Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

A financial services company is setting up AWS access for its newly hired database administrators. The company wants to enforce the principle of least privilege, simplify permissions management as the team grows, and secure individual console access. Which two of the following actions represent recommended AWS Identity and Access Management (IAM) best practices to achieve this?

  1. Assign the database administrators to an IAM group and attach the necessary permissions policy to that group.Answer
  2. Configure multi-factor authentication (MFA) on the database administrators' individual IAM user accounts.Answer
  3. C
    Share the AWS account root user credentials with the database administrators to perform daily database modifications.
  4. D
    Create an IAM role with permanent access keys and attach it to each database administrator's local workstation.
  5. E
    Configure AWS to automatically manage and patch the operating systems of all user workstations.

Answer

Assign the database administrators to an IAM group and attach the necessary permissions policy to that group, and configure multi-factor authentication (MFA) on the database administrators' individual IAM user accounts.
The correct practices are to assign the administrators to an IAM group and attach policies to that group, and to enforce multi-factor authentication (MFA) on the individual IAM user accounts. Using IAM groups simplifies permissions management as the team grows, and enabling MFA ensures that console access is secured with an additional authentication layer.

Step-by-Step Solution

1
Evaluate the requirement for managing permissions easily as the team grows.
Using IAM groups allows policies to be attached once and automatically applied to any user added to the group, satisfying the scalability requirement.
Managing permissions at the group level reduces administrative overhead and potential configuration errors.
2
Evaluate the requirement for securing individual console access.
Enabling Multi-Factor Authentication (MFA) on individual IAM user accounts enforces an extra security layer beyond password authentication.
MFA is the standard AWS recommendation for securing console access.
3
Analyze and eliminate incorrect alternatives.
Discard sharing the root user due to security risks; discard attaching roles with permanent access keys since roles only use temporary credentials; discard AWS patching workstations since client-side device security belongs to the customer.
This aligns with the AWS Shared Responsibility Model and core IAM security boundaries.

Key Concept

AWS IAM best practices including group-based permissions and multi-factor authentication (MFA).
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic