Exam Bundle

AWS IAM Identity Center: IAM Identity Center centrally manages workforce access to multiple AWS accounts and supported apps. This does not address the need for A team needs hierarchical application configuration values and optional protected parameters. The appropriate SSM Parameter Store applies because Parameter Store manages configuration and SecureString parameters; it is not a general audit-event service.

AWS Artifact supplies compliance reports and agreements. This does not address the need for A team needs hierarchical application configuration values and optional protected parameters. The appropriate SSM Parameter Store applies because Parameter Store manages configuration and SecureString parameters; it is not a general audit-event service.

AWS CloudTrail records API requests and account management events. This does not address the need for A team needs hierarchical application configuration values and optional protected parameters. The appropriate SSM Parameter Store applies because Parameter Store manages configuration and SecureString parameters; it is not a general audit-event service.

AWS CloudTrail records API requests and account management events. That does not meet the requirement: A developer stores nonsecret configuration strings and a few encrypted parameters without a dedicated secrets-rotation workflow.

AWS Artifact supplies compliance reports and agreements. That does not meet the requirement: A developer stores nonsecret configuration strings and a few encrypted parameters without a dedicated secrets-rotation workflow.

AWS IAM Identity Center: IAM Identity Center centrally manages workforce access to multiple AWS accounts and supported apps. That does not meet the requirement: A developer stores nonsecret configuration strings and a few encrypted parameters without a dedicated secrets-rotation workflow.

AWS CloudTrail records API requests and account management events. This does not address the need for A developer stores nonsecret configuration strings and a few encrypted parameters without a dedicated secrets-rotation workflow. The appropriate SSM Parameter Store applies because Parameter Store manages configuration and SecureString parameters; it is not a general audit-event service.

AWS Artifact supplies compliance reports and agreements. This does not address the need for A developer stores nonsecret configuration strings and a few encrypted parameters without a dedicated secrets-rotation workflow. The appropriate SSM Parameter Store applies because Parameter Store manages configuration and SecureString parameters; it is not a general audit-event service.

AWS IAM Identity Center: IAM Identity Center centrally manages workforce access to multiple AWS accounts and supported apps. This does not address the need for A developer stores nonsecret configuration strings and a few encrypted parameters without a dedicated secrets-rotation workflow. The appropriate SSM Parameter Store applies because Parameter Store manages configuration and SecureString parameters; it is not a general audit-event service.

Policies ignore resource scope incorrectly treats actions as independent of which resources policy statements cover. That does not meet the requirement: Consider this AWS requirement: A team needs to stop actions explicitly denied by an applicable IAM policy even if another policy allows them.

Unauthenticated implicit allow permits unauthenticated access rather than checking identity and authorization. That does not meet the requirement: Consider this AWS requirement: A team needs to stop actions explicitly denied by an applicable IAM policy even if another policy allows them.

Allow overrides every deny: Misstates IAM policy evaluation: an applicable explicit deny overrides allows. That does not meet the requirement: Consider this AWS requirement: A team needs to stop actions explicitly denied by an applicable IAM policy even if another policy allows them.

Allow overrides every deny: Misstates IAM policy evaluation: an applicable explicit deny overrides allows. This does not address the need for A team needs to stop actions explicitly denied by an applicable IAM policy even if another policy allows them. The appropriate Explicit deny takes precedence applies because Under AWS authorization policy evaluation, an applicable explicit deny overrides allows.

Unauthenticated implicit allow permits unauthenticated access rather than checking identity and authorization. This does not address the need for A team needs to stop actions explicitly denied by an applicable IAM policy even if another policy allows them. The appropriate Explicit deny takes precedence applies because Under AWS authorization policy evaluation, an applicable explicit deny overrides allows.

Policies ignore resource scope incorrectly treats actions as independent of which resources policy statements cover. This does not address the need for A team needs to stop actions explicitly denied by an applicable IAM policy even if another policy allows them. The appropriate Explicit deny takes precedence applies because Under AWS authorization policy evaluation, an applicable explicit deny overrides allows.

Unauthenticated implicit allow permits unauthenticated access rather than checking identity and authorization. That does not meet the requirement: An administrator checks access results after adding an explicit deny statement to a principal's policy.

