SCS-C03 Identity and Access Management — Timed 10 Questions

Question 1

A security engineer must provide temporary read-only access to an S3 bucket for an external auditor without creating IAM users. Which method adheres to the principle of least privilege?

Accepted Answer

Configure a cross-account IAM role with an external ID and read-only permissions.. Cross-account IAM roles are the standard for secure, temporary access. Option D is impractical for large buckets and does not adhere to the principle of least privilege as effectively as a role-based approach. Option B is a network-level control, not an identity-based access control, and does not provide authentication.

Answer

Create an IAM user with read-only permissions and provide the auditor with the access keys.

Answer

Attach a bucket policy that grants access to the auditor's specific IP address range.

Answer

Generate a pre-signed URL for every object in the bucket and share them with the auditor.

Question 2

Refer to the exhibit. A user with this policy cannot download files from the bucket. What is the most likely reason?

Accepted Answer

The user lacks the 'kms:Decrypt' permission for the KMS key used by the bucket.. While the logic regarding kms:Decrypt is correct for encrypted objects, the explanation incorrectly mentions 'bucket owner permissions' as a general requirement for S3 access, which is misleading. Furthermore, without the exhibit, it is impossible to verify if the resource ARN is indeed correct or if the policy is malformed.

Answer

The policy is missing the 's3:ListAllMyBuckets' action.

Answer

The resource ARN for 's3:GetObject' is incorrect.

Answer

The policy is missing an 'Effect: Deny' statement.

Question 3

Which THREE conditions are required for a user to assume an IAM role in another account? (Select THREE)

Accepted Answer

The trusting account must have a role with a trust policy allowing the trusted account ID.. To assume a role in another account, three conditions must be met: 1) The trusting account's role must have a trust policy that permits the trusted account (or specific principal) to assume it. 2) The identity in the trusted account must have an IAM policy that grants the 'sts:AssumeRole' permission for the target role ARN. 3) The identity must programmatically call the 'sts:AssumeRole' API with the target role ARN.

Answer

The user must have the AdministratorAccess managed policy attached.

Answer

The trusting account must share the root user password with the trusted account.

Question 4

Which AWS feature should be used to provide temporary, limited-privilege credentials to external applications?

Accepted Answer

AWS Security Token Service (STS).. AWS Security Token Service (STS) is designed to issue temporary credentials. By using STS, you avoid the need for permanent IAM user credentials. These temporary credentials expire automatically, limiting the window of opportunity for an attacker if they are compromised. This is the industry-standard way to manage access for federated users, cross-account roles, and temporary application sessions, ensuring that long-lived keys are never used in dynamic or external environments.

Answer

IAM User Access Keys.

Answer

IAM Managed Policies.

Answer

AWS Secret Manager.

Question 5

Refer to the exhibit. What is the effective permission for a user with this policy regarding 'production-bucket'?

Accepted Answer

The user cannot delete the production bucket, but can perform all other S3 actions.. While the Deny statement does take precedence, the explanation implies the Deny is for 's3:DeleteBucket' (the action of deleting the bucket itself). However, in standard S3 policy scenarios, the restriction is usually on 's3:DeleteObject' (deleting items inside the bucket). If the policy denies 's3:DeleteBucket', the user cannot delete the bucket resource, but if the policy allows 's3:*', they can still delete all objects within it. The explanation needs to clarify that the Deny applies to the specific action mentioned in the policy, not a blanket 'DeleteBucket' if the policy actually targets object-level actions.

Answer

The user can perform all actions, including deleting the production bucket.

Answer

The user cannot perform any S3 actions because the Deny statement takes precedence.

Answer

The policy is invalid due to conflicting statements.

Question 6

A user needs permission to manage IAM users but should not be able to change their own permissions. How can this be achieved?

