A SysOps administrator must create an IAM policy for a developer who needs access to specific AWS services. Based on the requirements, the SysOps administrator creates the following policy: Which…

Question

Options

• ACreate an AWS Storage Gateway.
• BCreate an IAM role for an AWS Lambda function.
• CDelete an Amazon Simple Queue Service (Amazon SQS) queue.
• DDescribe AWS load balancers.
• EInvoke an AWS Lambda function.

• A
  2% (1)
• B
  5% (2)
• C
  10% (4)
• D
  83% (34)

Explanation

Options D and E are correct because the policy grants elasticloadbalancing:Describe* (covering all Describe actions on load balancers) and lambda:InvokeFunction, which maps directly to describing load balancers and invoking Lambda functions respectively.

Why the distractors are wrong:

• A (Storage Gateway): The policy does not include storagegateway:Create* or any Storage Gateway permissions.
• B (IAM role for Lambda): Creating IAM roles requires iam:CreateRole, which is absent - IAM permissions are almost never bundled with service-level policies and are tightly controlled separately.
• C (Delete SQS queue): The policy likely includes read/describe-level SQS permissions (if any), not destructive actions like sqs:DeleteQueue.

Memory tip: On IAM policy questions, map each answer choice to its exact API action (e.g., "Describe load balancers" = elasticloadbalancing:Describe*) and check whether that action string appears in the policy's Action block - if it's not there or is explicitly denied, the action is not allowed. When in doubt, remember that Describe/List/Get actions are commonly granted as read-only, while Create/Delete actions require explicit, separate permissions.

No community discussion yet for this question.