Examius

🇮🇳 AWS Certified Solutions Architect – Associate · subject

AWS Certified Solutions Architect – Associate Identity, Access Management & Security Syllabus

The Identity, Access Management & Security syllabus for AWS Certified Solutions Architect – Associate in full: 4 chapters, 15 topics and 17 sub-topics, every one listed below, plus 51 Identity, Access Management & Security flashcards with answers.

4Chapters
15Topics
17Sub-topics
51Flashcards

Identity, Access Management & Security syllabus: all 4 chapters

Expand any chapter to see its topics and sub-topics.

  1. AWS Identity and Access Management (IAM)

     4 topics
    • Users, groups and roles
      • IAM roles for cross-account and service access
      • Instance profiles for EC2
    • IAM policies
      • Identity-based vs resource-based policies
      • Policy evaluation logic (explicit deny, allow, implicit deny)
      • Permission boundaries and SCPs
    • Multi-Factor Authentication and credential rotation
    • IAM Access Analyzer and least-privilege design

  2. Federation & Directory Services

     3 topics
    • Identity federation patterns
      • SAML 2.0 and web identity federation
      • IAM Identity Center (AWS SSO)
    • AWS Directory Service
      • Managed Microsoft AD, AD Connector and Simple AD
    • Amazon Cognito user pools and identity pools

  3. Data Protection & Encryption

     4 topics
    • AWS Key Management Service (KMS)
      • Customer managed vs AWS managed keys
      • Envelope encryption and key policies
    • Encryption in transit and at rest
      • TLS/SSL and ACM certificates
      • SSE-S3, SSE-KMS, SSE-C and client-side encryption
    • AWS Secrets Manager vs Systems Manager Parameter Store
    • CloudHSM for dedicated hardware key storage

  4. Threat Detection & Compliance

     4 topics
    • Detective and monitoring services
      • Amazon GuardDuty
      • Amazon Inspector and Amazon Macie
    • AWS WAF, AWS Shield and Shield Advanced
    • Auditing and governance
      • AWS Config rules and conformance packs
      • AWS CloudTrail event history and trails
      • AWS Artifact for compliance reports
    • AWS Security Hub centralized findings

AWS Certified Solutions Architect – Associate Identity, Access Management & Security flashcards — 51 questions with answers

  1. What is the difference between an IAM user, an IAM group, and an IAM role?

    An IAM user is a permanent identity with long-term credentials for a person or application. An IAM group is a collection of users used to assign permissions in bulk (it cannot be a principal and has no credentials). An IAM role is an identity with temporary credentials that can be assumed by users, services, or external identities and has no long-term credentials of its own.

  2. Why are IAM roles preferred over IAM users for granting AWS access to EC2 instances and applications?

    Roles provide temporary, automatically rotated credentials via the instance metadata service (STS), so there are no long-term access keys to store, leak, or manually rotate.

  3. What are the two policy documents that define an IAM role, and what does each do?

    The trust policy (assume-role policy) defines WHO is allowed to assume the role (the principal). The permissions policy defines WHAT actions and resources the role can access once assumed.

  4. What are the main types of IAM policies in AWS?

    Identity-based policies (attached to users, groups, roles), resource-based policies (attached to resources like S3 buckets and specifying a principal), permissions boundaries, Service Control Policies (SCPs in AWS Organizations), session policies, and ACLs.

  5. What are the required and key elements of an IAM policy statement?

    Effect (Allow/Deny, required), Action (required), and Resource (required for identity-based policies). Optional elements include Principal, Condition, and Sid.

  6. In IAM policy evaluation logic, how are Allow and Deny resolved?

    By default everything is implicitly denied. An explicit Allow grants access, but an explicit Deny always overrides any Allow. So the order is: explicit Deny > explicit Allow > implicit Deny.

  7. What is the difference between an AWS managed policy, a customer managed policy, and an inline policy?

    AWS managed policies are created and maintained by AWS for common use cases. Customer managed policies are created and maintained by you and are reusable across identities. Inline policies are embedded directly into a single user, group, or role with a strict one-to-one relationship.