Accepted Answer

Attach a policy that denies 'iam:PutUserPolicy' if the username matches the resource.. To prevent users from modifying their own permissions, you can attach an explicit Deny policy that uses the '${aws:username}' or user ARN variable in a condition (such as StringEquals with aws:PrincipalArn or aws:username) to block IAM modification actions on themselves. This stops privilege escalation while still allowing them to manage other IAM users.

Answer

Use an SCP to globally deny modification of IAM policies.

Answer

Create a separate IAM user for the administrator with read-only access.

Answer

Enable MFA on the administrator's account for all IAM changes.

Question 7

A security auditor from a third-party company needs to access your AWS account to review CloudTrail logs stored in an S3 bucket. They suggest using a cross-account IAM role. Which mechanism should you implement to specifically mitigate the 'confused deputy' security risk during this cross-account access?

Accepted Answer

Require an ExternalID in the IAM role's trust policy and ensure the auditor provides it when assuming the role.. The 'confused deputy' problem occurs when a third-party service (the deputy) with permissions to access your resources is tricked by a malicious actor into accessing resources they shouldn't have access to. By requiring an External ID, you ensure that the third party can only assume the role if they possess the unique identifier provided by you, preventing them from being tricked into using their access for the wrong customer.

Answer

Create a new IAM user with an access key and secret key specifically for the third-party auditor's use.

Answer

Add a resource-based policy to the S3 bucket that allows the third-party's AWS account ID directly.

Answer

Restrict the trust policy of the IAM role to only allow the specific IP address of the auditor's office.

Question 8

A company is transitioning from a Role-Based Access Control (RBAC) model to an Attribute-Based Access Control (ABAC) model to manage their growing AWS environment. Which TWO benefits does ABAC provide over a traditional RBAC approach?

Accepted Answer

Permissions automatically scale as new resources are created with the correct tags without requiring policy updates.. ABAC leverages tags to simplify permission management as the environment scales. Unlike RBAC, which requires updating policies or creating new roles for every new resource or team, ABAC allows permissions to evolve automatically based on resource and principal attributes. This reduces the administrative overhead and the risk of policy bloat in complex AWS environments.

Answer

ABAC allows for the use of Service Control Policies (SCPs) which are not supported in an RBAC model.

Answer

ABAC eliminates the need for IAM trust policies when performing cross-account access between organizational accounts.

Answer

ABAC provides a built-in mechanism for multi-factor authentication (MFA) enforcement that RBAC lacks.

Question 9

A company wants to provide its on-premises servers with access to AWS resources without using long-term IAM user access keys. The servers have existing X.509 certificates issued by an internal Certificate Authority (CA). Which AWS service or feature is the BEST solution for this requirement?

Accepted Answer

IAM Roles Anywhere using the internal CA as a trust anchor to exchange certificates for temporary credentials.. IAM Roles Anywhere allows workloads running outside of AWS, such as on-premises servers or containers, to obtain temporary AWS credentials. By using a Trust Anchor tied to a Certificate Authority, you eliminate the need for long-term IAM user access keys. This significantly improves security by aligning on-premises identity management with AWS best practices for temporary credentials.

Answer

AWS Directory Service for Microsoft Active Directory to create a trust relationship with the on-premises domain.

Answer

AWS PrivateLink to establish a private connection between the on-premises data center and IAM endpoints.

Answer

AWS Systems Manager Hybrid Activations to manage the on-premises servers as Managed Instances.

Question 10

A company wants to allow project leads to create IAM roles for their team members but must ensure that these new roles cannot exceed a specific set of permissions, such as access to S3 and DynamoDB only. Which IAM feature should be used to enforce this limit?

Accepted Answer

IAM Permissions Boundary.. Permissions boundaries are used to delegate the ability to create IAM roles or users to others without allowing them to escalate their own privileges. The boundary defines the maximum permissions the new identity can have. This is a vital security control for decentralized teams, ensuring that developers can manage their own roles while staying within organizational security limits.

Answer

IAM Groups with managed policies attached.

Answer

Service Control Policies (SCPs) at the OU level.

Answer

Resource-based policies on S3 and DynamoDB.