SCS-C02 Practice Exam 56 — 20 Questions

Question 1

A company uses an IAM role to allow an EC2 instance to access an S3 bucket. The role has an attached policy that grants s3:GetObject on the bucket. However, the application on the EC2 instance is unable to read objects. What is the MOST likely cause?

Accepted Answer

The EC2 instance does not have an IAM instance profile configured.. Option D is correct because the instance profile must be associated with the EC2 instance for the role to be used. Option A is wrong because the policy is attached to the role, not the instance. Option B is wrong because the bucket policy may be blocking access. Option C is wrong because the user data script does not affect IAM permissions.

Answer

The S3 bucket policy denies access to the IAM role.

Answer

The policy is attached to the EC2 instance instead of the role.

Answer

The EC2 instance is not running the latest user data script.

Question 2

A security engineer notices that an IAM role has a trust policy that allows 'sts:AssumeRole' from any AWS account. What is the security risk?

Accepted Answer

Any IAM user in any AWS account can assume the role and gain its permissions.. Option A is correct because any user from any account can assume the role. Option B is wrong because the risk is not just about resources outside the account. Option C is wrong because the trust policy allows assumption, not just viewing. Option D is wrong because the risk is that anyone can assume the role, not just malicious users.

Answer

The role can be assumed by any AWS service.

Answer

The role's permissions are exposed to all AWS accounts.

Answer

The role can be used to access resources in other accounts.

Question 3

A security engineer is designing a permissions boundary for an IAM role used by an EC2 instance. The boundary must allow the instance to list all S3 buckets but deny the ability to delete any bucket. Which policy should be used as the permissions boundary?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:ListAllMyBuckets","Resource":"*"},{"Effect":"Deny","Action":"s3:DeleteBucket","Resource":"*"}]}. Permissions boundaries limit the maximum permissions. Option A allows both actions. Option B denies s3:DeleteBucket but allows s3:ListAllMyBuckets, which meets the requirement. Option C denies list. Option D allows delete.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"s3:ListAllMyBuckets","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:ListAllMyBuckets","s3:DeleteBucket"],"Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:ListAllMyBuckets","Resource":"*"},{"Effect":"Allow","Action":"s3:DeleteBucket","Resource":"*"}]}

Question 4

A company has an S3 bucket that contains sensitive data. The security team wants to ensure that all objects uploaded to the bucket are encrypted at rest using server-side encryption with AWS KMS (SSE-KMS). What should the security team do to enforce this requirement?

Accepted Answer

Use an S3 bucket policy with a condition that denies PutObject if the x-amz-server-side-encryption header is not set to 'aws:kms'.. Option C is correct because an S3 bucket policy denying PutObject requests that do not include the x-amz-server-side-encryption header set to aws:kms ensures that only objects encrypted with SSE-KMS can be uploaded. Option A is wrong because bucket policies cannot enforce default encryption; they can only deny requests based on conditions. Option B is wrong because enabling default encryption does not prevent uploads without encryption headers. Option D is wrong because SSE-S3 is not KMS encryption.

Answer

Use an S3 bucket policy that requires the x-amz-server-side-encryption-aws-kms-key-id header to match a specific KMS key.

Answer

Use an S3 bucket policy with a condition that requires the x-amz-server-side-encryption header to be present.

Answer

Configure the bucket's default encryption to use SSE-KMS.

Question 5

A developer needs to allow an EC2 instance to read from a DynamoDB table named 'Orders' in the same account. The security team requires that the permissions be granted using an instance profile. Which steps should be taken?

Accepted Answer

Create an IAM role with a policy that allows dynamodb:GetItem on the 'Orders' table, create an instance profile, add the role to the profile, and launch the EC2 instance with the instance profile. Option A is correct because the instance profile is created, the IAM role is attached, and the EC2 instance is launched with that profile. Option B is wrong because the role itself is not attached directly to the instance; the instance profile must be used. Option C is wrong because storing credentials on the instance is insecure. Option D is wrong because the instance profile is not just for the root user; the role is assumed automatically.

Answer

Create an instance profile and attach a policy to it, then launch the EC2 instance with the instance profile

Answer

Create an IAM role with the required policy, then attach the role directly to the EC2 instance during launch

Answer

Create an IAM user with programmatic access, store the access key in a secure S3 bucket, and have the EC2 instance retrieve the credentials at startup

Question 6

A company runs a containerized application on Amazon ECS with Fargate. The security team wants to ensure that the containers can only communicate with specific external APIs and not with other containers in the same task. Which security control should be applied?

Accepted Answer

Attach a security group to the ECS task with outbound rules allowing only the specific API endpoints.. Option D is correct because security groups for ECS tasks in awsvpc mode can control inbound/outbound traffic. Option A is wrong because IAM policies control API calls, not network traffic. Option B is wrong because network ACLs are stateless and applied at subnet level, not per task. Option C is wrong because VPC endpoints are for accessing AWS services, not for container communication.

Answer

Configure network ACLs on the subnets where the tasks run.

Answer

Apply an IAM policy to the task execution role to restrict API calls.

Answer

Use VPC endpoints to restrict traffic to specific APIs.

