The correct choices are IAM groups can contain only IAM users and cannot include other groups and A single IAM user may be a member of multiple groups at once.

IAM groups can contain only IAM users and cannot include other groups is correct because IAM groups are flat collections that hold user identities and you attach policies to the group rather than nesting groups. Groups provide a simple way to manage permissions for many users at once and AWS IAM does not implement group hierarchies.

A single IAM user may be a member of multiple groups at once is correct because a user receives the union of permissions from every group they belong to. Placing a user in multiple groups lets you compose access by combining group policies instead of creating unique policies for each user.

New IAM users are automatically placed into a default group named 'users' is incorrect because AWS does not add new users to any group automatically and you must assign users to groups yourself.

IAM groups can be nested within other IAM groups to build hierarchies is incorrect because IAM does not support nested groups and you cannot create group-to-group relationships.

An IAM user can belong to exactly one IAM group at any time is incorrect because IAM allows users to be members of multiple groups so that permissions can be aggregated from several sources.

Full AWS Practitioner Certification Question