17. Cross-account KMS decrypt fails
A role in account B has kms:Decrypt in its IAM policy but cannot read S3 objects encrypted with a customer managed key in account A. What is missing?
- A.The key policy in account A must also allow account B's principal
- B.KMS keys can never be used across accounts
- C.Account B should switch to the AWS managed aws/s3 key
- D.S3 Transfer Acceleration must be enabled
Show answer
Answer: A. The key policy in account A must also allow account B's principal
For cross-account use, both the key policy in the owning account and an IAM policy in the calling account must allow the action. The key policy is the main control over who can use a KMS key. AWS managed keys such as aws/s3 cannot be shared across accounts at all.
18. Giving an app on EC2 access to S3
An app on EC2 needs to write to S3. What is the right way to give it credentials?
- A.Put an IAM user's access keys in the code
- B.Store the root user keys in an env file
- C.Make the bucket public for writes
- D.Attach an IAM role through an instance profile
Show answer
Answer: D. Attach an IAM role through an instance profile
An instance role provides short-lived credentials that rotate automatically through the instance metadata service, so no long-term keys sit on disk or in code. Azure uses managed identities and Google Cloud uses attached service accounts for the same purpose.
19. An allow and a deny on the same action
A user's IAM policy allows s3:DeleteObject on a bucket. The bucket policy explicitly denies s3:DeleteObject for everyone except a backup role. Can the user delete objects?
- A.Yes; identity policies beat bucket policies
- B.Yes; the most recent policy wins
- C.No; an explicit deny overrides any allow
- D.Only if the user has MFA enabled
Show answer
Answer: C. No; an explicit deny overrides any allow
AWS policy evaluation starts from implicit deny, then an allow is needed, but any explicit deny in any applicable policy wins over every allow. Explicit denies are a strong guardrail for sensitive actions.
20. Downloaded service account keys
A team downloads a Google Cloud service account JSON key to let an on-prem job call Cloud Storage. Why is this discouraged, and what is preferred?
- A.Long-lived keys leak; use workload identity
- B.Keys expire after one hour, so CI jobs fail
- C.JSON keys cannot be used to call Cloud Storage
- D.Service accounts are only meant for human users
Show answer
Answer: A. Long-lived keys leak; use workload identity
Exported service account keys are long-lived secrets that are easy to leak and hard to track. Workload identity federation lets external workloads exchange their own identity token for short-lived Google credentials with no stored key.
21. Requiring MFA for sensitive actions
You want to let engineers stop production EC2 instances only if they signed in with MFA. Which condition does that?
"Condition": { "Bool": { "aws:MultiFactorAuthPresent": "true" } }- A.Add this condition to a Deny statement for ec2:StopInstances
- B.Put the condition in the role's trust policy only
- C.Add it to the Resource element of the statement
- D.Add this condition to the Allow statement for ec2:StopInstances
Show answer
Answer: D. Add this condition to the Allow statement for ec2:StopInstances
Putting the condition on the Allow means the action is only allowed when the request was made with MFA-authenticated credentials. A Deny with the same "true" condition would do the opposite and block MFA users. For a deny-based guard you would use BoolIfExists with "false", because the key is absent for long-term access keys.
22. Allow with NotAction
A developer writes this statement to 'give everything except IAM'. What does it actually grant?
{
"Effect": "Allow",
"NotAction": "iam:*",
"Resource": "*"
}- A.Nothing, because NotAction can only be used with Deny
- B.Every action in every service other than IAM
- C.Only read-only actions in services outside IAM
- D.Full IAM access, since NotAction inverts the effect
Show answer
Answer: B. Every action in every service other than IAM
NotAction with Allow grants every action that is not listed, across all services and any new services AWS adds later. It does not block IAM if another policy allows it; it simply does not grant IAM. It is valid, but it is almost always far broader than intended.
23. ListBucket needs the bucket ARN
A role can download files but gets AccessDenied when running aws s3 ls s3://reports-prod/. What is wrong with this policy?
{
"Effect": "Allow",
"Action": ["s3:GetObject", "s3:ListBucket"],
"Resource": "arn:aws:s3:::reports-prod/*"
}- A.ListBucket must be granted in a separate Deny statement
- B.The S3 ARN is missing the account ID and the region
- C.aws s3 ls needs s3:ListAllMyBuckets on the bucket
- D.ListBucket needs the bucket ARN, which is not listed
Show answer
Answer: D. ListBucket needs the bucket ARN, which is not listed
s3:ListBucket is a bucket-level action, so its resource is arn:aws:s3:::reports-prod. Object actions like GetObject use the object ARN with /*. The fix is to include both ARNs, ideally in separate statements so each action matches the right resource.
24. What a session policy does
An application calls sts:AssumeRole and passes an inline session policy that allows only s3:GetObject on one prefix. The role itself allows s3:*. What can the session do?
- A.All S3 actions, since the role policy is broader
- B.s3:* plus GetObject, because the policies add together
- C.Nothing until an administrator approves the session policy
- D.Only s3:GetObject on that prefix
Show answer
Answer: D. Only s3:GetObject on that prefix
A session policy can only narrow permissions. The session gets the intersection of the role's identity policies and the session policy. This is useful for brokers that hand out tightly scoped credentials per tenant or per request.
25. Finding unused access keys
You need a list of every IAM user with the age of their password and access keys and when each key was last used. Which built-in feature gives this as a CSV?