  8. What is an IAM permissions boundary?

    A permissions boundary is an advanced feature that uses a managed policy to set the MAXIMUM permissions an identity-based policy can grant to a user or role. Effective permissions are the intersection of the permissions boundary and the identity policy.

  9. What is a Service Control Policy (SCP) in AWS Organizations?

    An SCP is a guardrail applied to AWS accounts/OUs in an Organization that sets the maximum available permissions for all principals in those accounts. SCPs do not grant permissions; they only set the boundary, and they do not affect the management account.

  10. What is Multi-Factor Authentication (MFA) in AWS and why is it used?

    MFA requires a second authentication factor (a code from a virtual/hardware device, FIDO security key, or SMS) in addition to a password. It adds a layer of protection so that a compromised password alone cannot grant access.

  11. What MFA device types does AWS support?

    Virtual MFA apps (e.g., Google Authenticator, Authy), FIDO security keys (e.g., YubiKey), and hardware TOTP tokens. (SMS text-message MFA is being deprecated.)

  12. What is a best practice for the AWS account root user regarding MFA and daily use?

    Enable MFA on the root user, lock away its credentials, and do not use it for everyday tasks. Use IAM users/roles with least privilege for daily operations instead.

  13. What is credential rotation and which IAM credentials should be rotated?

    Credential rotation is regularly changing long-term credentials to limit exposure. Access keys and passwords should be rotated periodically; roles with temporary STS credentials rotate automatically.

  14. How can you require IAM users to rotate their passwords?

    By configuring an account password policy that sets a maximum password age (expiration), minimum length, complexity requirements, and prevents password reuse.

  15. What is AWS IAM Access Analyzer and what does it detect?

    IAM Access Analyzer uses automated reasoning to identify resources (S3 buckets, IAM roles, KMS keys, etc.) shared with external entities, helping you find unintended public or cross-account access. It can also generate least-privilege policies based on CloudTrail activity and validate policies.

  16. What is the principle of least privilege?

    Granting an identity only the minimum permissions required to perform its tasks, and nothing more, to reduce the attack surface and blast radius of compromised credentials.

  17. How does IAM Access Analyzer help achieve least-privilege design?

    It can generate fine-grained IAM policies based on the actual access activity recorded in CloudTrail, validate policies against best practices and grammar, and identify unused access, so you can right-size permissions.

  18. What is identity federation in AWS?

    Identity federation lets users authenticate with an external identity provider (corporate directory, social login, or another IdP) and then assume an IAM role to access AWS without creating IAM users for each person.

  19. What are the two main standards/types of identity federation supported by AWS IAM?

    SAML 2.0 federation (for enterprise IdPs like Active Directory Federation Services) and OpenID Connect (OIDC) / web identity federation (for OAuth/OIDC providers and social logins, often via Cognito).

  20. What AWS service provides single sign-on across multiple AWS accounts and business applications?

    AWS IAM Identity Center (formerly AWS SSO), which centralizes access management and SSO across an AWS Organization and connects to external identity providers.

Show the other 31 Identity, Access Management & Security flashcards

  1. What is AWS Directory Service and what is the fully managed Microsoft AD option?

    AWS Directory Service provides managed directories for AWS. AWS Managed Microsoft AD is a fully managed actual Microsoft Active Directory in the cloud, supporting trust relationships with on-premises AD and AD-aware workloads.

  2. What are the three main flavors of AWS Directory Service?

    AWS Managed Microsoft AD (full Microsoft AD), AD Connector (a proxy that redirects requests to your existing on-premises AD without storing data), and Simple AD (a small, low-cost Samba-based directory for basic needs).

  3. What is Amazon Cognito used for?

    Amazon Cognito provides authentication, authorization, and user management for web and mobile apps. It handles user sign-up/sign-in and access to AWS resources for application users.

  4. What is the difference between a Cognito user pool and a Cognito identity pool?

    A user pool is a user directory that handles authentication (sign-up, sign-in) and returns JWT tokens. An identity pool (federated identities) provides authorization by exchanging tokens for temporary AWS credentials (via STS) to access AWS services.

