Practice SCS-C03 Identity and Access Management questions with full explanations on every answer.
Start practicing
Identity and Access Management — choose a session length
Free · No account required
Click any question to see the full explanation and answer options, or start a focused practice session above.
An organization is migrating to AWS and needs to enforce security guardrails across multiple accounts. Which TWO actions should the security team perform to ensure compliance? (Select TWO)
2Refer to the exhibit. An IAM user with the 'Finance' tag is trying to upload an object to the 'production-data' bucket. The upload is failing. What is the most likely cause?
3An application running on EC2 needs to access DynamoDB tables. What is the most secure way to provide these permissions?
4Which THREE actions are best practices for managing root user account security? (Select THREE)
5An auditor needs to verify which IAM policies are attached to a specific user. Which command provides this information?
6A security engineer needs to prevent IAM users from disabling CloudTrail. Which policy element is most appropriate?
7Which IAM configuration helps prevent the 'confused deputy' problem when accessing cross-account resources?
8Refer to the exhibit. A developer is attempting to upload a file to 'my-secure-bucket' using the S3 console but receives an Access Denied error. The developer is not specifying any encryption settings during the upload. Based on the provided IAM policy, what is the reason for the failure?
9A security engineer is using Service Control Policies (SCPs) to manage permissions across an AWS Organization. Which TWO statements accurately describe the behavior and limitations of SCPs?
10A company wants to identify any S3 buckets or IAM roles in their AWS account that are accessible by external AWS accounts or public users. Which AWS service provides this functionality by analyzing resource-based policies?
11Refer to the exhibit. This S3 bucket policy is applied to a bucket named 'marketing-data'. What is the effect of this policy regarding access to the objects in the bucket?
12A company is setting up SAML 2.0 federation to allow employees to log into the AWS Management Console using their corporate credentials. Which TWO components are required to establish this trust relationship in AWS?
13A company is using AWS IAM Identity Center (successor to AWS Single Sign-On) to manage access to their AWS accounts. They want to automate the process of adding and removing users based on their status in an external identity provider. Which protocol should they use?
14A developer in Account A needs to use an AWS KMS customer managed key (CMK) located in Account B to encrypt data. Which TWO configuration steps are necessary to allow this cross-account access?
15A security engineer is troubleshooting an IAM policy evaluation issue where an explicit deny statement inside a permissions boundary is failing to restrict permissions as expected for a developer role. Which TWO factors must the engineer verify during the evaluation process?
16A security engineer is tasked with granting a developer in Account A access to an Amazon S3 bucket located in Account B. The developer needs to perform PutObject and GetObject operations. According to security best practices for cross-account access, which configuration provides the most secure and manageable solution?
17A company uses AWS Organizations with all features enabled. A security engineer has applied a Service Control Policy (SCP) at the Organizational Unit (OU) level that explicitly denies the 'iam:CreateUser' action. However, a specific IAM user in a member account within that OU has an administrator policy attached. What is the resulting behavior when this user attempts to create a new IAM user?
18A large enterprise wants to implement SAML 2.0-based federation to allow employees to access the AWS Management Console using their existing corporate credentials. Which TWO steps are required to establish this trust relationship and enable user access?
19A security team wants to identify which IAM roles in their AWS account have been granted permissions that allow access from external AWS accounts or public entities. Which AWS service should they use to automate this audit?
20An application running on an Amazon EC2 instance needs to access files in an Amazon S3 bucket. What is the most secure way to provide the application with the necessary credentials?
21A company is building a mobile application that requires users to authenticate before accessing private data stored in Amazon S3 and Amazon DynamoDB. Which THREE components or features of Amazon Cognito should be used to implement this securely?
The Identity and Access Management domain covers the key concepts tested in this area of the SCS-C03 exam blueprint published by Amazon Web Services. Courseiva provides free domain-focused practice, mock exams, missed-question review, and readiness tracking across all SCS-C03 domains — no account required.
The Courseiva SCS-C03 question bank contains 21 questions in the Identity and Access Management domain. Click any question to see the full explanation and answer breakdown.
Start with a 10-question focused session to identify your baseline accuracy in this domain. Read every explanation — even for questions you answer correctly — to understand the reasoning. Once you score consistently above 80%, move to a 20–30 question session to confirm depth before moving to the next domain.
Yes — the session launcher on this page draws questions exclusively from the Identity and Access Management domain. Choose 10, 20, 30, or 50 questions for a focused session, or click individual questions to review them one by one.
Save your results, see per-domain analytics, and get readiness scores — free, for every certification.
Sign Up FreeFree forever · Every certification included