Free CLF-C02 practice questions: IAM basics

Identity is where the exam is most concrete, and most learnable. Six questions on users, groups, roles and policies — CLF-C02, 2026 edition.

Here are 6 typical IAM questions in the exam's own style — free, with the answer explained, no sign-up.

Straight to the 6 free questions ↓

Identity and Access Management is where the Security and Compliance domain is at its most concrete. There is no architecture to reason about — just four building blocks and a handful of rules AWS repeats everywhere. Get the blocks straight and this is some of the most reliable scoring on the whole exam.

The four building blocks

Everything in IAM is one of four things:

A user is a permanent identity, usually for one person. It has its own sign-in and its own credentials.
A group bundles users so that a policy attached to the group applies to all of them. Groups are how you avoid attaching the same policy to twenty people by hand.
A role is an identity that is assumed temporarily. A person can assume one, but more importantly so can a service — an EC2 instance or a Lambda function assumes a role to get short-lived credentials with exactly the permissions it needs.
A policy is the JSON document that actually grants or denies permissions. You attach it to a user, a group or a role. The policy is the “what is allowed”; the others are the “who”.

If you can place any IAM term into one of those four slots, most questions answer themselves.

Roles beat stored keys — every time

The single most tested IAM idea beyond the vocabulary is this: when an application or an AWS service needs access to another service, give it a role, not an access key. A role hands out temporary credentials that rotate on their own, so there is nothing to hard-code and nothing to leak. Any option that involves pasting access keys into code, baking them into an AMI, or reusing the root user’s keys is there to be rejected. This is the exam’s favourite “secure versus convenient” fork, and secure always wins.

Multi-factor authentication adds a second factor — a one-time code from a device — on top of the password. It does not replace the password and it does not grant any permissions; it simply means a stolen password alone cannot sign in. Expect at least one question that offers MFA as “encrypts your data” or “gives admin rights” to see whether you know what it actually does.

One fact worth memorising: IAM is global

IAM is a global service. A user or role exists across all Regions — you do not recreate identities Region by Region. It is a small fact, but the exam likes small facts that sound plausible when stated the wrong way, and “you must create IAM users in each Region” is a classic wrong option.

How to use the questions below

Answer each one first, then read the explanation past the correct letter to the part that says why the other three fail. IAM distractors are always real AWS ideas put in the wrong slot — a group offered where a role belongs, an access key offered where a role belongs — and separating them on sight is the whole skill the exam is testing here.

The four IAM building blocks: a user is a permanent identity for one person, a group bundles users so a policy applies to all of them, a role is assumed temporarily for short-lived credentials by a person or a service such as EC2, and a policy is the JSON document that grants or denies the actual permissions attached to any of them.

6 free CLF-C02 practice questions

Answers and explanations — no email wall

CLF-C02 Question 1 of 6

A company wants to give the same set of permissions to 20 developers, without attaching policies to each person one by one. What should it use?

Answer: A — An IAM group

An IAM group bundles users so a policy attached to the group applies to every member — add or remove people and permissions follow automatically. Why not the others: a shared user destroys the audit trail, since you can no longer tell who did what. The root user is never used for team access. A separate account per developer is enormous overhead for what a group solves in one step.

CLF-C02 Question 2 of 6

An application running on an Amazon EC2 instance needs to read files from an S3 bucket. What is the recommended way to grant this access?

Answer: A — Attach an IAM role to the EC2 instance

An IAM role gives the instance temporary, automatically rotated credentials with only the permissions it needs — no secrets to store. Why not the others: hard-coding access keys leaks the moment the code is shared or committed. The root user's keys should never be used by an application. Making the bucket public exposes it to the entire internet to solve an access problem that a role solves securely.

CLF-C02 Question 3 of 6

What does enabling multi-factor authentication (MFA) add to an IAM sign-in?

Answer: A — A second factor, such as a temporary code from a device, in addition to the password

MFA requires something you know (the password) plus something you have (a one-time code), so a stolen password alone is not enough to sign in. Why not the others: MFA adds a factor, it does not replace the password. It has nothing to do with granting permissions. And it protects sign-in, not data-at-rest encryption, which is what KMS is for.

CLF-C02 Question 4 of 6

What is an IAM policy?

Answer: A — A JSON document that defines which actions are allowed or denied

A policy is a JSON document listing permissions — the actions allowed or denied on which resources — that you attach to a user, group or role. Why not the others: a server that filters network traffic is a security group or firewall, not a policy. A spending alert is AWS Budgets. And IAM has no concept of a 'backup of users' — the distractors are all real AWS ideas placed in the wrong slot.

CLF-C02 Question 5 of 6

Which statement about IAM is correct?

Answer: A — IAM is a global service; users and roles are not tied to a specific Region

IAM is global: an IAM user or role exists across all Regions, not once per Region. Why not the others: you do not recreate identities per Region — that is the whole convenience of a global service. IAM governs access to AWS services broadly, not just EC2. And it is available from the moment the account exists, with no dependency on creating a VPC first.

CLF-C02 Question 6 of 6

What is the difference between an IAM user and an IAM role?

Answer: A — A user is a permanent identity for a person; a role is assumed temporarily and provides short-lived credentials

A user is a long-lived identity, usually for one person, with its own credentials. A role is not tied to one identity — a person or a service assumes it and receives temporary credentials for the session. Why not the others: roles are not limited to the root account; in fact services like EC2 and Lambda assume roles constantly. Roles avoid permanent keys rather than holding them. And the two are clearly distinct, which is exactly what the exam checks here.

That is exactly how every question in the course works — answer, explanation, why-not. The real set continues in the practice player: 10 free questions, no sign-up.

Continue with the 10 free questions →

Those 6 questions were the start.

The exam does not test whether you recognise a term — it tests whether you can rule out three plausible answers under time pressure. That is what the explanations above are for, and there are 390 more questions built exactly like them.

Collecting questions yourself

Scattered across forums, of unknown age
Answer keys without reasoning
No idea which domain you are weak in

Practising with a system

390 questions in 6 full tests, CLF-C02 (2026)
Every option explained — including the wrong ones
Readiness per exam domain, and drills for your weakest

Start free — 10 questions

Straight into the player. No account, no email.

Frequently asked questions

Is this the current CLF-C02 format?

Yes — these questions follow the CLF-C02 exam guide (2026 edition). IAM sits in the Security and Compliance domain, which is the heaviest on the exam at 30%, and identity questions are among the most predictable marks in it.

Are these real exam questions?

No. They are our own questions, written in the style and difficulty of the exam. Reproducing real exam items breaks the AWS certification agreement and can cost you your certification — and it would not help, because memorising an item teaches you nothing about the one you have not seen.

Do I need to write IAM policies by hand for this exam?

No. CLF-C02 tests the concepts — what a user, group, role and policy are, and when a role beats stored keys — not JSON syntax. You will not be asked to author a policy document; you will be asked to pick the right building block for a situation.

When should I use a role instead of a user?

Whenever an AWS service or an application needs access. A role gives temporary credentials that rotate automatically, so there is no long-lived key to leak. Users are for people who sign in; roles are for workloads and for granting temporary access.

Updated for CLF-C02 (July 2026). The sample questions above are our own work in the style of the exam — not real exam items. The exam itself is set and marked by the certification body.