  5. In Cognito, what does a user pool return after a successful sign-in?

    JSON Web Tokens (JWTs): an ID token, an access token, and a refresh token.

  6. How would you let mobile app users access an S3 bucket using their Google login with Cognito?

    Authenticate the user through a Cognito user pool (or directly with the social IdP), then use a Cognito identity pool to exchange the identity token for temporary AWS credentials via STS that grant scoped access to the S3 bucket.

  7. What is AWS Key Management Service (KMS)?

    KMS is a managed service for creating and controlling cryptographic keys (KMS keys / CMKs) used to encrypt data. It integrates with most AWS services and uses FIPS 140-2 validated hardware security modules.

  8. What are the types of KMS keys based on who manages them?

    AWS managed keys (created and managed by AWS for a service, e.g., aws/s3), customer managed keys (created and fully controlled by you, supporting rotation and key policies), and AWS owned keys (owned/used by AWS across accounts, not visible to you).

  9. What is the difference between symmetric and asymmetric KMS keys?

    Symmetric KMS keys use a single 256-bit key for both encryption and decryption and never leave KMS unencrypted. Asymmetric KMS keys use a public/private key pair for encrypt/decrypt or sign/verify, where the public key can be downloaded and used outside AWS.

  10. What is envelope encryption in KMS?

    Envelope encryption is encrypting data with a data key (data encryption key), then encrypting that data key with a KMS key. The encrypted data key is stored alongside the data; KMS is only called to decrypt the data key, which is efficient for large data.

  11. What is automatic key rotation in KMS and how often does it occur?

    For customer managed symmetric keys, KMS can automatically rotate the cryptographic backing material once a year (rotation period is configurable). The key ID stays the same and old material is retained so previously encrypted data can still be decrypted.

  12. What controls access to a KMS key?

    A key policy (the primary, mandatory resource-based access control on the key), optionally combined with IAM policies and grants. Without a key policy granting access, even account admins cannot use the key.

  13. What is encryption in transit and how is it typically implemented in AWS?

    Encryption in transit protects data moving over networks, typically using TLS/SSL (HTTPS). AWS provides it via ACM certificates on load balancers/CloudFront, TLS endpoints on services, and VPN/Direct Connect with encryption.

  14. What is encryption at rest and give examples of AWS at-rest encryption options?

    Encryption at rest protects stored data. Examples: S3 server-side encryption (SSE-S3, SSE-KMS, SSE-C), EBS volume encryption, RDS encryption, and DynamoDB encryption, most integrating with KMS.

  15. What are the server-side encryption options for Amazon S3?

    SSE-S3 (Amazon S3-managed keys, AES-256, now the default), SSE-KMS (AWS KMS keys, adds auditing and key control), DSSE-KMS (dual-layer KMS encryption), and SSE-C (customer-provided keys where AWS does encryption but does not store the key).

  16. What is AWS Certificate Manager (ACM) used for in the context of encryption in transit?

    ACM provisions, manages, and renews SSL/TLS certificates used to enable HTTPS on integrated services like Elastic Load Balancing, CloudFront, and API Gateway. Public ACM certificates are free and auto-renew.

  17. What is AWS Secrets Manager?

    Secrets Manager securely stores, retrieves, and manages secrets (database credentials, API keys, tokens). Its key differentiator is built-in automatic rotation of secrets using Lambda functions, with native rotation support for several AWS database services.

  18. What is AWS Systems Manager Parameter Store?

    Parameter Store provides hierarchical, secure storage for configuration data and secrets as parameters. Standard parameters are free; SecureString parameters can be encrypted with KMS. It does not have native automatic secret rotation.

  19. When should you choose Secrets Manager over Parameter Store?

    Choose Secrets Manager when you need automatic secret rotation, cross-account secret access, or generated credentials for databases. Choose Parameter Store for general configuration values and simpler/cheaper secret storage without built-in rotation.

  20. What is the cost difference between Secrets Manager and Parameter Store?

    Secrets Manager charges per secret per month plus per API call (no free tier). Parameter Store standard parameters are free; advanced parameters and higher-throughput API usage incur charges.

