Question 710
Which outcome most clearly shows that the chosen AWS capability meets the stated requirement? A company gives analysts full administrator access because it is unsure which AWS actions they actually need.
Explanation
Correct Answer
Analysts complete approved work while unrelated privileged actions are denied. This directly addresses the question rather than a different AWS use case. The principle of least privilege grants only permissions necessary for an authorized task. Recognize the requirement: Look for broad grants that exceed the analyst's required AWS operations. At a high level, define task-specific permissions and review them regularly as responsibilities change. The intended outcome is: Analysts complete approved work while unrelated privileged actions are denied. Keep in mind: Insufficient privileges can interrupt work, so review and test least-privilege policies.
Incorrect Answers
AWS IAM policies define allowed and denied actions on specified resources. That addresses a different mechanism; this question turns on Analysts complete approved work while unrelated privileged actions are.
AWS Secrets Manager stores and controls retrieval of secrets such as application credentials. In the present case the governing issue is Analysts complete approved work while unrelated privileged actions are, which this does not resolve.
Cross-account IAM roles support controlled access between trusted AWS accounts. That observation may hold without resolving the relevant issue: Analysts complete approved work while unrelated privileged actions are.