4.0 Identity and Access Management SCS-C03 Practice Quiz

• A. Define job-function roles and group assignments, then attach managed policies that represent approved permission sets
• B. Attach a unique inline policy to every individual user
• C. Share one administrator user across all engineers
• D. Use security group membership as the AWS permission model

Group-based and role-based assignments reduce per-user policy sprawl and make authorization changes easier to review and audit.

• A. Create reviewed policy templates for common job functions and migrate teams to those templates
• B. Keep copying old wildcard policies because they are already working
• C. Delete all policies before understanding dependencies
• D. Allow every team to create administrator roles to avoid policy review

Reviewed templates reduce copy-paste permission drift and create a consistent baseline for future access changes.

• A. One role with AdministratorAccess in every account
• B. Separate roles or permission sets by environment with group-based assignment
• C. One IAM user per environment with shared passwords
• D. Resource tags only, with no IAM policies

Environment-specific roles allow permissions to reflect risk and job need without granting broad access everywhere.

• A. Use one role for deployment, runtime, and emergency actions
• B. Use distinct roles for each operational context with different trust policies and permissions
• C. Use local application configuration files as the IAM authority
• D. Use only resource names to imply permission level

Separating roles by context limits what each activity can do and improves audit clarity.

• A. Only the EC2 instance type in the account
• B. Identity provider group mappings, SAML attributes, role trust policy, and permission set assignment
• C. Only the S3 bucket storage class
• D. Only CloudFront response headers

Federation depends on both identity-provider assertions and AWS-side role or permission set configuration.

• A. Unreviewed inline policies written manually in the console
• B. A policy that grants iam:* to every team role
• C. Reusable managed policies and permission boundaries applied through infrastructure as code
• D. An email thread listing allowed actions

Managed patterns and boundaries let teams self-serve while staying inside approved authorization limits.

• A. Create one administrator policy per project and attach it broadly
• B. Let users self-assign any project tag without controls
• C. ABAC with governed principal tags and resource tags
• D. Use VPC route tables to determine project permissions

Attribute-based access control can scale project authorization by comparing trusted attributes rather than creating a policy per project.

• A. Separate unmanaged IAM users in each account for every employee
• B. One account root user login for auditors
• C. Bucket ACLs that list every auditor
• D. Standardized roles or IAM Identity Center permission sets assigned to appropriate groups

Standard permission sets keep access consistent across accounts while still mapping to different job functions.