ExamPark
Course menuSOA-C03

Exams / SOA-C03 / IAM users, roles and policies / Question 1

SOA-C03 practice question: IAM users, roles and policies (1 of 2)

Security and Compliance A free question from our original SOA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

A logistics broker's operations engineers sign in as IAM users with AdministratorAccess. After an accidental mass termination of EC2 instances, the security team requires that ec2:TerminateInstances and ec2:StopInstances succeed only when the caller signed in with MFA. Engineers must keep all their other permissions, whether or not they used MFA. Which policy change should a CloudOps engineer make for the engineers' group?

Choose one answer.

  1. A. Update the account password policy to require MFA for every IAM user who calls EC2 stop or terminate actions.
  2. B. Add a policy that allows the two actions only with the condition Bool aws:MultiFactorAuthPresent true.
  3. C. Add a policy that denies the two actions with the condition BoolIfExists aws:MultiFactorAuthPresent false.
  4. D. Remove AdministratorAccess and require engineers to assume a role through IAM Identity Center for every task they perform.
Show the answer and explanation

Answer: C

Explanation

Explicit Deny statements always win in IAM policy evaluation, so they are the way to restrict an action that a broad policy allows. aws:MultiFactorAuthPresent shows whether the caller authenticated with MFA, and BoolIfExists treats a missing key, as with long-term access keys, as not authenticated with MFA. Allow statements with conditions cannot remove permissions granted elsewhere.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free SOA-C03 practice examPractice IAM users, roles and policiesAll IAM users, roles and policies questions