SCS-C03 Identity and Access Management — 20 Questions

Question 1

A security engineer must provide temporary read-only access to an S3 bucket for an external auditor without creating IAM users. Which method adheres to the principle of least privilege?

Accepted Answer

Configure a cross-account IAM role with an external ID and read-only permissions.. Cross-account IAM roles are the standard for secure, temporary access. Option D is impractical for large buckets and does not adhere to the principle of least privilege as effectively as a role-based approach. Option B is a network-level control, not an identity-based access control, and does not provide authentication.

Answer

Create an IAM user with read-only permissions and provide the auditor with the access keys.

Answer

Attach a bucket policy that grants access to the auditor's specific IP address range.

Answer

Generate a pre-signed URL for every object in the bucket and share them with the auditor.

Question 2

Refer to the exhibit. A user with this policy cannot download files from the bucket. What is the most likely reason?

Accepted Answer

The user lacks the 'kms:Decrypt' permission for the KMS key used by the bucket.. While the logic regarding kms:Decrypt is correct for encrypted objects, the explanation incorrectly mentions 'bucket owner permissions' as a general requirement for S3 access, which is misleading. Furthermore, without the exhibit, it is impossible to verify if the resource ARN is indeed correct or if the policy is malformed.

Answer

The policy is missing the 's3:ListAllMyBuckets' action.

Answer

The resource ARN for 's3:GetObject' is incorrect.

Answer

The policy is missing an 'Effect: Deny' statement.

Question 3

Which THREE conditions are required for a user to assume an IAM role in another account? (Select THREE)

Accepted Answer

The trusting account must have a role with a trust policy allowing the trusted account ID.. To assume a role in another account, three conditions must be met: 1) The trusting account's role must have a trust policy that permits the trusted account (or specific principal) to assume it. 2) The identity in the trusted account must have an IAM policy that grants the 'sts:AssumeRole' permission for the target role ARN. 3) The identity must programmatically call the 'sts:AssumeRole' API with the target role ARN.

Answer

The user must have the AdministratorAccess managed policy attached.

Answer

The trusting account must share the root user password with the trusted account.

Question 4

Which AWS feature should be used to provide temporary, limited-privilege credentials to external applications?

Accepted Answer

AWS Security Token Service (STS).. AWS Security Token Service (STS) is designed to issue temporary credentials. By using STS, you avoid the need for permanent IAM user credentials. These temporary credentials expire automatically, limiting the window of opportunity for an attacker if they are compromised. This is the industry-standard way to manage access for federated users, cross-account roles, and temporary application sessions, ensuring that long-lived keys are never used in dynamic or external environments.

Answer

IAM User Access Keys.

Answer

IAM Managed Policies.

Answer

AWS Secret Manager.

Question 5

Refer to the exhibit. What is the effective permission for a user with this policy regarding 'production-bucket'?

Accepted Answer

The user cannot delete the production bucket, but can perform all other S3 actions.. While the Deny statement does take precedence, the explanation implies the Deny is for 's3:DeleteBucket' (the action of deleting the bucket itself). However, in standard S3 policy scenarios, the restriction is usually on 's3:DeleteObject' (deleting items inside the bucket). If the policy denies 's3:DeleteBucket', the user cannot delete the bucket resource, but if the policy allows 's3:*', they can still delete all objects within it. The explanation needs to clarify that the Deny applies to the specific action mentioned in the policy, not a blanket 'DeleteBucket' if the policy actually targets object-level actions.

Answer

The user can perform all actions, including deleting the production bucket.

Answer

The user cannot perform any S3 actions because the Deny statement takes precedence.

Answer

The policy is invalid due to conflicting statements.

Question 6

A user needs permission to manage IAM users but should not be able to change their own permissions. How can this be achieved?

Accepted Answer

Attach a policy that denies 'iam:PutUserPolicy' if the username matches the resource.. To prevent users from modifying their own permissions, you can attach an explicit Deny policy that uses the '${aws:username}' or user ARN variable in a condition (such as StringEquals with aws:PrincipalArn or aws:username) to block IAM modification actions on themselves. This stops privilege escalation while still allowing them to manage other IAM users.

Answer

Use an SCP to globally deny modification of IAM policies.

Answer

Create a separate IAM user for the administrator with read-only access.

Answer

Enable MFA on the administrator's account for all IAM changes.

