ExamPark
Course menuCLF-C02

Exams / CLF-C02 / Authentication and federation / Question 2

CLF-C02 practice question: Authentication and federation (2 of 2)

Security and Compliance A free question from our original CLF-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

A company runs 40 AWS accounts in AWS Organizations and uses IAM Identity Center for workforce sign-in.

Its data analysts need the same permissions in 12 of those accounts.

The security team wants one definition that it can change once and apply to all 12 accounts.

Which feature should it use?

Choose one answer.

  1. A. IAM permissions boundaries attached to each analyst's role in every one of the 12 accounts
  2. B. A permission set in IAM Identity Center, assigned to the analysts' group in 12 accounts
  3. C. Service control policies (SCPs) attached to the 12 accounts that allow the analysts' actions
  4. D. An IAM group in each of the 12 accounts, with the same managed policy copied into each one
Show the answer and explanation

Answer: B

  • A. Wrong: A permissions boundary limits the maximum permissions a role can get, and it grants nothing itself. Attaching one per account would still mean managing each account separately.
  • B. Right: Correct. A permission set is a reusable template of IAM policies, maintained in one place. IAM Identity Center creates the matching roles in each account where the permission set is assigned. Learn more: Permission sets in IAM Identity Center (opens in a new tab)
  • C. Wrong: SCPs set the maximum permissions that accounts can use. They never grant permissions by themselves, so the analysts would still have no access.
  • D. Wrong: Copying one policy into 12 accounts creates 12 copies to keep in step. Any change means editing every account by hand, which the security team wants to avoid.

Explanation

Permission sets let administrators define job-function permissions once in IAM Identity Center and assign them to users or groups in the accounts they need. IAM Identity Center then creates the matching roles in each account. Permissions boundaries and SCPs limit permissions and do not grant access, and separate IAM groups mean maintaining copies in every account.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free CLF-C02 practice examPractice Authentication and federationAll Authentication and federation questions

Want more on Authentication and federation? The 5 full-length practice sets have 10 more Authentication and federation questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets