ExamPark
Course menuDOP-C02

Exams / DOP-C02 / Least privilege, permissions boundaries and ABAC / Question 1

DOP-C02 practice question: Least privilege, permissions boundaries and ABAC (1 of 3)

Security and Compliance A free question from our original DOP-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

A regional bank's engineering teams run EC2 instances that are tagged with the owning team's name in a tag called team. Each team has its own IAM principals, and each principal carries a team tag that matches its owning team.

The platform team wants developers to start and stop only the instances that belong to their own team, including instances that teams create in the future. The bank wants one shared policy rather than a separate policy for each team.

Which approach meets these requirements?

Choose one answer.

  1. A. Create one IAM group for each team with a policy that lists the ARNs of that team's current instances, and add the group's members to the policy as each instance is created.
  2. B. Attach a policy that allows ec2:StartInstances and ec2:StopInstances on all instances, and add a deny statement for each team that lists the instance IDs owned by every other team.
  3. C. Add a resource-based policy to each EC2 instance that allows the team's principals to start and stop it, so that access follows the instance wherever it is created.
  4. D. Attach one policy that allows start and stop actions when the instance's team tag matches the caller's team principal tag, using aws:ResourceTag and aws:PrincipalTag.
Show the answer and explanation

Answer: D

  • A. Wrong: This works for current instances, but the policy changes every time an instance is created. It also needs a separate group and policy for each team, which the bank wanted to avoid.
  • B. Wrong: The deny lists must change every time any team creates an instance, and the bank would maintain one statement per team. The approach does not follow the tags, so new instances are unprotected until someone edits the policy. Learn more: Define permissions based on attributes with ABAC authorization (opens in a new tab)
  • C. Wrong: EC2 instances do not support resource-based policies for starting and stopping, so this cannot be configured. The access control has to come from identity-based policies.
  • D. Right: Correct. Attribute-based access control compares tags on the resource with tags on the caller, so one shared policy covers every team and every new instance. Instances that a team creates with its tag are covered automatically. Learn more: Define permissions based on attributes with ABAC authorization (opens in a new tab)

Explanation

Attribute-based access control uses tags to match the caller's principal tags with the resource's tags, so one policy covers every team and every future instance. Per-team groups with instance ARNs need constant upkeep, broad allows with local denies are hard to keep right, and EC2 instances do not take resource-based start and stop policies.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free DOP-C02 practice examPractice Least privilege, permissions boundaries and ABACAll Least privilege, permissions boundaries and ABAC questions

Want more on Least privilege, permissions boundaries and ABAC? The 5 full-length practice sets have 14 more Least privilege, permissions boundaries and ABAC questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets