Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

A university database administrator needs to grant an administrative application running on a local, on-premises server the ability to read metadata from an Amazon DynamoDB table. Additionally, a new junior administrator has joined the team to assist with day-to-day configuration. Which of the following actions align with the AWS recommended best practices for IAM and access control? (Select TWO.)

  1. Use AWS IAM Roles Anywhere to grant the on-premises server secure access to DynamoDB using temporary credentials.Answer
  2. Create an IAM user for the junior administrator, place them in an IAM group with least-privilege policies, and require Multi-Factor Authentication (MFA).Answer
  3. C
    Provide the junior administrator with the AWS account root user login credentials to simplify their administrative access.
  4. D
    Generate a permanent IAM user access key pair and embed it directly in the on-premises application source code.
  5. E
    Update the AWS Shared Responsibility Model agreement to delegate the physical security of the on-premises server to AWS.

Answer

Use AWS IAM Roles Anywhere to grant the on-premises server secure access to DynamoDB using temporary credentials, and create an IAM user for the junior administrator, place them in an IAM group with least-privilege policies, and require Multi-Factor Authentication (MFA).
The correct practices are to use AWS IAM Roles Anywhere to grant temporary security credentials to the on-premises server, and to create an individual IAM user with least-privilege permissions and MFA enabled for the junior administrator. These actions align with the core security principles of minimizing long-term credentials and securing human identities.

Step-by-Step Solution

1
Identify secure access methods for on-premises servers to interact with AWS resources.
Using temporary credentials via AWS IAM Roles Anywhere is preferred over hardcoding long-lived access keys.
This minimizes the risk of credential exposure and adheres to the security principle of temporary credentials.
2
Identify secure access management practices for human users.
Creating a dedicated IAM user inside a group with least-privilege permissions and enforcing MFA is the recommended standard.
This ensures accountability, limits access to only what is necessary, and adds an extra layer of authentication security.

Key Concept

AWS IAM Best Practices for User and Workload Access Control
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic