Welcome to Part 4 of our dedicated preparation series for the AWS Certified Cloud Practitioner (CLF-C02) certification. Identity governance and access control form the absolute foundation of cloud security. While studying official documentation builds your baseline knowledge, solving realistic scenario-based questions is the single most effective way to master the core principles of AWS Identity and Access Management (IAM), credential hygiene, and access policies before taking the actual exam.
 |
| AWS Certified Cloud Practitioner (CLF-C02) Practice Test - IAM & Security Best Practices |
In this aws cloud practitioner practice test free guide (Part 4), we break down 20 high-yield questions (Questions 1 through 20) focused specifically on IAM & Security Best Practices. You will test your understanding of IAM users, user groups, IAM roles for service delegation, JSON permission policies, the principle of least privilege, root account protection, Multi-Factor Authentication (MFA), and credential rotation. Every question includes an exhaustive technical breakdown explaining why the correct answer is right and why the distractors do not meet AWS security benchmarks.
AWS Cloud Practitioner (CLF-C02) Practice Questions
Q1: AWS Root User vs. Delegated IAM Permissions
Even when an IAM identity is granted full administrative access (AdministratorAccess), certain sensitive account-level actions remain restricted.
Which of the following tasks requires signing in with AWS account root user credentials?
• Root User Exclusive Tasks: Closing an AWS account is a privileged administrative action that strictly requires the root user's email and password. Even an IAM user or role with full administrative privileges (
AdministratorAccess) is blocked from executing this operation.Why are the other options incorrect?
• Deleting an S3 bucket: Can be performed by any delegated IAM identity with the
s3:DeleteBucket permission.• Attaching IAM policies: Managing IAM policies and roles is a routine task delegated to IAM administrators.
• Configuring CloudTrail: Creating management trails can be managed by IAM users with appropriate CloudTrail administrative permissions.
Q2: IAM Roles & Cross-Account Access
Delegating access across multiple AWS accounts requires a secure way to let users in one AWS account temporarily access resources located in a different AWS account.
Which IAM feature should be configured in the target account to enable this cross-account access?
• Cross-Account IAM Roles: An IAM role is an identity that can be assumed by trusted entities across different AWS accounts using temporary security credentials (via AWS STS). By configuring an IAM trust policy on the role in the target account, you allow external users to assume the role and access target resources securely.
Why are the other options incorrect?
• IAM group: A collection of IAM users within a single account; groups cannot span across multiple accounts or be assumed.
• IAM tag: Key-value metadata attached to resources for tracking or attribute-based access control (ABAC), not an identity delegation mechanism.
• IAM Access Analyzer: A security analysis tool that detects resources shared with external accounts, rather than configuring permissions.
Q3: Root User Best Practices & Billing Access
Day-to-day cloud operations should be performed by IAM users with assigned permissions rather than logging in as the AWS account root user.
Which of the following tasks can an IAM user perform when granted the required IAM permissions?
• Delegated Billing Access: An IAM user or role can view billing reports, monthly invoices, and usage breakdowns once the root account enables IAM access to billing and attaches appropriate read-only billing policies.
Why are the other options incorrect?
• Changing AWS Support plans: Modifying or canceling enterprise support tiers requires root user credentials.
• Closing an account: Exclusively restricted to the AWS account root user.
• Changing root user email/credentials: Changing the primary email, root password, or account name requires direct root user login.
Q4: Root Account Security & Access Keys
Determine whether the following statement is True or False:
"According to AWS security best practices, administrators should generate long-term access keys for the AWS account root user to automate routine command-line (AWS CLI) tasks."
• Root Account Best Practices: AWS strongly advises never creating access keys (Access Key ID and Secret Access Key) for the root user. If root access keys already exist, they should be deleted immediately. For daily administrative and automated CLI tasks, you should create dedicated IAM users or IAM roles with temporary credentials granted strictly through the principle of least privilege.
Q5: IAM Roles & Application Credentials
Determine whether the following statement is True or False:
"Attaching an IAM role directly to an Amazon EC2 instance allows applications running on that instance to securely obtain temporary credentials without embedding hardcoded access keys in application code."
• IAM Roles for EC2: Hardcoding permanent AWS access keys inside application source code or configuration files is a critical security vulnerability. By attaching an IAM role (via an instance profile) to an Amazon EC2 instance, AWS automatically rotates and delivers short-term, temporary security credentials to the application via the Instance Metadata Service (IMDS).
