Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

A multi-department enterprise is setting up its AWS environment. The security team must define access controls for two distinct groups: a finance audit team that requires read-only access to AWS billing information, and an operations team that needs to start, stop, and reboot Amazon EC2 instances. Which TWO of the following configurations represent AWS-recommended IAM best practices to implement this access? (Select TWO.)

  1. Create an IAM user group for the audit team, attach the AWS-managed Billing policy to it, and assign individual audit users to this group.Answer
  2. Create an IAM user group for the operations team, attach a customer-managed policy that permits the necessary EC2 actions to it, and assign individual operations users to this group.Answer
  3. C
    Share the AWS account root user login credentials with the operations team to allow them to manage EC2 instances.
  4. D
    Create a single shared IAM user for all operations team members to use, and assign it administrative privileges to simplify credential management.
  5. E
    Submit an AWS Support ticket requesting AWS to manage individual EC2 instance OS-level access, since guest operating system security is the responsibility of AWS.

Answer

Create an IAM user group for the audit team, attach the AWS-managed Billing policy to it, and assign individual audit users to this group; and create an IAM user group for the operations team, attach a customer-managed policy that permits the necessary EC2 actions to it, and assign individual operations users to this group.
The correct configurations involve creating separate IAM user groups for the audit and operations teams, attaching targeted permission policies, and placing individual users into those groups. This aligns with AWS security best practices by avoiding direct policy assignment to users and applying the principle of least privilege.

Step-by-Step Solution

1
Analyze the access requirements for the audit and operations teams.
The audit team needs read-only billing access. The operations team needs partial EC2 access (start, stop, reboot).
This establishes the minimum permissions needed for each team to apply the principle of least privilege.
2
Identify the AWS identity best practices for organizing access.
Instead of assigning policies to individual users or sharing credentials, users should be placed in IAM user groups with specific permission policies attached.
Grouping users simplifies permission management and ensures consistency across roles.
3
Evaluate the option configurations against security standards.
Creating separate groups for audit and operations with specific policies is correct. Using root accounts, sharing users, or requesting AWS to manage OS access are incorrect configurations.
This rules out distractors based on security anti-patterns and the Shared Responsibility Model.

Key Concept

Principle of least privilege and IAM user groups management
Estimated Time:1m 30s
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic