “trusted identity” and require
deeper investigation. Which of these is not considered a trusted entity in the context of
IAM roles?
A. A web identity authenticating with Google
B. An identity coming through a SAML-based federated provider
C. An identity using an X.509 certificate
D. A web identity authenticating with Amazon Cognito
8. Your company is bidding for a contract with a U.S. government agency that demands any
cryptography modules used on the project be compliant with government standards. Which
of the following AWS services provides virtual hardware devices for managing encryption
infrastructure that’s FIPS 140-2 compliant?