Exam Bundle

Hard-coded access keys: Embed long-lived credentials in code, increasing exposure and rotation difficulty. This does not address the need for A Lambda function must access DynamoDB using role-based temporary credentials. The appropriate IAM role applies because IAM roles provide assumed temporary credentials to workloads rather than distributing embedded long-lived secrets.

Shared root credentials: Expose the highest-privilege identity and prevent individual accountability. This does not address the need for A Lambda function must access DynamoDB using role-based temporary credentials. The appropriate IAM role applies because IAM roles provide assumed temporary credentials to workloads rather than distributing embedded long-lived secrets.

IAM user password in code: Exposes credentials in source files instead of using temporary workload credentials. This does not address the need for A Lambda function must access DynamoDB using role-based temporary credentials. The appropriate IAM role applies because IAM roles provide assumed temporary credentials to workloads rather than distributing embedded long-lived secrets.

Individual inline user policies only: Repeat access configuration per user rather than applying group, role or policy patterns. That does not meet the requirement: An administrator wants to assign the same permissions to a collection of IAM users.

Root account is the high-privilege account owner identity, unsuitable for routine access. That does not meet the requirement: An administrator wants to assign the same permissions to a collection of IAM users.

Single shared IAM user: Eliminates separate per-person or per-workload identity and audit trails. That does not meet the requirement: An administrator wants to assign the same permissions to a collection of IAM users.

Root account is the high-privilege account owner identity, unsuitable for routine access. This does not address the need for An administrator wants to assign the same permissions to a collection of IAM users. The appropriate IAM user group applies because IAM user groups simplify permissions assignment across multiple IAM users.

Single shared IAM user: Eliminates separate per-person or per-workload identity and audit trails. This does not address the need for An administrator wants to assign the same permissions to a collection of IAM users. The appropriate IAM user group applies because IAM user groups simplify permissions assignment across multiple IAM users.

Individual inline user policies only: Repeat access configuration per user rather than applying group, role or policy patterns. This does not address the need for An administrator wants to assign the same permissions to a collection of IAM users. The appropriate IAM user group applies because IAM user groups simplify permissions assignment across multiple IAM users.

Root account is the high-privilege account owner identity, unsuitable for routine access. That does not meet the requirement: Consider this AWS requirement: A department hires multiple analysts who all need a common read-only policy.

Individual inline user policies only: Repeat access configuration per user rather than applying group, role or policy patterns. That does not meet the requirement: Consider this AWS requirement: A department hires multiple analysts who all need a common read-only policy.

Single shared IAM user: Eliminates separate per-person or per-workload identity and audit trails. That does not meet the requirement: Consider this AWS requirement: A department hires multiple analysts who all need a common read-only policy.

Single shared IAM user: Eliminates separate per-person or per-workload identity and audit trails. This does not address the need for A department hires multiple analysts who all need a common read-only policy. The appropriate IAM user group applies because IAM user groups simplify permissions assignment across multiple IAM users.

Individual inline user policies only: Repeat access configuration per user rather than applying group, role or policy patterns. This does not address the need for A department hires multiple analysts who all need a common read-only policy. The appropriate IAM user group applies because IAM user groups simplify permissions assignment across multiple IAM users.

Root account is the high-privilege account owner identity, unsuitable for routine access. This does not address the need for A department hires multiple analysts who all need a common read-only policy. The appropriate IAM user group applies because IAM user groups simplify permissions assignment across multiple IAM users.

Amazon GuardDuty: Detects suspicious activity through supported telemetry. That does not meet the requirement: Employees need centralized access to multiple AWS accounts using one workforce identity solution.

AWS IAM access keys are long-term programmatic credentials for IAM identities. That does not meet the requirement: Employees need centralized access to multiple AWS accounts using one workforce identity solution.

AWS KMS manages encryption keys and related permissions. That does not meet the requirement: Employees need centralized access to multiple AWS accounts using one workforce identity solution.

Amazon GuardDuty: Detects suspicious activity through supported telemetry. This does not address the need for Employees need centralized access to multiple AWS accounts using one workforce identity solution. The appropriate AWS IAM Identity Center applies because IAM Identity Center centrally manages workforce access to multiple AWS accounts and supported apps.

AWS KMS manages encryption keys and related permissions. This does not address the need for Employees need centralized access to multiple AWS accounts using one workforce identity solution. The appropriate AWS IAM Identity Center applies because IAM Identity Center centrally manages workforce access to multiple AWS accounts and supported apps.

AWS IAM access keys are long-term programmatic credentials for IAM identities. This does not address the need for Employees need centralized access to multiple AWS accounts using one workforce identity solution. The appropriate AWS IAM Identity Center applies because IAM Identity Center centrally manages workforce access to multiple AWS accounts and supported apps.

AWS IAM access keys are long-term programmatic credentials for IAM identities. That does not meet the requirement: A technical reviewer evaluates this need: An organization wants workforce users to reach assigned AWS accounts and applications with centralized sign-in.

AWS KMS manages encryption keys and related permissions. That does not meet the requirement: A technical reviewer evaluates this need: An organization wants workforce users to reach assigned AWS accounts and applications with centralized sign-in.

Amazon GuardDuty: Detects suspicious activity through supported telemetry. That does not meet the requirement: A technical reviewer evaluates this need: An organization wants workforce users to reach assigned AWS accounts and applications with centralized sign-in.

AWS KMS manages encryption keys and related permissions. This does not address the need for An organization wants workforce users to reach assigned AWS accounts and applications with centralized sign-in. The appropriate AWS IAM Identity Center applies because IAM Identity Center centrally manages workforce access to multiple AWS accounts and supported apps.

AWS IAM access keys are long-term programmatic credentials for IAM identities. This does not address the need for An organization wants workforce users to reach assigned AWS accounts and applications with centralized sign-in. The appropriate AWS IAM Identity Center applies because IAM Identity Center centrally manages workforce access to multiple AWS accounts and supported apps.

Amazon GuardDuty: Detects suspicious activity through supported telemetry. This does not address the need for An organization wants workforce users to reach assigned AWS accounts and applications with centralized sign-in. The appropriate AWS IAM Identity Center applies because IAM Identity Center centrally manages workforce access to multiple AWS accounts and supported apps.

Security group ingress rule: Controls specified inbound network access, not identity authentication. That does not meet the requirement: An administrator wants another verification factor beyond password for sensitive console access.

Longer password only: Improves a password characteristic but does not add a distinct authentication factor. That does not meet the requirement: An administrator wants another verification factor beyond password for sensitive console access.

S3 versioning: Retains object versions rather than establishing a second factor of authentication. That does not meet the requirement: An administrator wants another verification factor beyond password for sensitive console access.

Longer password only: Improves a password characteristic but does not add a distinct authentication factor. This does not address the need for An administrator wants another verification factor beyond password for sensitive console access. The appropriate Multi-factor authentication applies because MFA adds an independent factor and reduces risk from a compromised password.

Security group ingress rule: Controls specified inbound network access, not identity authentication. This does not address the need for An administrator wants another verification factor beyond password for sensitive console access. The appropriate Multi-factor authentication applies because MFA adds an independent factor and reduces risk from a compromised password.

S3 versioning: Retains object versions rather than establishing a second factor of authentication. This does not address the need for An administrator wants another verification factor beyond password for sensitive console access. The appropriate Multi-factor authentication applies because MFA adds an independent factor and reduces risk from a compromised password.