Correct Answer: Only if ALL policies allow the action and NO policy explicitly denies it
An explicit Deny always wins. For an Allow, the request must be within the intersection of all applicable boundaries and policies....
Correct Answer
Only if ALL policies allow the action and NO policy explicitly denies it
Why This Answer Is Correct
An explicit Deny always wins. For an Allow, the request must be within the intersection of all applicable boundaries and policies.
This question evaluates your knowledge of AWS IAM — a core concept tested in AWS Certified Solutions Architect – Associate (SAA-C03). Understanding AWS IAM is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.
Which IAM policy type is used to set the maximum permissions that an identity-based policy can grant to an IAM user or role?
Your organization has multiple cloud accounts. Users in Account A need temporary access to resources in Account B. What AWS IAM feature should you use?
A company uses AWS Organizations and wants to ensure that NO user in any account can delete S3 buckets, regardless of their individual IAM permissions. What should be used?
What is the recommended way to grant an EC2 instance permission to call other AWS services (like S3 or DynamoDB)?
Which IAM feature allows an architect to verify which permissions in a policy are actually being used by an entity, helping to implement the 'principle of least privilege'?