SCS-C03 Identity and Access Management Practice Test 2 — 15 Questions

Question 1

Refer to the exhibit. An administrator applied the given S3 bucket policy to allow secure retrieval of objects. However, users connecting through a NAT gateway with an Elastic IP inside the specified CIDR block are still receiving Access Denied errors. What is the most likely cause of this behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The aws:SourceIp condition key evaluates the public IP of the client rather than the NAT gateway when traversing an internet gateway.. When clients connect through a NAT gateway, the NAT gateway replaces the private IP address of the client with its own public Elastic IP address for traffic exiting to the internet. If the bucket policy uses the aws:SourceIp condition to restrict access based on the client's local network CIDR rather than the NAT gateway's Elastic IP CIDR, the requests will be denied. Conversely, if the intent was to check the client IP, aws:SourceIp fails because it sees the NAT gateway's public IP. (Note: Depending on the exact scenario, if the policy checks the client's internal IP while going through a NAT, it fails; or if it checks the NAT IP, it succeeds unless the CIDR was misconfigured. However, B correctly identifies how aws:SourceIp interacts with NAT and public IPs).

Answer

The bucket policy lacks a corresponding explicit deny statement to override implicit denies from other global accounts.

Answer

Requests routed through Interface VPC Endpoints for Amazon S3 preserve the original client private IP, causing the public IP condition to fail.

Answer

The action s3:GetObject requires additional list permissions on the bucket level that are absent from the provided policy statement.

Question 2

A security engineer needs to delegate the ability to create IAM roles to a junior administrator. However, the engineer must ensure that the junior administrator cannot create roles with more permissions than they themselves possess. Which IAM feature should be used to enforce this constraint?

Accepted Answer

IAM Permissions Boundaries. While Permissions Boundaries are the correct feature, the explanation should clarify that the security engineer must use an IAM policy with a 'Condition' element (specifically 'iam:PermissionsBoundary') to force the junior administrator to attach a specific boundary to any role they create. Without this condition, the junior administrator could simply choose not to attach a boundary.

Answer

IAM Access Analyzer

Answer

Resource-based policies

Answer

Service Linked Roles

Question 3

Refer to the exhibit. A security engineer discovers the following policy attached to an IAM role. What is the actual effect of this policy regarding access to the 'company-data' S3 bucket?

Accepted Answer

It allows S3 access to the bucket from any source except for the specified VPC Endpoint 'vpce-1a2b3c4d'.. An IAM policy with 'Effect: Allow' and 'Condition: StringNotEquals' for 'aws:SourceVpce' grants access to all requests that do not originate from that specific VPC endpoint. However, if this is an IAM policy (as stated in the stem), it only grants permissions; it does not explicitly deny access from other sources unless there is an explicit Deny elsewhere. The explanation correctly identifies the logic but the phrasing of Option C is misleading as it implies a global restriction rather than a permission grant.

Answer

It restricts access to the S3 bucket so that it can only be reached through the specified VPC Endpoint 'vpce-1a2b3c4d'.

Answer

It denies all access to the S3 bucket if the request originates from the VPC Endpoint 'vpce-1a2b3c4d'.

Answer

It requires that all requests to the S3 bucket must be signed using AWS Signature Version 4 through the VPC Endpoint.

Question 4

An organization is using AWS Organizations to manage multiple accounts. The security team wants to use Service Control Policies (SCPs) to restrict certain actions. Which TWO statements accurately describe the behavior and limitations of SCPs?

Accepted Answer

SCPs affect all users and roles in a member account, including the root user.. The explanation states that SCPs 'lack of effect on the management account', but Option B (which claims SCPs restrict the management account root user) is marked as wrong. Furthermore, option A and C are correct, and SCPs indeed do not affect service-linked roles. The explanation should be aligned to correctly justify why SCPs affect member accounts (including root) and do not affect service-linked roles.

Answer

SCPs applied to the Management Account restrict the actions of the Management Account's root user.

Answer

SCPs can be used to grant permissions to a user who has no identity-based policies attached.

Answer

SCPs are the only way to enable cross-account access between member accounts in an organization.

