IAM Roles and Permissions for Compute u0026 Cloud Services Quiz Quiz

Assess your understanding of managing permissions and roles for cloud-based compute resources like virtual machines and serverless functions. Explore key concepts related to identity access management in connection with automated services and ensure secure, effective access control in diverse architectures.

1. EC2 Role Basics

   When launching a virtual machine, what is the primary purpose of assigning an identity and access role to the instance?

   1. To automatically install software updates on the instance
   2. To assign a static IP address to the instance
   3. To allow the instance to access other cloud resources securely
   4. To increase the network bandwidth of the instance

   Explanation: Assigning an identity and access role enables the instance to securely communicate with other resources without embedding sensitive keys. Increasing bandwidth or assigning a static IP is handled elsewhere, not through roles. Automatic software updates are managed by configuration or agents, not directly by roles.

2. Lambda Execution Permissions

   A developer wants a serverless function to write logs to a monitoring service. Which method should be used to grant this permission?

   1. Attach an execution role to the function
   2. Use a security group to allow access
   3. Include credentials in environment variables
   4. Manually configure firewall rules

   Explanation: Attaching an execution role allows the function to securely interact with other services. Firewall rules only control network traffic, not permissions. Storing credentials in environment variables is insecure. Security groups are unrelated to service privileges.

3. Understanding Resource Policies

   Which statement correctly describes a resource policy in the context of cloud storage?

   1. It allocates more disk space to storage buckets
   2. It assigns encryption keys to storage buckets
   3. It monitors bucket usage metrics
   4. It specifies who can access and manage a specific storage bucket

   Explanation: A resource policy defines which identities can use a resource and with what actions. Allocating disk space or assigning encryption keys involves different configurations. Monitoring is handled by logging features, not policies themselves.

4. Instance Profile Purpose

   What is the function of an instance profile when configuring a virtual machine for role-based permissions?

   1. It serves as a container for the assigned role and allows the instance to assume it
   2. It manages the virtual network connections
   3. It increases the CPU resources available
   4. It determines the operating system installed on the instance

   Explanation: An instance profile links an identity role to a running instance for secure access to resources. The operating system, CPU, and network settings are chosen elsewhere and not handled by instance profiles.

5. Service Role Concepts

   Why might a compute service need a dedicated service role with specific permissions?

   1. To execute tasks on behalf of users without storing long-term credentials
   2. To increase memory allocation for processes
   3. To encrypt data at rest automatically
   4. To reduce the cost of cloud billing

   Explanation: Service roles enable systems to perform actions securely without embedded credentials. Encryption is managed through separate features. Adjusting memory or affecting billing does not rely on roles.

6. Least Privilege Principle

   If you want to grant a function access only to read data from storage, what should you do?

   1. Grant full admin privileges to the execution role
   2. Add write and delete access just in case
   3. Attach a policy granting only read permissions to the function's execution role
   4. Remove all policies from the function

   Explanation: Granting only the necessary permissions follows the ‘least privilege’ principle and improves security. Full admin access or extra permissions increase risk, and removing all policies prevents the function from accessing anything.

7. Short-Lived Credentials

   Why do virtual machines using identity roles receive temporary credentials instead of static access keys?

   1. Static keys enable automatic region selection
   2. Static access keys allow faster startup times
   3. Temporary credentials reduce security risks in case of exposure
   4. Temporary credentials cost more to issue

   Explanation: Temporary credentials limit the window for misuse if they’re leaked. Startup times and costs are unrelated to credential length. Static keys don’t provide any region selection capabilities.

8. Cross-Service Access Scenarios

   A virtual machine needs to retrieve items from a database service. Which step enables this communication securely?

   1. Restarting the instance each time access is needed
   2. Assigning the public IP address of the instance to the database
   3. Setting the database to public access
   4. Ensuring the instance's role has permissions for the database service

   Explanation: Granting suitable permissions via the role enables secure access to the database. IP assignments and restarts are unrelated to permissions, and making the database public exposes sensitive data.

9. Lambda Triggers and IAM

   When connecting a serverless function to respond to storage bucket events, what must be in place for secure operation?

   1. A security group allowing outbound HTTP traffic
   2. A permission policy attached to the function enabling access to the bucket
   3. Manual invocation of the function for each event
   4. A local configuration file with credentials

   Explanation: A permission policy allows the function to read or process bucket events securely. Local credential files and outbound traffic controls don’t handle access, and requiring manual invocation defeats automation.

10. Revoking Unnecessary Access

    What should you do after identifying that an identity role attached to an instance has unused write permissions to storage?

    1. Update the role to remove unnecessary write permissions
    2. Create a duplicate role with the same permissions
    3. Reboot the instance for changes to take effect
    4. Ignore, since unused permissions do not matter

    Explanation: Removing extra permissions reduces risk by adhering to security best practices. Duplicating roles doesn’t address the issue, and ignoring the problem accepts unnecessary risk. Operating system reboots are unrelated to role configuration changes.