Q6: Core IAM Entities & Building Blocks (Matching)
Match each description below to its corresponding IAM Entity:
1. A formal JSON document that explicitly specifies permitted or denied actions on targeted AWS resources:
2. An identity granted temporary security credentials, typically assumed by AWS services, applications, or federated users:
3. A collection of users used to apply common permission policies to multiple employees simultaneously:
• Description 1 matches IAM Policy: IAM policies are JSON documents defining the Effect (Allow/Deny), Action (e.g.,
s3:GetObject), and Resource boundaries for identities.• Description 2 matches IAM Role: An IAM role is an identity that does not have permanent credentials; instead, trusted entities (like EC2 instances or Lambda functions) assume the role dynamically using temporary security keys.
• Description 3 matches IAM User Group: User groups allow administrators to assign permissions to multiple IAM users at once (e.g., Developers, Admins, Auditors), simplifying access management.
Q7: IAM Authentication & Security Credentials (Matching)
Match each security credential description below to its corresponding IAM Credential Type:
1. A combination of an Access Key ID and Secret Access Key used to make programmatic requests via AWS CLI or SDKs:
2. A critical security mechanism requiring a time-based code from a virtual app or hardware device in addition to password sign-in:
3. A confidential string used exclusively to sign in interactively to the web-based AWS Management Console:
• Description 1 matches Access Keys: Access keys (Access Key ID & Secret Access Key) are long-term credentials used strictly for programmatic API calls, SDK scripts, and AWS Command Line Interface (CLI) commands.
• Description 2 matches Multi-Factor Authentication (MFA): MFA provides a vital layer of defense-in-depth by requiring a time-synchronized one-time password (OTP) generated from an authenticator app (e.g., Google Authenticator) or hardware token (e.g., YubiKey).
• Description 3 matches Console Password: Passwords provide interactive access for human administrators authenticating into the AWS Management Console browser interface.
Q8: IAM Evaluation Logic & Governance (Yes/No)
Review the three statements below regarding IAM policies, permission logic, and access governance. Determine whether each statement is Yes (True) or No (False):
1. Under AWS IAM policy evaluation logic, an explicit Deny statement always overrides any conflicting Allow statements.
2. Applying the principle of least privilege means initially assigning full administrator permissions to all new IAM users and revoking rights as errors occur.
3. Service Control Policies (SCPs) configured in AWS Organizations establish maximum permission guardrails across member accounts without granting direct access.
• Statement 1 is True (Yes): Golden Rule of IAM Evaluation: By default, all requests are implicitly denied. An explicit Allow overrides the default, but an explicit Deny always overrides any Allow across all evaluated identity and resource-based policies.
• Statement 2 is False (No): The Principle of Least Privilege mandates granting only the minimum permissions necessary for an identity to complete its assigned job functions, starting with zero access and incrementally adding rights as required.
• Statement 3 is True (Yes): Service Control Policies (SCPs) act as central organizational guardrails. An SCP restricts the maximum permissions available to IAM users and roles in member accounts, even if an account administrator attaches an
AdministratorAccess policy.
Q9: IAM Roles for EC2 & Temporary Credentials
Granting software running on Amazon EC2 instances secure access to other AWS services without embedding permanent access keys into application code is a key cloud security practice.
Which AWS service provides this capability by assigning roles and temporary credentials to compute instances?
• IAM Roles for Compute Workloads: IAM allows administrators to create IAM roles and attach them to Amazon EC2 instances (via an instance profile). Applications running on the virtual server automatically receive rotated, short-term security credentials from the Instance Metadata Service (IMDS), eliminating the security risk of storing hardcoded access keys in source code.
Why are the other options incorrect?
• Security Groups: Stateful virtual firewalls that govern network-layer IP and port traffic, not identity credentials.
• AWS CloudTrail: An audit-logging service that records API activity across accounts, rather than granting permissions.
• AWS KMS: A cryptographic key management service used to encrypt and decrypt data at rest.
Q10: AWS Root User Architecture & Privileges
In the context of AWS identity management and security best practices, which statement correctly describes the AWS account root user?
• Root User Profile: When you first sign up for an AWS account, you authenticate with the root user identity (the account sign-up email address). It has complete, unrestricted administrative access to all AWS services and billing resources across the account and should be locked down with MFA immediately.