Policies ignore resource scope incorrectly treats actions as independent of which resources policy statements cover. That does not meet the requirement: An administrator checks access results after adding an explicit deny statement to a principal's policy.

Allow overrides every deny: Misstates IAM policy evaluation: an applicable explicit deny overrides allows. That does not meet the requirement: An administrator checks access results after adding an explicit deny statement to a principal's policy.

Policies ignore resource scope incorrectly treats actions as independent of which resources policy statements cover. This does not address the need for An administrator checks access results after adding an explicit deny statement to a principal's policy. The appropriate Explicit deny takes precedence applies because Under AWS authorization policy evaluation, an applicable explicit deny overrides allows.

Unauthenticated implicit allow permits unauthenticated access rather than checking identity and authorization. This does not address the need for An administrator checks access results after adding an explicit deny statement to a principal's policy. The appropriate Explicit deny takes precedence applies because Under AWS authorization policy evaluation, an applicable explicit deny overrides allows.

Allow overrides every deny: Misstates IAM policy evaluation: an applicable explicit deny overrides allows. This does not address the need for An administrator checks access results after adding an explicit deny statement to a principal's policy. The appropriate Explicit deny takes precedence applies because Under AWS authorization policy evaluation, an applicable explicit deny overrides allows.

Individual root accounts are privileged account owner identities, not a least-privilege mechanism for routine work. That does not meet the requirement: A technical reviewer evaluates this need: Employees already authenticate with a corporate identity provider and should not need separate IAM user passwords.

Local hard-coded passwords: Place secrets in an application or machine configuration rather than a managed secret store. That does not meet the requirement: A technical reviewer evaluates this need: Employees already authenticate with a corporate identity provider and should not need separate IAM user passwords.

Shared permanent access key: Allows multiple users or workloads to share long-lived credentials without clear attribution. That does not meet the requirement: A technical reviewer evaluates this need: Employees already authenticate with a corporate identity provider and should not need separate IAM user passwords.

Local hard-coded passwords: Place secrets in an application or machine configuration rather than a managed secret store. This does not address the need for Employees already authenticate with a corporate identity provider and should not need separate IAM user passwords. The appropriate Federated authentication applies because Federation lets AWS rely on a trusted external identity provider for authentication.

Individual root accounts are privileged account owner identities, not a least-privilege mechanism for routine work. This does not address the need for Employees already authenticate with a corporate identity provider and should not need separate IAM user passwords. The appropriate Federated authentication applies because Federation lets AWS rely on a trusted external identity provider for authentication.

Shared permanent access key: Allows multiple users or workloads to share long-lived credentials without clear attribution. This does not address the need for Employees already authenticate with a corporate identity provider and should not need separate IAM user passwords. The appropriate Federated authentication applies because Federation lets AWS rely on a trusted external identity provider for authentication.

Shared permanent access key: Allows multiple users or workloads to share long-lived credentials without clear attribution. That does not meet the requirement: A company wants enterprise SSO and federation for cloud access.

Individual root accounts are privileged account owner identities, not a least-privilege mechanism for routine work. That does not meet the requirement: A company wants enterprise SSO and federation for cloud access.

Local hard-coded passwords: Place secrets in an application or machine configuration rather than a managed secret store. That does not meet the requirement: A company wants enterprise SSO and federation for cloud access.

Local hard-coded passwords: Place secrets in an application or machine configuration rather than a managed secret store. This does not address the need for A company wants enterprise SSO and federation for cloud access. The appropriate Federated authentication applies because Federation lets AWS rely on a trusted external identity provider for authentication.

Individual root accounts are privileged account owner identities, not a least-privilege mechanism for routine work. This does not address the need for A company wants enterprise SSO and federation for cloud access. The appropriate Federated authentication applies because Federation lets AWS rely on a trusted external identity provider for authentication.

Shared permanent access key: Allows multiple users or workloads to share long-lived credentials without clear attribution. This does not address the need for A company wants enterprise SSO and federation for cloud access. The appropriate Federated authentication applies because Federation lets AWS rely on a trusted external identity provider for authentication.