Question 7

A security auditor from a third-party company needs to access your AWS account to review CloudTrail logs stored in an S3 bucket. They suggest using a cross-account IAM role. Which mechanism should you implement to specifically mitigate the 'confused deputy' security risk during this cross-account access?

Accepted Answer

Require an ExternalID in the IAM role's trust policy and ensure the auditor provides it when assuming the role.. The 'confused deputy' problem occurs when a third-party service (the deputy) with permissions to access your resources is tricked by a malicious actor into accessing resources they shouldn't have access to. By requiring an External ID, you ensure that the third party can only assume the role if they possess the unique identifier provided by you, preventing them from being tricked into using their access for the wrong customer.

Answer

Create a new IAM user with an access key and secret key specifically for the third-party auditor's use.

Answer

Add a resource-based policy to the S3 bucket that allows the third-party's AWS account ID directly.

Answer

Restrict the trust policy of the IAM role to only allow the specific IP address of the auditor's office.

Question 8

A company is transitioning from a Role-Based Access Control (RBAC) model to an Attribute-Based Access Control (ABAC) model to manage their growing AWS environment. Which TWO benefits does ABAC provide over a traditional RBAC approach?

Accepted Answer

Permissions automatically scale as new resources are created with the correct tags without requiring policy updates.. ABAC leverages tags to simplify permission management as the environment scales. Unlike RBAC, which requires updating policies or creating new roles for every new resource or team, ABAC allows permissions to evolve automatically based on resource and principal attributes. This reduces the administrative overhead and the risk of policy bloat in complex AWS environments.

Answer

ABAC allows for the use of Service Control Policies (SCPs) which are not supported in an RBAC model.

Answer

ABAC eliminates the need for IAM trust policies when performing cross-account access between organizational accounts.

Answer

ABAC provides a built-in mechanism for multi-factor authentication (MFA) enforcement that RBAC lacks.

Question 9

A company wants to provide its on-premises servers with access to AWS resources without using long-term IAM user access keys. The servers have existing X.509 certificates issued by an internal Certificate Authority (CA). Which AWS service or feature is the BEST solution for this requirement?

Accepted Answer

IAM Roles Anywhere using the internal CA as a trust anchor to exchange certificates for temporary credentials.. IAM Roles Anywhere allows workloads running outside of AWS, such as on-premises servers or containers, to obtain temporary AWS credentials. By using a Trust Anchor tied to a Certificate Authority, you eliminate the need for long-term IAM user access keys. This significantly improves security by aligning on-premises identity management with AWS best practices for temporary credentials.

Answer

AWS Directory Service for Microsoft Active Directory to create a trust relationship with the on-premises domain.

Answer

AWS PrivateLink to establish a private connection between the on-premises data center and IAM endpoints.

Answer

AWS Systems Manager Hybrid Activations to manage the on-premises servers as Managed Instances.

Question 10

A company wants to allow project leads to create IAM roles for their team members but must ensure that these new roles cannot exceed a specific set of permissions, such as access to S3 and DynamoDB only. Which IAM feature should be used to enforce this limit?

Accepted Answer

IAM Permissions Boundary.. Permissions boundaries are used to delegate the ability to create IAM roles or users to others without allowing them to escalate their own privileges. The boundary defines the maximum permissions the new identity can have. This is a vital security control for decentralized teams, ensuring that developers can manage their own roles while staying within organizational security limits.

Answer

IAM Groups with managed policies attached.

Answer

Service Control Policies (SCPs) at the OU level.

Answer

Resource-based policies on S3 and DynamoDB.

Question 11

An organization uses AWS Organizations and wants to ensure that only members of the 'Compliance' team can access S3 buckets that are tagged with 'DataClassification: Restricted'. The Compliance team members use a specific IAM role. How can this be enforced across all accounts?

Accepted Answer

Use an identity-based policy on the Compliance role with a Condition that checks 'aws:ResourceTag/DataClassification'.. To restrict access to specific S3 buckets based on tags across all accounts in an AWS Organization, Service Control Policies (SCPs) cannot evaluate S3 resource tags because S3 resource tags are not supported in SCP condition keys. Instead, you can use IAM policies for Attribute-Based Access Control (ABAC) or, more commonly, S3 bucket policies evaluated across accounts. However, since the question asks how to ensure only the Compliance team can access these buckets, an identity-based policy on the Compliance role using condition keys or using AWS Organizations with tag policies isn't quite right for *restricting* others. Wait, if Option B says 'Use an identity-based policy on the Compliance role with a Condition that checks aws:ResourceTag/DataClassification', this grants or limits what the Compliance role can access based on tags. But to enforce this across all accounts, a central bucket policy or Permission Boundaries are often used. Let's correct the question to use a bucket policy or clarify ABAC.

