IAM Access Analyzer shows up in the exam for finding unintended permissions and for refining policies toward least privilege. These are the facts from the AWS documentation that are easiest to mix up.
IAM Access Analyzer offers external access, internal access and unused access analyzers, plus policy validation, custom policy checks and policy generation from CloudTrail. The 'zone of trust' is your account or organization.
Official source: docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html
External access analysis only covers resources in the same Region where it is enabled: create one analyzer per Region in use. The unused access analyzer does NOT depend on the Region. After a policy change, it is re-analyzed within about 30 minutes.
Official source: docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html
The unused access analyzer detects unused roles, unused access keys and passwords of IAM users, and unused services and actions in active roles. Service-linked roles are not analyzed.
Official source: docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html
Access Analyzer generates an IAM policy from the actual activity of a user or role in CloudTrail over the date range you choose. It is the way to apply least privilege with real data.
Official source: docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html
Answer practice questions, then review your mistakes with spaced repetition.