- A.AWS Cost Explorer
- B.The IAM credential report
- C.Amazon Inspector findings
- D.The S3 server access log
Show answer
Answer: B. The IAM credential report
The credential report lists all users with password status, MFA status, access key age, last rotation and last used date. It is the quickest way to find stale keys to rotate or delete. Inspector scans workloads for vulnerabilities, and Cost Explorer shows spending.
26. How long a role session lasts
A data engineer's job runs 6 hours, but the credentials from assuming a role expire after 1 hour. What should you change?
- A.Set "Expire": "never" in the role's trust policy
- B.Switch the job to use the root user's access keys
- C.Raise the role's maximum session duration and request longer
- D.Nothing; role sessions can never last more than 1 hour
Show answer
Answer: C. Raise the role's maximum session duration and request longer
The default role session is one hour, but you can set the role's maximum session duration up to 12 hours and request a longer DurationSeconds when assuming it. SDKs that use a credential provider can also refresh credentials automatically before expiry. Role chaining is the exception, capped at one hour.
27. StringEquals vs StringLike
A condition must match any S3 prefix that starts with reports/2026/. Which operator is needed?
"Condition": { "???": { "s3:prefix": "reports/2026/*" } }- A.StringEquals, because it also expands wildcards
- B.StringLike, because it supports the * wildcard
- C.ArnEquals, because the prefix is part of an ARN
- D.NumericEquals, because 2026 is a number
Show answer
Answer: B. StringLike, because it supports the * wildcard
StringEquals compares the literal text, so "reports/2026/*" would only match a value with an actual asterisk. StringLike supports * and ? wildcards. Using the wrong operator is a common reason a condition silently never matches.
28. Using a key only through one service
You want a role to use a KMS key only when the request comes through Amazon S3 in me-central-1, not by calling KMS directly. Which condition fits?
- A.aws:SourceIp equal to the S3 service IP range
- B.kms:ViaService equal to s3.me-central-1.amazonaws.com
- C.kms:EncryptionAlgorithm equal to SYMMETRIC_DEFAULT
- D.aws:SecureTransport equal to true for S3 traffic
Show answer
Answer: B. kms:ViaService equal to s3.me-central-1.amazonaws.com
kms:ViaService limits key use to requests that an AWS service makes on the principal's behalf, such as S3 calling KMS for SSE-KMS. A direct kms:Decrypt call from the CLI would then be denied. Service IPs are not reliable or practical as conditions.
29. GCP VPC Service Controls
In Google Cloud, a stolen service account token is used from an attacker's laptop to copy BigQuery data to their own project. Which control is designed to stop that even with valid credentials?
- A.A VPC firewall rule denying egress on port 443 from all VMs
- B.Granting the service account the Viewer role instead of Editor
- C.Turning on default encryption at rest for BigQuery tables
- D.A VPC Service Controls perimeter around the projects and services
Show answer
Answer: D. A VPC Service Controls perimeter around the projects and services
VPC Service Controls create a perimeter around projects and Google APIs such as BigQuery and Cloud Storage, blocking data movement to resources outside it and requests from outside unless allowed by access levels. IAM alone trusts a valid token from anywhere. Firewall rules do not govern Google API calls made from the internet.
30. Admin blocked by an SCP
An SCP on your 'Prod' OU denies all actions outside me-central-1 and ap-south-1, with exceptions for global services. A member-account user with AdministratorAccess tries to launch EC2 in us-east-1. What happens?
- A.It succeeds, because AdministratorAccess overrides SCPs
- B.It succeeds, but CloudTrail marks it as a violation
- C.It is denied, because SCPs cap what any principal can do
- D.It is denied only if the user has no MFA session
Show answer
Answer: C. It is denied, because SCPs cap what any principal can do
Service control policies set the maximum permissions for every principal in member accounts, including account admins and the account root user. An identity policy cannot grant what an SCP denies. SCPs do not apply to the organization's management account, which is one reason to keep workloads out of it.
31. Assuming a role in another account
A user in AWS account A needs to assume the 'ReadAudit' role in account B. What must be in place?
- A.B's role trust policy allows A, and A's identity policy allows sts:AssumeRole on it
- B.Only an identity policy in account A allowing sts:AssumeRole on the role
- C.Only a trust policy on the role in account B naming account A
- D.Both accounts must be in the same AWS Organization and region
Show answer
Answer: A. B's role trust policy allows A, and A's identity policy allows sts:AssumeRole on it
Cross-account access needs both sides to agree. Account B decides who may assume its role through the trust policy, and account A must grant its own user permission to call sts:AssumeRole on that role. If either is missing, the call is denied.
32. Restricting a bucket to your organization
A shared S3 bucket should be readable by any role in any of your 30 AWS accounts, but by nobody outside your AWS Organization. Which bucket policy approach fits best?
- A.List all 30 account IDs and update the list for each new account
- B.Use a condition on aws:PrincipalOrgID matching your organization ID
- C.Make the bucket public and rely on obscure object names
- D.Use a condition on aws:SourceIp with your office IP range
Show answer
Answer: B. Use a condition on aws:PrincipalOrgID matching your organization ID
The aws:PrincipalOrgID condition key matches any principal from accounts in your organization, so new accounts are covered automatically. It is simpler and less error-prone than a long list of account IDs. Source IP conditions break for AWS services and remote workers, and public buckets are a classic data leak.