Answer

Apply an SCP to the root of the organization that grants S3 access to the Compliance role.

Answer

Enable S3 Block Public Access at the organization level for all buckets.

Answer

Create a Resource Group for all restricted buckets and assign the role to that group.

Question 12

A company uses a centralized identity account to manage users who assume roles in various production accounts. They want to pass the user's department name as a session tag during the 'sts:AssumeRole' call to enforce fine-grained access control in the production accounts. What must be configured to support this?

Accepted Answer

The role's trust policy in the production account must allow the 'sts:TagSession' action for the identity account principal.. To pass session tags during an sts:AssumeRole call, the IAM role's trust policy must include the 'sts:TagSession' action. Additionally, the caller must have the 'sts:TagSession' permission. The explanation should explicitly mention that the trust policy must allow the 'sts:TagSession' action to authorize the passing of tags during the assumption process.

Answer

The production account's role must have a resource-based policy allowing the 'iam:TagSession' action.

Answer

The user in the identity account must have the 'iam:AddUserToGroup' permission for the production group.

Answer

The department name must be added as a permanent tag to the IAM role itself in the production account.

Question 13

Which of the following is considered a security best practice for managing the AWS account root user?

Accepted Answer

Enable Multi-Factor Authentication (MFA) and only use the root user for tasks that specifically require it.. The AWS account root user has unrestricted access to all resources and services in the account. Protecting this identity is the highest priority in AWS security. Best practices include avoiding the use of the root user for daily tasks, enabling multi-factor authentication, and securely storing the credentials. Most administrative tasks should be performed using IAM roles with the AdministratorAccess policy.

Answer

Create an IAM policy that denies all actions for the root user to prevent accidental changes.

Answer

Share the root user credentials with all senior administrators so that there is always a backup available.

Answer

Generate an access key for the root user and use it for automated scripts that require high privileges.

Question 14

A company is securing AWS Secrets Manager. Which THREE actions will improve the security posture of secrets management?

Accepted Answer

Enabling automatic rotation using an AWS Lambda function to update credentials in the target database.. The explanation is accurate, but the trap fields need to be populated to provide pedagogical value to the student.

Answer

Disabling the automatic rotation of secrets to prevent accidental application downtime.

Answer

Storing the secrets in an S3 bucket with versioning enabled and using that as the primary source.

Question 15

An enterprise wants to grant an external partner secure, programmatic access to specific Amazon S3 buckets within their AWS account without creating individual IAM users. The solution must enforce rotating temporary credentials and adhere to the principle of least privilege. Which approach should a security engineer implement?

Accepted Answer

Establish an IAM role in the enterprise account with a trust policy requiring an external ID, and grant permissions to the S3 buckets.. Option C is the correct approach for cross-account access using IAM roles. Option B is incorrect because you cannot configure an S3 bucket policy to 'trust' an external account directly; you must use an IAM role in the enterprise account that the partner account assumes. The explanation correctly identifies the use of IAM roles and External IDs to prevent the confused deputy problem.

Answer

Create an IAM user for the partner with programmatic access keys, and attach an inline policy restricted to the specific S3 buckets.

Answer

Provision an IAM role in the partner account and configure an S3 bucket policy in the enterprise account trusting the external account.

Answer

Configure cross-account resource sharing using AWS Resource Access Manager to directly share the S3 buckets with the partner AWS account.

Question 16

Refer to the exhibit. An administrator applied the given S3 bucket policy to allow secure retrieval of objects. However, users connecting through a NAT gateway with an Elastic IP inside the specified CIDR block are still receiving Access Denied errors. What is the most likely cause of this behavior?