Why are the other options incorrect?
• Option A: Multi-Factor Authentication (MFA) can and should be enabled on individual IAM users as well as the root user.
• Option B: Standard IAM users and federated single sign-on (SSO) users can also sign in to the AWS Management Console.
• Option D: The root user password can and must be changed, rotated, and protected with strong complexity standards.
Q11: Workforce SSO & AWS IAM Identity Center
An enterprise wants to streamline employee access to multiple AWS accounts and integrated third-party SaaS applications (such as Salesforce, Microsoft 365, and Slack). The IT department needs a centralized user portal where staff can authenticate once to access all their assigned cloud tools and accounts.
Which AWS service fulfills these requirements?
• AWS IAM Identity Center: Provides a unified web portal that centrally manages single sign-on (SSO) access across multiple AWS accounts in AWS Organizations, as well as integrated third-party business SaaS applications (e.g., Slack, Microsoft 365, Salesforce). Users authenticate once to access all assigned roles and apps.
Why are the other options incorrect?
• Amazon Cognito: A Customer Identity and Access Management (CIAM) service used for customer sign-up/sign-in inside custom mobile and web applications.
• AWS IAM: Manages users and permissions within a single AWS account, but does not natively provide a multi-account SSO web portal for SaaS applications.
• AWS Directory Service: Provides a managed Active Directory in AWS, but IAM Identity Center handles the multi-account single sign-on portal experience.
Q12: AWS IAM Pricing & Account Governance
Which of the following core AWS security features is always offered completely free of charge to all AWS account holders?
• No-Cost Security Governance: AWS Identity and Access Management (IAM) is a foundational feature of every AWS account provided at no additional charge. You incur zero costs for creating and managing users, user groups, IAM roles, JSON policies, or configuring Multi-Factor Authentication (MFA). You pay only for the underlying AWS resources (such as EC2 or S3) that your identities interact with.
Why are the other options incorrect?
• Amazon Aurora: Incurs compute instance hourly costs, storage consumption, and I/O request fees.
• Amazon EC2: Incurs hourly or per-second compute capacity charges based on instance type and running duration.
• Amazon S3: Charges per gigabyte of stored data, API requests (GET/PUT), and outbound data transfers.
Q13: AWS IAM Security Best Practices & MFA
A security administrator is auditing the identity management configurations of a newly created AWS account.
Which of the following actions directly aligns with AWS Identity and Access Management (IAM) security best practices?
• IAM Security Hardening: Enabling Multi-Factor Authentication (MFA) across all administrative accounts—especially the AWS account root user—is a primary IAM best practice. MFA requires a physical or virtual token code in addition to standard credentials, preventing unauthorized access in the event of password compromise.
Why are the other options incorrect?
• Sharing root credentials: Root credentials should never be shared; teams must create dedicated IAM users or federated identities with delegated roles.
• Wildcard permissions (*): Violates the principle of least privilege, exposing infrastructure to severe accidental or malicious damage.
• Retaining static access keys indefinitely: Credentials should be rotated regularly, and applications should use temporary credentials via IAM roles.
Q14: IAM Credential Reports & Account Auditing
A compliance officer needs an account-wide audit report listing all IAM user identities, the last time their passwords were used, whether access keys are active, and the current status of Multi-Factor Authentication (MFA) devices.
Which AWS feature generates this security and identity status report?
• IAM Credential Report: A downloadable CSV report generated directly within AWS IAM that provides comprehensive audit data on all IAM users in the account. It details password ages, last sign-in timestamps, active access key statuses, key rotation dates, and whether MFA is enabled for each identity.
Why are the other options incorrect?
• AWS Cost and Usage Reports: Detailed raw billing datasets containing resource consumption and financial line items.
• AWS Cost Explorer: A financial forecasting and spending analysis visualization tool.
• AWS Systems Manager Inventory: Collects software, OS, and application metadata running on managed compute instances.
Q15: JSON IAM Policy Structure (Multiple Choice)
Cloud security engineers write custom JSON policies in AWS Identity and Access Management (IAM) to govern user actions.
Which TWO of the following elements are required in every standard identity-based IAM policy statement? (Select 2)
• IAM Policy Core Structure: Every basic identity-based policy statement requires an
Effect (specifying whether the statement results in an Allow or an explicit Deny), an Action (the specific API calls permitted or blocked), and a Resource (the targeted ARNs).Why the other choices are incorrect:
• Principal: Only required in Resource-based policies (like S3 bucket policies) or IAM role trust policies to specify WHO can access the resource. Identity-based policies do not include a Principal because the identity to which the policy is attached IS the principal.
• MultiFactorAuthPresent & SourceIp: These are optional Condition elements used for advanced context filtering.
Q16: Identity Federation & IAM Architecture (Yes/No)
Review the three statements below regarding AWS Identity Federation and IAM architecture. Determine whether each statement is Yes (True) or No (False):
1. AWS IAM Identity Center can federate workforce identities from external identity providers (such as Okta or Microsoft Entra ID) using SAML 2.0.
2. AWS IAM is a regional service, requiring administrators to recreate users, groups, and policies separately within each global AWS Region.
3. Amazon Cognito is designed specifically for customer-facing mobile and web applications to handle user registration, sign-in, and guest authentication.
• Statement 1 is True (Yes): AWS IAM Identity Center supports open standards like SAML 2.0 and SCIM, allowing organizations to integrate existing enterprise directories (Okta, Microsoft Entra ID, Ping) for single sign-on.
• Statement 2 is False (No): Universal AWS Concept: IAM is a Global service. Users, roles, groups, and policies created in IAM are automatically recognized and enforced across all global AWS Regions worldwide without regional re-creation.
• Statement 3 is True (Yes): Amazon Cognito provides Customer Identity and Access Management (CIAM), enabling web and mobile apps to authenticate external public users via email/password or social logins (Apple, Google, Facebook).
Q17: External Resource Sharing & IAM Access Analyzer
A security team wants to continuously inspect their Amazon S3 buckets, KMS keys, and IAM roles to ensure no internal cloud resources have been inadvertently shared with external AWS accounts or public internet users.
Which IAM feature analyzes resource-based policies to identify unintended external access?
• IAM Access Analyzer: Evaluates resource-based policies (attached to S3 buckets, SQS queues, Secrets Manager secrets, and KMS keys) using mathematical logic to identify resources accessible from outside your AWS organization or account boundary, alerting security teams to unintended public or cross-account access.
Why are the other options incorrect?
• IAM Credential Report: Audits password age, access key activity, and MFA device status for IAM users in the account.
• AWS Security Hub: A centralized dashboard aggregating compliance checks and security alerts from multiple tools.
• Amazon GuardDuty: An intelligent threat detection service that analyzes VPC Flow Logs, DNS logs, and CloudTrail events for malicious activity.
Q18: IAM Account Password Policy Governance (Select 2)
To enforce corporate compliance requirements, a security administrator needs to configure password complexity rules for all IAM users who sign in to the AWS Management Console.
Which TWO requirements can be enforced using an AWS IAM account password policy? (Select 2)
• IAM Password Policy Rules: Administrators can define custom account-wide password policies in IAM to mandate minimum character lengths (up to 128 characters), require mixed character types (uppercase, lowercase, digits, symbols), enforce maximum password age (expiration periods), and prevent users from reusing previous passwords.
Why the other choices are incorrect:
• Biometric fingerprint scanning: Managed by client operating systems or FIDO security keys, not configured via IAM password policies.
• Deleting inactive accounts: IAM password policies do not automatically delete user accounts; administrators manage account lifecycles manually or via automation scripts.
• Matching corporate email domain: IAM does not validate password strings against email formats.
Q19: IAM Policy Types & Resource-Based Policies
A security architect needs to attach an access control policy directly to an Amazon S3 bucket to specify which external accounts, IAM roles, and VPC endpoints are permitted to download bucket objects.
Which type of policy is attached directly to the AWS resource itself rather than to an IAM identity?
• Resource-Based Policies: JSON policy documents attached directly to specific AWS resources (such as Amazon S3 bucket policies, AWS KMS key policies, or Amazon SQS queue policies). They define the
Principal (who is allowed access) and the actions they can perform on that specific resource.Why are the other options incorrect?
• Identity-based policy: Attached directly to IAM users, user groups, or IAM roles to define what that identity can access.
• Permission boundary: An advanced feature that sets the maximum permissions an identity-based policy can grant to an IAM entity.
• Service Control Policy (SCP): Applied at the organizational level (AWS Organizations) to set maximum guardrails on AWS accounts.
