___________________________________________________________________
AWS Cloud Practitioner IAM Users,
Groups, Roles & Policies Practice Test
2026–2027 | AWS Identity Questions,
Answers & Detailed Rationales
1. What is the primary purpose of AWS Identity and Access Management
(IAM)?
A. To monitor application performance
B. To control access to AWS resources
C. To encrypt data stored in Amazon S3
D. To provide DNS resolution
Answer: B. To control access to AWS resources
Rationale: IAM enables you to securely control authentication and authorization
for AWS resources by defining who can access what and under which conditions.
2. Which IAM identity is intended to represent a person or application that
needs long-term AWS credentials?
A. IAM role
B. IAM policy
C. IAM user
D. IAM group
,Answer: C. IAM user
Rationale: An IAM user represents an individual person or workload requiring
persistent credentials. Roles are generally preferred for temporary access.
3. What is an IAM group primarily used for?
A. Storing AWS access keys
B. Assigning permissions to multiple IAM users
C. Creating temporary credentials
D. Encrypting IAM policies
Answer: B. Assigning permissions to multiple IAM users
Rationale: IAM groups allow administrators to attach permissions policies to a
collection of users, simplifying permission management.
4. Which IAM identity is designed to provide temporary permissions that can
be assumed by trusted entities?
A. IAM user
B. IAM group
C. IAM role
D. IAM root account
Answer: C. IAM role
Rationale: IAM roles provide temporary security credentials and can be assumed
by users, applications, AWS services, or federated identities.
5. Which statement about IAM roles is correct?
A. Roles always require permanent access keys
B. Roles are only available to the root user
C. Roles provide temporary security credentials when assumed
D. Roles can contain other IAM roles
Answer: C. Roles provide temporary security credentials when assumed
,Rationale: AWS Security Token Service (STS) issues temporary credentials when
an IAM role is assumed.
6. What does an IAM policy primarily define?
A. Network routes
B. Resource pricing
C. Permissions and access conditions
D. Encryption algorithms only
Answer: C. Permissions and access conditions
Rationale: IAM policies define allowed or denied actions on resources and can
include conditions controlling when access is permitted.
7. Which format are identity-based IAM policies commonly written in?
A. YAML only
B. XML only
C. JSON
D. CSV
Answer: C. JSON
Rationale: IAM policies use JSON syntax to specify elements such as Effect,
Action, Resource, and Condition.
8. Which IAM policy element specifies whether a statement allows or denies
access?
A. Action
B. Effect
C. Principal
D. Resource
Answer: B. Effect
, Rationale: The Effect element specifies either Allow or Deny for the permissions
described by the statement.
9. Which IAM policy element specifies the AWS API operations affected by the
policy?
A. Action
B. Resource
C. Principal
D. Version
Answer: A. Action
Rationale: The Action element identifies the API operations, such as
s3:GetObject or ec2:StartInstances, to which the statement applies.
10.Which IAM policy element identifies the AWS resource to which a
permission applies?
A. Principal
B. Resource
C. Effect
D. Condition
Answer: B. Resource
Rationale: Resource specifies the ARN or resource scope affected by the policy
statement.
11.Which IAM policy element can restrict access based on attributes such as
source IP address or MFA status?
A. Condition
B. Version
C. Sid
D. Principal
Answer: A. Condition
AWS Cloud Practitioner IAM Users,
Groups, Roles & Policies Practice Test
2026–2027 | AWS Identity Questions,
Answers & Detailed Rationales
1. What is the primary purpose of AWS Identity and Access Management
(IAM)?
A. To monitor application performance
B. To control access to AWS resources
C. To encrypt data stored in Amazon S3
D. To provide DNS resolution
Answer: B. To control access to AWS resources
Rationale: IAM enables you to securely control authentication and authorization
for AWS resources by defining who can access what and under which conditions.
2. Which IAM identity is intended to represent a person or application that
needs long-term AWS credentials?
A. IAM role
B. IAM policy
C. IAM user
D. IAM group
,Answer: C. IAM user
Rationale: An IAM user represents an individual person or workload requiring
persistent credentials. Roles are generally preferred for temporary access.
3. What is an IAM group primarily used for?
A. Storing AWS access keys
B. Assigning permissions to multiple IAM users
C. Creating temporary credentials
D. Encrypting IAM policies
Answer: B. Assigning permissions to multiple IAM users
Rationale: IAM groups allow administrators to attach permissions policies to a
collection of users, simplifying permission management.
4. Which IAM identity is designed to provide temporary permissions that can
be assumed by trusted entities?
A. IAM user
B. IAM group
C. IAM role
D. IAM root account
Answer: C. IAM role
Rationale: IAM roles provide temporary security credentials and can be assumed
by users, applications, AWS services, or federated identities.
5. Which statement about IAM roles is correct?
A. Roles always require permanent access keys
B. Roles are only available to the root user
C. Roles provide temporary security credentials when assumed
D. Roles can contain other IAM roles
Answer: C. Roles provide temporary security credentials when assumed
,Rationale: AWS Security Token Service (STS) issues temporary credentials when
an IAM role is assumed.
6. What does an IAM policy primarily define?
A. Network routes
B. Resource pricing
C. Permissions and access conditions
D. Encryption algorithms only
Answer: C. Permissions and access conditions
Rationale: IAM policies define allowed or denied actions on resources and can
include conditions controlling when access is permitted.
7. Which format are identity-based IAM policies commonly written in?
A. YAML only
B. XML only
C. JSON
D. CSV
Answer: C. JSON
Rationale: IAM policies use JSON syntax to specify elements such as Effect,
Action, Resource, and Condition.
8. Which IAM policy element specifies whether a statement allows or denies
access?
A. Action
B. Effect
C. Principal
D. Resource
Answer: B. Effect
, Rationale: The Effect element specifies either Allow or Deny for the permissions
described by the statement.
9. Which IAM policy element specifies the AWS API operations affected by the
policy?
A. Action
B. Resource
C. Principal
D. Version
Answer: A. Action
Rationale: The Action element identifies the API operations, such as
s3:GetObject or ec2:StartInstances, to which the statement applies.
10.Which IAM policy element identifies the AWS resource to which a
permission applies?
A. Principal
B. Resource
C. Effect
D. Condition
Answer: B. Resource
Rationale: Resource specifies the ARN or resource scope affected by the policy
statement.
11.Which IAM policy element can restrict access based on attributes such as
source IP address or MFA status?
A. Condition
B. Version
C. Sid
D. Principal
Answer: A. Condition