  21. What is AWS CloudHSM?

    CloudHSM provides dedicated, single-tenant hardware security modules (FIPS 140-2 Level 3) in your VPC where you have full, exclusive control of the keys. AWS cannot access your keys, making it suitable for strict compliance requirements.

  22. What is the key difference between AWS KMS and AWS CloudHSM regarding tenancy and control?

    KMS is a multi-tenant, AWS-managed service where AWS manages the HSM infrastructure (FIPS 140-2 Level 2/3 for some operations). CloudHSM is single-tenant dedicated hardware you fully control, where AWS has no access to your keys.

  23. Which AWS service provides intelligent threat detection by analyzing logs like VPC Flow Logs, DNS logs, and CloudTrail?

    Amazon GuardDuty, a managed threat detection service that uses machine learning and threat intelligence to detect malicious or unauthorized behavior.

  24. What is Amazon Inspector used for?

    Amazon Inspector is an automated vulnerability management service that continually scans EC2 instances, container images in ECR, and Lambda functions for software vulnerabilities (CVEs) and unintended network exposure.

  25. What is Amazon Macie?

    Amazon Macie is a data security service that uses machine learning and pattern matching to discover, classify, and protect sensitive data (such as PII) stored in Amazon S3.

  26. What is AWS WAF and at what layer does it operate?

    AWS WAF (Web Application Firewall) protects web applications at Layer 7 (application layer) by filtering HTTP/HTTPS requests using rules for SQL injection, cross-site scripting, rate limiting, geo-blocking, and more. It attaches to CloudFront, ALB, API Gateway, and AppSync.

  27. What is AWS Shield Standard versus AWS Shield Advanced?

    Shield Standard is free, automatically protecting all AWS customers against common Layer 3/4 DDoS attacks. Shield Advanced is a paid service adding enhanced DDoS protection, 24/7 DDoS Response Team (DRT) access, real-time visibility, and DDoS cost protection (bill credits).

  28. Which combination of services would you use to protect a web application from both DDoS and application-layer attacks?

    Use AWS Shield (Standard or Advanced) for DDoS protection at Layers 3/4 and AWS WAF for application-layer (Layer 7) filtering, typically fronted by CloudFront.

  29. What is AWS CloudTrail and what is its role in auditing and governance?

    CloudTrail records API calls and account activity across AWS as event logs, providing an audit trail of who did what, when, and from where. It is essential for security analysis, compliance, and operational troubleshooting.

  30. What is AWS Config used for in governance?

    AWS Config continuously records and evaluates the configuration of AWS resources, tracks changes over time, and uses Config Rules to assess compliance against desired configurations, supporting auditing and governance.

  31. What is AWS Security Hub?

    AWS Security Hub is a centralized cloud security posture management service that aggregates, normalizes, and prioritizes security findings from services like GuardDuty, Inspector, Macie, IAM Access Analyzer, and partner tools, and runs automated compliance checks against standards (e.g., CIS, PCI DSS, AWS Foundational Security Best Practices).

AWS Certified Solutions Architect – Associate Identity, Access Management & Security FAQ

What is in the AWS Certified Solutions Architect – Associate Identity, Access Management & Security syllabus?

AWS Certified Solutions Architect – Associate Identity, Access Management & Security is split into 4 chapters: AWS Identity and Access Management (IAM), Federation & Directory Services, Data Protection & Encryption and Threat Detection & Compliance. Together they contain 15 topics and 17 sub-topics.

How many chapters are in AWS Certified Solutions Architect – Associate Identity, Access Management & Security?

4 chapters, containing 15 topics and 17 sub-topics. The largest chapter is AWS Identity and Access Management (IAM), with 4 topics.

Are there flashcards for AWS Certified Solutions Architect – Associate Identity, Access Management & Security?

Yes — a 51-card Identity, Access Management & Security deck, printed in full in the flashcards section of this page and available in the Examius app with spaced repetition. The free plan covers one exam of your choice, including its flashcards; Examius Pro, a one-time purchase, unlocks every other exam and deck.