Question 5

An organization is migrating to AWS and needs to enforce security guardrails across multiple accounts. Which TWO actions should the security team perform to ensure compliance? (Select TWO)

Accepted Answer

Apply SCPs at the root level to restrict specific AWS services in member accounts.. Implementing AWS Organizations allows for centralized management and governance. Service Control Policies (SCPs) act as guardrails, defining the maximum permissions allowed within an account, regardless of user identity. Combining SCPs with IAM Permission Boundaries provides a robust multi-layered defense strategy. This setup ensures that even if an administrator mistakenly grants broad permissions, the guardrails remain in effect, effectively preventing accidental or malicious privilege escalation across the entire AWS organization.

Answer

Assign IAM policies directly to the root user of every member account.

Answer

Configure individual IAM users in every account to ensure fine-grained control.

Answer

Enable AWS CloudTrail only in the primary management account.

Question 6

Refer to the exhibit. An IAM user with the 'Finance' tag is trying to upload an object to the 'production-data' bucket. The upload is failing. What is the most likely cause?

Accepted Answer

The user does not have the 'Department' tag attached to their IAM principal.. The policy uses a Deny effect with a StringNotEquals condition. If the principal tag 'Department' is anything other than 'Finance', the action is denied. However, if the user's tag is missing or the principal does not have the expected tag during the request, the condition evaluates to true, triggering the Deny. This exhibit highlights how attribute-based access control (ABAC) relies heavily on accurate, consistent tagging across all principal entities.

Answer

The user is missing the required S3 permission in their IAM policy.

Answer

The S3 bucket policy is not allowing the action.

Answer

The S3 bucket is in a different AWS region.

Question 7

An application running on EC2 needs to access DynamoDB tables. What is the most secure way to provide these permissions?

Accepted Answer

Assign an IAM role to the EC2 instance via an instance profile.. Assigning an IAM role to an EC2 instance is the secure, standard AWS approach. The instance profile automatically provides temporary credentials that the SDK uses, eliminating the need for manual key rotation or storage. This method follows the principle of least privilege by scoping access strictly to the necessary DynamoDB resources, preventing exposure of long-term credentials and simplifying maintenance for the application developers and security administrators.

Answer

Embed IAM access keys directly into the application code.

Answer

Store IAM access keys in a configuration file on the EC2 instance.

Answer

Create a public DynamoDB table to allow unauthenticated access.

Question 8

Which THREE actions are best practices for managing root user account security? (Select THREE)

Accepted Answer

Enable multi-factor authentication (MFA) on the root account.. The root user has unrestricted access to all resources. Therefore, it must be protected with the highest level of security. Enabling MFA, deleting access keys, and avoiding day-to-day tasks are essential. These actions minimize the risk of a full account takeover. By following these, you ensure that the root account is reserved for critical tasks like closing the account or managing specific billing configurations that cannot be delegated through IAM.

Answer

Store the root access keys in a secure, encrypted S3 bucket.

Answer

Use the root account for daily administrative tasks to simplify management.

Question 9

An auditor needs to verify which IAM policies are attached to a specific user. Which command provides this information?

Accepted Answer

aws iam list-attached-user-policies --user-name <username>. The AWS CLI is the primary tool for querying IAM metadata. The 'list-attached-user-policies' command specifically returns a list of all managed policies attached to the specified user. This is critical for security audits, where verifying the effective permissions of a principal is essential to ensure they match the requirements of their role and that no excessive privileges have been granted accidentally over time.

Answer

aws iam list-user-policies --user-name <username>

Answer

aws iam get-user-policy --user-name <username>

Answer

aws iam describe-user --user-name <username>

Question 10

A security engineer needs to prevent IAM users from disabling CloudTrail. Which policy element is most appropriate?

Accepted Answer

Use an SCP to explicitly deny 'cloudtrail:StopLogging' for the organization.. Using an explicit 'Deny' on the 'cloudtrail:StopLogging' action in a Service Control Policy (SCP) or a Permission Boundary is the most effective way to prevent even administrators from disabling logging. By applying this as a guardrail, you ensure that audit integrity is maintained regardless of individual user privileges. This is crucial for compliance, as it creates an immutable audit trail that security teams can rely on during incident investigations.

