Practise vocabulary for IAM policies: Allow/Deny effects, RBAC vs ABAC, least privilege, and policy evaluation concepts.
0 / 15 completed
1 / 15
In AWS IAM policy evaluation, an ___ always overrides an Allow, regardless of other policies.
An Explicit Deny always wins in IAM policy evaluation. If any policy statement explicitly denies an action, that denial overrides all allow statements.
2 / 15
The principle of ___ means granting only the permissions necessary to perform a specific task, nothing more.
The principle of least privilege (PoLP) requires granting only the minimum permissions needed. This reduces the blast radius if credentials are compromised.
3 / 15
___ is an access control model where permissions are assigned to roles, and users are assigned to those roles — not granted permissions directly.
Role-Based Access Control (RBAC) assigns permissions to roles. Users inherit permissions through role membership, making permission management scalable.
4 / 15
In AWS IAM policy language, the ___ element specifies what API actions the policy applies to.
The Action element specifies which AWS API operations the policy statement affects (e.g., 's3:GetObject', 'ec2:DescribeInstances').
5 / 15
A ___ in AWS IAM sets the maximum permissions that an IAM entity can have, even if its identity-based policies grant more.
A Permission Boundary is an IAM feature that sets the maximum permissions an IAM entity can have. Even if a user's identity policy grants s3:*, a permission boundary can restrict it to s3:GetObject only.
6 / 15
During a code review of a Lambda function deployment to S3, Sarah notices the following policy attached to the role: `{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:*",
"Resource": "*"
}
]
}.
David, the senior developer, comments: 'This policy is overly permissive. We should restrict access to only the specific S3 buckets this Lambda uses.' What's the primary concern David raises regarding this IAM policy?
David's concern is about the `Action: "s3:*"` and `Resource: "*"` parts of the policy. This allows the Lambda function to perform *any* action on *any* S3 resource, which exposes it to potential security vulnerabilities. The correct response highlights this overly broad permission set, emphasizing that limiting actions and resources is crucial for IAM best practices.
7 / 15
Mark is explaining the principle of least privilege to a new developer. He says: 'We should give users all the permissions they *might* need, just in case.' What's the most accurate critique of Mark's statement regarding IAM access policies?
Mark's statement directly opposes the principle of least privilege. This principle states that users and services should only have the minimum set of permissions required to perform their tasks. Granting excessive permissions increases the risk of unauthorized access or accidental data breaches – it's a fundamental security concept.
8 / 15
During a Slack conversation about managing access to an AWS environment, Alex mentions: 'We should use IAM roles for all our applications and services.' What does Alex primarily refer to when discussing 'IAM roles'?
IAM roles are crucial for managing access in AWS. They act as temporary credentials that applications and services can assume to perform actions on AWS resources—avoiding the need to embed user credentials directly into code or configurations. This significantly improves security and simplifies management.
9 / 15
In a PR description for an update to a serverless application's IAM policy, you need to clearly define the scope of changes. Which section is MOST important to include regarding API access?
The `Effect`, `Action`, and `Resource` elements within an IAM policy statement are *essential* for defining API access. The `Action` specifies which AWS API operations (e.g., `s3:GetObject`) the entity is permitted to perform, while the `Resource` designates the specific AWS resources it can access. This detailed specification is key to controlling and auditing API usage.
10 / 15
You're reviewing a Lambda function's IAM policy that grants it `sts:AssumeRole` permission. What does this capability primarily enable the Lambda function to do?
`sts:AssumeRole` allows the Lambda function to temporarily assume the identity and permissions of another IAM role. This is a core mechanism for enabling cross-service access and delegation within an AWS environment – it's how resources can securely interact with each other.
11 / 15
During a code review of a Lambda function deployment to S3, Sarah notices the following policy attached to the role: `{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:*",
"Resource": "*"
}
]
}.
David, the senior developer, comments: 'This policy is overly permissive. We should restrict access to only the specific S3 buckets this Lambda uses.' What's the primary concern David raises regarding this IAM policy?
David's concern is about the `Action: "s3:*"` and `Resource: "*"` parts of the policy. This allows the Lambda function to perform *any* action on *any* S3 resource, which exposes it to potential security vulnerabilities. The correct response highlights this overly broad permission set, emphasizing that limiting actions and resources is crucial for IAM best practices.
12 / 15
Mark is explaining the principle of least privilege to a new developer. He says: 'We should give users all the permissions they *might* need, just in case.' What's the most accurate critique of Mark's statement regarding IAM access policies?
Mark's statement directly opposes the principle of least privilege. This principle states that users and services should only have the minimum set of permissions required to perform their tasks. Granting excessive permissions increases the risk of unauthorized access or accidental data breaches – it's a fundamental security concept.
13 / 15
During a Slack conversation about managing access to an AWS environment, Alex mentions: 'We should use IAM roles for all our applications and services.' What does Alex primarily refer to when discussing 'IAM roles'?
IAM roles are crucial for managing access in AWS. They act as temporary credentials that applications and services can assume to perform actions on AWS resources—avoiding the need to embed user credentials directly into code or configurations. This significantly improves security and simplifies management.
14 / 15
In a PR description for an update to a serverless application's IAM policy, you need to clearly define the scope of changes. Which section is MOST important to include regarding API access?
The `Effect`, `Action`, and `Resource` elements within an IAM policy statement are *essential* for defining API access. The `Action` specifies which AWS API operations (e.g., `s3:GetObject`) the entity is permitted to perform, while the `Resource` designates the specific AWS resources it can access. This detailed specification is key to controlling and auditing API usage.
15 / 15
You're reviewing a Lambda function's IAM policy that grants it `sts:AssumeRole` permission. What does this capability primarily enable the Lambda function to do?
`sts:AssumeRole` allows the Lambda function to temporarily assume the identity and permissions of another IAM role. This is a core mechanism for enabling cross-service access and delegation within an AWS environment – it's how resources can securely interact with each other.
What will I practise in "IAM Access Policy Language"?
Practise vocabulary for IAM policies: Allow/Deny effects, RBAC vs ABAC, least privilege, and policy evaluation concepts.
How many exercises are in this module?
This module has 15 multiple-choice exercises, each with instant feedback and a full explanation of the correct answer.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall.
Do I need to create an account to do these exercises?
No account is required. Just click an option to answer — your score for this session is tracked automatically in the progress bar above.
What happens if I choose the wrong answer?
You'll immediately see which answer was correct, plus a full explanation covering the vocabulary and reasoning behind it — mistakes are where most of the learning happens.
Can I retry the exercises if I want a higher score?
Yes — use the "Try again" button on the results screen to reset and go through all the questions again.
Is my progress saved if I close the page?
No. Progress is tracked only for your current visit; reloading or leaving the page resets the counter. This keeps the exercise simple and account-free.
Where can I find more Identity & Access Management exercises?
Browse the full Identity & Access Management hub for related drills, or check the "Next up" link below to continue with a connected topic.
How is this different from reading an article on the same topic?
Articles explain vocabulary and concepts in prose; this exercise tests and reinforces that vocabulary through active recall with immediate feedback — the two work best together.
Who writes these exercises?
Every exercise is written by the CoderSlingo team, drawing on real workplace English used in IT roles, then reviewed for accuracy and clarity.