These questions are independently created for study purposes. They are not official AWS exam questions, actual exam questions, leaked questions, or exam dumps.
CLF-042
Which of the following is a JSON document that defines access permissions for AWS resources?
Choices
Explanation and answer
Read the explanation and correct answer (spoiler — try answering first)
Correct answer: A. IAM policy
Explanation
An IAM policy is a JSON document that defines which actions are allowed or denied on which AWS resources.
Per-choice explanations
A. IAM policy
Correct. IAM policies define access permissions.
B. Availability Zone
An Availability Zone is an independent group of data centers within a Region.
C. Reserved Instance
A Reserved Instance is a discounted purchasing option based on a long-term commitment.
D. Region
A Region is a geographical area where AWS provides services.
Practical Use
In AWS Identity and Access Management (IAM), a policy (an IAM policy) is a JSON document that defines who, on which resources, can perform which actions, and whether those actions are allowed or denied. A policy is composed of elements such as Version, Statement, Effect, Action, Resource, and Condition. Access permissions are expressed by combining Effect (Allow or Deny), Action (API action name), and Resource (target ARN). A policy takes effect only when it is attached to an IAM user, IAM group, or IAM role. On the exam, the IAM policy is the expected answer for the prompt asking which item defines access permissions for AWS resources in JSON form. Common distractors include Availability Zone (an independent group of data centers within a Region), Reserved Instance (a discounted purchasing option), and Region (a geographical area). These are resource concepts with roles different from access control. Once the keywords "JSON format" and "access permission definition" appear together, the other choices can be eliminated. In practice, policies are operated as one of three types: AWS managed policies (prepared in advance by AWS), customer managed policies (created by the user in a reusable form), and inline policies (embedded directly in a specific principal). Following the principle of least privilege, the recommended design is to allow only the required actions on only the required resources. CLF-C02 frequently asks about the division of roles among IAM users, IAM groups, IAM roles, and IAM policies, and the point that IAM falls under customer responsibility in the shared responsibility model.