Answer

Create an IAM policy that denies 'cloudtrail:StopLogging' to all users.

Answer

Enable MFA Delete on all CloudTrail S3 buckets.

Answer

Restrict access to the CloudTrail console via IAM groups.

Question 11

Which IAM configuration helps prevent the 'confused deputy' problem when accessing cross-account resources?

Accepted Answer

External ID.. The 'External ID' is specifically designed to mitigate the confused deputy problem. When a third party assumes a role in your account, they must provide a unique identifier that you have pre-shared with them. This ensures that the third party is acting on behalf of the correct customer, preventing an attacker from tricking the service into accessing the wrong account's resources. It is a critical security control for cross-account integrations.

Answer

MFA requirement on the role.

Answer

Role session name.

Answer

Source IP condition.

Question 12

Refer to the exhibit. A developer is attempting to upload a file to 'my-secure-bucket' using the S3 console but receives an Access Denied error. The developer is not specifying any encryption settings during the upload. Based on the provided IAM policy, what is the reason for the failure?

Accepted Answer

The explicit Deny statement takes precedence because the upload request does not include the required KMS encryption header.. This question tests the understanding of IAM policy evaluation logic, specifically the explicit deny rule. Even if an allow statement exists, any matching deny statement will take precedence. In this scenario, the user is restricted from uploading objects unless they specify KMS encryption, which is a common requirement for maintaining data security standards within a bucket.

Answer

The S3 bucket lacks a bucket policy that explicitly allows the PutObject action for the developer.

Answer

The developer's IAM user does not have the 'kms:GenerateDataKey' permission required to encrypt the object.

Answer

The resource ARN in the policy is incorrect because it should include the bucket name without the trailing slash.

Question 13

A security engineer is using Service Control Policies (SCPs) to manage permissions across an AWS Organization. Which TWO statements accurately describe the behavior and limitations of SCPs?

Accepted Answer

SCPs affect all users and roles in the member account, including the account's root user.. SCPs are a key component of AWS Organizations for implementing guardrails across multiple accounts. They do not grant permissions but define the maximum available permissions for IAM users and roles within the targeted accounts. Understanding how SCPs interact with identity-based and resource-based policies is essential for maintaining a secure and compliant multi-account environment.

Answer

SCPs can grant permissions to an IAM user that hasn't been given access by an identity-based policy.

Answer

SCPs are applied to the management account of the organization to restrict its own administrator activities.

Answer

SCPs are used to manage resource-level permissions for cross-account access between different organizations.

Question 14

A company wants to identify any S3 buckets or IAM roles in their AWS account that are accessible by external AWS accounts or public users. Which AWS service provides this functionality by analyzing resource-based policies?

Accepted Answer

AWS IAM Access Analyzer. AWS IAM Access Analyzer helps identify resources in your organization and accounts that are shared with an external entity. This includes S3 buckets, IAM roles, and KMS keys. By analyzing resource-based policies, it provides findings that allow security engineers to verify if the access is intended, helping to prevent accidental data exposure or unauthorized cross-account access.

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Answer

AWS Config

Question 15

Refer to the exhibit. This S3 bucket policy is applied to a bucket named 'marketing-data'. What is the effect of this policy regarding access to the objects in the bucket?

Accepted Answer

It allows any IAM user or role within any account belonging to the AWS Organization 'o-1234567890' to read objects.. The PrincipalOrgID condition key is a powerful tool for restricting resource access to identities within a specific AWS Organization. This allows for broad 'Allow' statements that are still safely scoped to internal users only. Mastering this condition helps in creating scalable resource-based policies that don't require listing individual account IDs, thus reducing complexity and manual errors.

Answer

It makes the bucket public to anyone on the internet as long as they are using an AWS account.

Answer

It allows access only if the S3 bucket itself is owned by the organization 'o-1234567890'.

Answer

It requires that the request must originate from a VPC endpoint that is tagged with the organization ID.