Permission Boundaries u0026 IAM Policies Fundamentals Quiz Quiz

Assess your understanding of permission boundaries and identity and access management (IAM) policies with these foundational questions. This quiz covers the concepts, purposes, and interactions of policies and boundaries in access control settings.

1. Purpose of Permission Boundaries

   What is the main purpose of setting a permission boundary for an identity in an access management system?

   1. To increase the available storage space for the identity
   2. To provide a backup for the identity’s credentials
   3. To reduce network latency when the identity accesses resources
   4. To restrict the maximum allowable permissions for the identity

   Explanation: Setting a permission boundary limits the maximum permissions an identity can have, acting as a guardrail. Storage space, credential backups, and network latency are unrelated to permission boundaries. Only the first option describes the correct function.

2. Policy vs. Boundary

   If a user has an IAM policy allowing full access to a resource, but their permission boundary only allows read access, what level of effective access do they receive?

   1. Full access as defined in the policy
   2. Write access but not read access
   3. Read access only
   4. No access at all

   Explanation: Effective permissions are determined by the intersection of the allowed policy and the permission boundary; the most restrictive applies. Full access isn’t possible if the boundary limits it to read. No access is incorrect unless both deny access, and write without read is not logically possible.

3. Default Behavior of Boundaries

   What happens if an identity has no permission boundary set in an access management environment?

   1. The identity can only perform read operations
   2. The identity gets temporary permissions for 24 hours
   3. The identity follows its assigned policies without boundary restrictions
   4. The identity is completely denied access to all resources

   Explanation: Without a boundary, only the assigned policies control permissions. The other options are incorrect; default behavior does not restrict to read-only, block all access, or set temporary durations.

4. Boundary and Policy Interaction

   Which statement best describes how a permission boundary and an IAM policy work together?

   1. Boundaries override policies regardless of content
   2. Policies can ignore boundaries if they are newly created
   3. Both must allow an action for it to be permitted
   4. The more permissive of the two always takes precedence

   Explanation: Both the policy and the boundary must allow an action; otherwise, access is denied. The most permissive option does not take precedence. Boundaries do not override everything but act as a ceiling based on the policy. New policies cannot ignore boundaries.

5. Types of IAM Policies

   Which of the following is considered a type of IAM policy commonly used in access management?

   1. Network-based policy
   2. Identity-based policy
   3. Timetable policy
   4. Capacity policy

   Explanation: Identity-based policies are widely used for granting permissions directly to users or groups. Network-based and timetable policies are not standard IAM concepts, and capacity policy refers to a different context.

6. Adjusting Permissions

   You want to prevent a user from deleting resources while allowing other actions. What should you add to their IAM policy?

   1. Remove all policies from the user
   2. Increase storage quota
   3. Add a boundary that grants delete access
   4. Explicitly deny Delete actions

   Explanation: To restrict delete access specifically, explicitly deny Delete actions in the policy. Adding a boundary granting more access would not solve the problem. Adjusting storage quotas does not control permissions, and removing all policies would remove all access, not just deletion rights.

7. Role of Wildcards in Policies

   What is the effect of using a wildcard symbol (*) in an action clause within an IAM policy?

   1. It denies all actions for the resource
   2. It sets the action to expire in one day
   3. It grants permission to all actions for the specified resource
   4. It only allows actions starting with 'A'

   Explanation: The wildcard symbol matches all possible actions, granting broad permission. It does not deny actions or restrict to those starting with a certain letter. Setting expiry is not the purpose of a wildcard in this context.

8. Who Can Set Permission Boundaries

   Who is typically allowed to attach a permission boundary to an identity in an access management setting?

   1. External vendors by default
   2. Only the identity itself
   3. Any user in the system
   4. An administrator with appropriate permissions

   Explanation: Only users with administrative privileges or explicit permission can attach permission boundaries. General users, the identities themselves, and external vendors do not have this ability by default, as it would compromise security.

9. Least Privilege Principle

   Applying both a restrictive policy and a stringent permission boundary helps organizations enforce which security principle?

   1. Unlimited access
   2. Open relay
   3. Least privilege
   4. Maximum exposure

   Explanation: Combining restrictive policies and boundaries limits permissions to only what is necessary—known as least privilege. The other choices suggest less secure or incorrect practices.

10. Effect of Removing a Boundary

    If an identity’s permission boundary is removed but its policies remain unchanged, how does the identity's effective permission change?

    1. A new boundary with no permissions is automatically set
    2. The identity can use all permissions granted by their policies
    3. The identity loses all access
    4. Permissions revert to anonymous user defaults

    Explanation: With no permission boundary, the user’s access is controlled solely by their assigned policies. Removing a boundary does not cause a loss of all access or force a default, and no new automatic boundary is created.