IAM Policy Evaluation Logic Quiz

5 questions Pass: 70% +25 pts (50 with Pro)

Quiz covering IAM Policies and Permissions

What you'll be asked

  1. In AWS IAM policy evaluation, what is the default behavior if there is no explicit allow or explicit deny for a requested action?
  2. If an IAM user has an identity-based policy that allows 's3:ListBucket' and a Service Control Policy (SCP) that denies 's3:*', what is the final result?
  3. Which of the following components is NOT part of the IAM policy evaluation context?
  4. An IAM policy contains a condition block with 'StringEquals' for 'aws:SourceIp'. If the request is made from an IP address not listed in the condition, what happens?
  5. Consider a user with two inline policies attached. Policy A allows 'ec2:StartInstances' on all resources. Policy B denies 'ec2:StartInstances' on 'instance-id: i-12345'. What is the result when the user attempts to start instance 'i-12345'?

Answers and explanations come after you submit.