SOA-C03 practice question: IAM users, roles and policies (1 of 2)
Security and Compliance A free question from our original SOA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A logistics broker's operations engineers sign in as IAM users with AdministratorAccess.
After an accidental mass termination of EC2 instances, the security team requires that ec2:TerminateInstances and ec2:StopInstances succeed only when the caller signed in with MFA.
Engineers must keep all their other permissions, whether or not they used MFA.
Which policy change should a CloudOps engineer make for the engineers' group?
Choose one answer.
AA. Update the account password policy to require MFA for every IAM user who calls EC2 stop or terminate actions.
BB. Add a policy that allows the two actions only with the condition Bool aws:MultiFactorAuthPresent true.
CC. Add a policy that denies the two actions with the condition BoolIfExists aws:MultiFactorAuthPresent false.
DD. Remove AdministratorAccess and require engineers to assume a role through IAM Identity Center for every task they perform.
B. Wrong: An extra Allow does nothing while AdministratorAccess already allows the actions without MFA. Only an explicit Deny can take away a permission another policy grants. Learn more: Policy evaluation logic (opens in a new tab)
C. Right: Correct. An explicit Deny overrides the Allow in AdministratorAccess. BoolIfExists also denies requests where the key is missing, such as calls made with long-term access keys, so only MFA-authenticated calls succeed. Learn more: AWS global condition context keys (opens in a new tab)
Explicit Deny statements always win in IAM policy evaluation, so they are the way to restrict an action that a broad policy allows. aws:MultiFactorAuthPresent shows whether the caller authenticated with MFA, and BoolIfExists treats a missing key, as with long-term access keys, as not authenticated with MFA. Allow statements with conditions cannot remove permissions granted elsewhere.
Want more on IAM users, roles and policies? The 5 full-length practice sets have 10 more IAM users, roles and policies questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →