Exams / CLF-C02 / Authentication and federation / Question 2
CLF-C02 practice question: Authentication and federation (2 of 2)
Security and Compliance A free question from our original CLF-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
A company uses AWS IAM Identity Center with AWS Organizations to manage workforce access to 40 AWS accounts. It wants to define a 'database administrator' set of permissions once and then give it to a group of users in 12 of those accounts. Which feature should it use?
Choose one answer.
- AA. IAM permissions boundaries
- BB. Permission sets in IAM Identity Center
- CC. Service control policies (SCPs)
- DD. An IAM user group in the management account
Show the answer and explanation
Answer: B
- A. Wrong: Permissions boundaries set the maximum permissions an IAM entity can have. They are not a way to define and assign job-function access across accounts.
- B. Right: Correct. Permission sets define common job-function permissions once and are provisioned to the accounts where you assign them to users and groups.
- C. Wrong: SCPs set guardrails on what accounts can do, but they never grant permissions on their own.
- D. Wrong: IAM groups exist in a single account. They cannot give users access to roles in 12 other accounts.
Explanation
IAM Identity Center gives workforce users one place to sign in and reach their assigned AWS accounts and applications. Permission sets let administrators define job-function permissions once and provision them to many accounts, where they are assigned to users and groups. This avoids creating separate IAM users or groups in every account.
Study
Keep practising
Answer questions with a score at the end, or practise just this topic with the explanation after each one. No sign-up needed.