Managed vs inline policies in AWS - Practice Questions

Challenge - 5 Problems

🧠 Conceptual

intermediate

Difference between managed and inline policies

Which statement correctly describes the difference between AWS managed policies and inline policies?

A Inline policies are AWS predefined policies; managed policies are custom policies created by users.

B Inline policies can be reused across multiple users, groups, or roles; managed policies are embedded directly into a single user, group, or role.

C Managed policies cannot be modified once created; inline policies can be attached to multiple users, groups, or roles.

D Managed policies are standalone and can be attached to multiple users, groups, or roles; inline policies are embedded directly into a single user, group, or role.

💡 Hint

Think about how policies are attached and reused in AWS IAM.

Managed policies are standalone and reusable across multiple identities, while inline policies are embedded directly into a single identity and cannot be reused.

❓ Architecture

intermediate

Policy management best practice

You want to apply the same permissions to multiple IAM users and update permissions easily in the future. Which policy type should you use?

A Use inline policies attached to a group containing the users.

B Use a single customer managed policy attached to all users.

C Use inline policies attached to each user separately.

D Use AWS managed policies only.

💡 Hint

Consider ease of updating permissions for many users at once.

Customer managed policies can be attached to multiple users and updated centrally, making permission management easier.

❓ security

advanced

Policy deletion impact

What happens if you delete a customer managed policy that is attached to multiple IAM roles?

A All roles lose the permissions granted by that policy immediately.

B Roles keep the permissions because the policy is cached locally.

C Roles lose permissions only after a 24-hour delay.

D AWS automatically replaces the deleted policy with a default managed policy.

💡 Hint

Think about how AWS enforces permissions from policies.

Deleting a customer managed policy removes it from all attached roles immediately, causing loss of those permissions.

❓ service_behavior

advanced

Inline policy behavior on user deletion

If an IAM user with an inline policy is deleted, what happens to the inline policy?

A The inline policy is deleted along with the user.

B The inline policy remains in AWS and can be attached to another user.

C The inline policy is converted automatically into a managed policy.

D The inline policy is archived but not deleted.

💡 Hint

Consider the lifecycle of inline policies tied to a single identity.

Inline policies are embedded in the user and are deleted when the user is deleted.

✅ Best Practice

expert

Choosing policy type for audit and reuse

Your organization requires strict auditing of policy changes and wants to reuse policies across multiple accounts. Which policy type and approach best meets these requirements?

A Use AWS managed policies only, as AWS audits all changes automatically.

B Use inline policies in each account to keep policies isolated and auditable per user.

C Use customer managed policies stored in AWS Organizations and attach them across accounts.

D Use inline policies attached to groups to simplify reuse and auditing.

💡 Hint

Think about centralized management and audit capabilities across accounts.

Customer managed policies can be centrally managed and audited, and shared across accounts using AWS Organizations, supporting reuse and compliance.