IAM Policy Evaluation Logic Quiz

5 questions Pass: 70% +25 pts (50 with Pro)

Quiz covering IAM Policies

What you'll be asked

  1. In AWS IAM, what is the default behavior if there is no explicit allow and no explicit deny for a request?
  2. If an IAM policy contains an explicit 'Allow' and a Service Control Policy (SCP) contains an explicit 'Deny' for the same action, what is the final result?
  3. When evaluating multiple policies attached to an IAM user, which of the following is true regarding the evaluation logic?
  4. An IAM user has an identity-based policy that allows 's3:ListBucket'. A resource-based policy on a specific S3 bucket denies 's3:ListBucket' to that user. What happens when the user tries to list that bucket?
  5. A developer is troubleshooting an access issue. The user has an identity-based policy with 'Allow' for 'ec2:DescribeInstances'. There is a Permission Boundary attached to the user that does not include 'ec2:DescribeInstances'. What is the result?

Answers and explanations come after you submit.