Accepted Answer

The aws:SourceIp condition key evaluates the public IP of the client rather than the NAT gateway when traversing an internet gateway.. When clients connect through a NAT gateway, the NAT gateway replaces the private IP address of the client with its own public Elastic IP address for traffic exiting to the internet. If the bucket policy uses the aws:SourceIp condition to restrict access based on the client's local network CIDR rather than the NAT gateway's Elastic IP CIDR, the requests will be denied. Conversely, if the intent was to check the client IP, aws:SourceIp fails because it sees the NAT gateway's public IP. (Note: Depending on the exact scenario, if the policy checks the client's internal IP while going through a NAT, it fails; or if it checks the NAT IP, it succeeds unless the CIDR was misconfigured. However, B correctly identifies how aws:SourceIp interacts with NAT and public IPs).

Answer

The bucket policy lacks a corresponding explicit deny statement to override implicit denies from other global accounts.

Answer

Requests routed through Interface VPC Endpoints for Amazon S3 preserve the original client private IP, causing the public IP condition to fail.

Answer

The action s3:GetObject requires additional list permissions on the bucket level that are absent from the provided policy statement.

Question 17

A security engineer needs to delegate the ability to create IAM roles to a junior administrator. However, the engineer must ensure that the junior administrator cannot create roles with more permissions than they themselves possess. Which IAM feature should be used to enforce this constraint?

Accepted Answer

IAM Permissions Boundaries. While Permissions Boundaries are the correct feature, the explanation should clarify that the security engineer must use an IAM policy with a 'Condition' element (specifically 'iam:PermissionsBoundary') to force the junior administrator to attach a specific boundary to any role they create. Without this condition, the junior administrator could simply choose not to attach a boundary.

Answer

IAM Access Analyzer

Answer

Resource-based policies

Answer

Service Linked Roles

Question 18

Refer to the exhibit. A security engineer discovers the following policy attached to an IAM role. What is the actual effect of this policy regarding access to the 'company-data' S3 bucket?

Accepted Answer

It allows S3 access to the bucket from any source except for the specified VPC Endpoint 'vpce-1a2b3c4d'.. An IAM policy with 'Effect: Allow' and 'Condition: StringNotEquals' for 'aws:SourceVpce' grants access to all requests that do not originate from that specific VPC endpoint. However, if this is an IAM policy (as stated in the stem), it only grants permissions; it does not explicitly deny access from other sources unless there is an explicit Deny elsewhere. The explanation correctly identifies the logic but the phrasing of Option C is misleading as it implies a global restriction rather than a permission grant.

Answer

It restricts access to the S3 bucket so that it can only be reached through the specified VPC Endpoint 'vpce-1a2b3c4d'.

Answer

It denies all access to the S3 bucket if the request originates from the VPC Endpoint 'vpce-1a2b3c4d'.

Answer

It requires that all requests to the S3 bucket must be signed using AWS Signature Version 4 through the VPC Endpoint.

Question 19

An organization is using AWS Organizations to manage multiple accounts. The security team wants to use Service Control Policies (SCPs) to restrict certain actions. Which TWO statements accurately describe the behavior and limitations of SCPs?

Accepted Answer

SCPs affect all users and roles in a member account, including the root user.. The explanation states that SCPs 'lack of effect on the management account', but Option B (which claims SCPs restrict the management account root user) is marked as wrong. Furthermore, option A and C are correct, and SCPs indeed do not affect service-linked roles. The explanation should be aligned to correctly justify why SCPs affect member accounts (including root) and do not affect service-linked roles.

Answer

SCPs applied to the Management Account restrict the actions of the Management Account's root user.

Answer

SCPs can be used to grant permissions to a user who has no identity-based policies attached.

Answer

SCPs are the only way to enable cross-account access between member accounts in an organization.

Question 20

An organization is migrating to AWS and needs to enforce security guardrails across multiple accounts. Which TWO actions should the security team perform to ensure compliance? (Select TWO)

Accepted Answer

Apply SCPs at the root level to restrict specific AWS services in member accounts.. Implementing AWS Organizations allows for centralized management and governance. Service Control Policies (SCPs) act as guardrails, defining the maximum permissions allowed within an account, regardless of user identity. Combining SCPs with IAM Permission Boundaries provides a robust multi-layered defense strategy. This setup ensures that even if an administrator mistakenly grants broad permissions, the guardrails remain in effect, effectively preventing accidental or malicious privilege escalation across the entire AWS organization.

Answer

Assign IAM policies directly to the root user of every member account.

Answer

Configure individual IAM users in every account to ensure fine-grained control.

Answer

Enable AWS CloudTrail only in the primary management account.