Q20: Global Identity Scope in AWS
Determine whether the following statement is True or False:
"AWS Identity and Access Management (IAM) is a Global service, meaning users, roles, and security policies created in IAM apply seamlessly across all AWS Regions worldwide without requiring regional configuration."
• Global Scope of IAM: AWS IAM is engineered as a global service. When you create an IAM user, role, user group, or policy, it is stored centrally and replicated globally. That identity can interact with resources in US East (N. Virginia), Europe (Frankfurt), Asia Pacific (Tokyo), or any other global region according to its assigned permissions without requiring regional recreation.
Key Takeaways for IAM & Security Best Practices (Part 4 Summary)
• Root User Hardening: The AWS account root user possesses unrestricted access across all resources and billing data. Best practices mandate enabling Multi-Factor Authentication (MFA) immediately, locking away root credentials, never generating long-term root access keys, and reserving root logins strictly for exclusive tasks (like closing the account or changing support plans).
• Principle of Least Privilege: All IAM requests are implicitly denied by default. Organizations must grant only the minimum permissions necessary for users or roles to perform specific job duties, and remember that an explicit Deny always overrides any Allow across evaluated policies.
• Temporary Credentials with IAM Roles: Applications running on compute instances (like Amazon EC2 or AWS Lambda) must never use hardcoded access keys. Attaching an IAM role delivers rotated, temporary security credentials via the Instance Metadata Service (IMDS).
• Identity-Based vs. Resource-Based Policies: Identity-based policies attach to IAM users, groups, or roles to dictate what they can access. Resource-based policies attach directly to resources (e.g., S3 Bucket Policies, KMS Key Policies) and specify the
Principalallowed to interact with that specific resource.• Auditing & Credential Hygiene: Use IAM Credential Reports to audit password ages, MFA enforcement, and active access keys across all accounts, and deploy IAM Access Analyzer to detect resources inadvertently exposed to external accounts or the public internet.
Frequently Asked Questions (AWS CLF-C02 FAQ)
1. What is the fundamental difference between an IAM User and an IAM Role?
An IAM User represents a permanent identity created for an individual person or dedicated system that requires long-term credentials (a console password or static access keys). In contrast, an IAM Role is an identity with assigned permissions that does not have permanent credentials. Instead, trusted entities—such as Amazon EC2 instances, AWS Lambda functions, cross-account administrators, or federated corporate users—temporarily assume the role to receive short-term, auto-rotated security credentials through AWS Security Token Service (AWS STS), significantly improving security posture.
2. Why does an explicit Deny always take precedence in AWS IAM policy evaluation?
AWS IAM follows a strict default-deny evaluation model designed to guarantee robust access control. When an identity requests an action on an AWS resource, IAM evaluates all applicable identity-based policies, resource-based policies, and Service Control Policies (SCPs). If any single policy contains an explicit Deny for that specific action or resource, access is immediately blocked, completely overriding any existing Allow permissions. This ensures security administrators can set definitive security boundaries and organizational guardrails that cannot be accidentally bypassed.
3. What is the difference between Identity-Based Policies and Resource-Based Policies?
Identity-based policies are JSON permission documents attached directly to IAM users, user groups, or IAM roles to specify what actions that identity is permitted to perform across AWS resources. Conversely, Resource-based policies are JSON documents attached directly to an AWS resource itself (such as an Amazon S3 bucket policy, Amazon SQS queue policy, or AWS KMS key policy). Resource-based policies must include a Principal element to explicitly declare which AWS accounts, roles, or users are granted permission to access that specific resource.
4. How does AWS IAM Access Analyzer help protect accounts from unintended public exposure?
AWS IAM Access Analyzer is a built-in security feature that applies mathematical analysis and automated reasoning to inspect resource-based policies attached to cloud assets like Amazon S3 buckets, AWS KMS keys, and Secrets Manager secrets. It evaluates policy permissions to determine whether any resource is accessible by identities outside of your trusted AWS organization or AWS account. When external or public access is identified, IAM Access Analyzer generates actionable security findings so administrators can remediate accidental exposure.
Ready to See Your Results?
Congratulations on completing all 20 questions of this aws cloud practitioner practice test free module! Mastering identity governance, IAM roles, and security hardening is essential for scoring high on the AWS Certified Cloud Practitioner (CLF-C02) exam.
Click the button above to calculate your final score, share your score in the comments below, and proceed to Part 5 to master AWS Security, Encryption, and Threat Protection Services!