Question 7

A company uses AWS Organizations and wants to prevent any IAM user from creating access keys for a long period. Which SCP should be applied to the root OU to enforce that IAM users cannot create access keys unless explicitly allowed?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"iam:CreateAccessKey","Resource":"arn:aws:iam::*:user/*","Condition":{"StringNotEquals":{"aws:ResourceTag/purpose":"temporary"}}}]}. SCPs can deny actions. Option A is correct because it denies CreateAccessKey to all IAM users unless they have a specific tag. Option B allows all. Option C only prevents deletion. Option D allows creation.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"iam:CreateAccessKey","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"iam:DeleteAccessKey","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"iam:CreateAccessKey","Resource":"arn:aws:iam::*:user/*"}]}

Question 8

A company wants to allow an IAM user to manage only their own password in the AWS Management Console. Which IAM policy action should be used?

Accepted Answer

iam:ChangePassword. The correct action is iam:ChangePassword for changing the password and iam:GetAccountPasswordPolicy for viewing the password policy. Option C is correct because it allows the user to change their own password. Option A allows listing users, which is not needed. Option B allows deactivating MFA. Option D allows creating access keys, which is unrelated.

Answer

iam:ListUsers

Answer

iam:CreateAccessKey

Answer

iam:DeactivateMFADevice

Question 9

Which TWO actions can be used to restrict access to an S3 bucket to only users who authenticate using multi-factor authentication (MFA)? (Choose TWO.)

Accepted Answer

Use pre-signed URLs with MFA credentials. The correct answers are A and D. A bucket policy with a condition for aws:MultiFactorAuthPresent is the standard way to enforce MFA for S3 operations. Using pre-signed URLs with MFA can also enforce MFA for specific objects. Option B is wrong because IAM policies can enforce MFA but not at the bucket level. Option C is wrong because CloudTrail does not enforce MFA. Option E is wrong because S3 ACLs do not support conditions.

Answer

Use AWS CloudTrail to log requests and deny those without MFA

Answer

Set an S3 bucket ACL that requires MFA

Answer

Add a condition in the IAM policy that checks aws:MultiFactorAuthPresent is true

Question 10

An application running on an EC2 instance needs to access an S3 bucket. What is the most secure way to grant the EC2 instance the necessary permissions?

Accepted Answer

Create an IAM role with the necessary S3 permissions and attach it to the EC2 instance as an instance profile.. Option B is correct because an IAM instance profile is the recommended way to grant permissions to EC2 instances. Option A is wrong because storing credentials in the code is insecure. Option C is wrong because storing credentials in an encrypted file still requires managing keys. Option D is wrong because S3 bucket policies are not designed to grant permissions to EC2 instances directly.

Answer

Store the credentials in an encrypted file on the EC2 instance and decrypt them at runtime.

Answer

Store the AWS access key and secret key in the application code.

Answer

Use an S3 bucket policy that allows access from the EC2 instance's public IP address.

Question 11

An IAM policy attached to a user contains the above statements. The user attempts to download an object from 'example-bucket/confidential/report.pdf'. What is the result?

Accepted Answer

The download fails because the deny statement applies to the object.. The explicit deny on the confidential folder overrides the allow. Option A is incorrect because deny overrides. Option B is incorrect because the user is not an admin. Option D is incorrect because the deny is for the specific path.

Answer

The download fails because the user is not an administrator.

Answer

The download succeeds because the user can access other objects.

Answer

The download succeeds because the first statement allows GetObject.

Question 12

Which IAM entity can be used to delegate permissions to an AWS service to perform actions on your behalf?

Accepted Answer

Service role. A service role is an IAM role that a service assumes to perform actions on your behalf. Option A is correct. Option B is wrong because a service-linked role is a special type of service role, but not all service roles are service-linked. Option C is wrong because an instance profile is used for EC2. Option D is wrong because a permissions boundary is used to set maximum permissions.

Answer

Service-linked role

Answer

Instance profile

Answer

Permissions boundary

Question 13

An AWS Lambda function needs to read from a DynamoDB table. What is the best practice for granting the Lambda function the necessary permissions?

Accepted Answer

Create an IAM role with the necessary permissions and attach it as the Lambda function's execution role.. Option B is correct because attaching an execution role to the Lambda function is the standard and secure method. Option A is wrong because embedding credentials in the code is insecure. Option C is wrong because resource-based policies are not supported for Lambda functions to access DynamoDB. Option D is wrong because IAM users are not appropriate for service-to-service access.

Answer

Use a resource-based policy on the DynamoDB table to allow the Lambda function.

Answer

Create an IAM user with the necessary permissions and assign it to the Lambda function.

Answer

Embed the IAM user's access key and secret key in the Lambda function code.

Question 14

A security engineer needs to allow an IAM user to rotate their own access keys. Which TWO IAM actions must be allowed in the user's policy? (Choose TWO.)

Accepted Answer

iam:DeleteAccessKey. Option A and Option E are correct. To rotate access keys, the user needs to create a new key and delete the old one. Option B is wrong because UpdateAccessKey can change the status (Active/Inactive) but is not required for rotation. Option C is wrong because ListAccessKeys is not strictly necessary; it helps but is not required. Option D is wrong because GetAccessKeyLastUsed is not needed.

Answer

iam:GetAccessKeyLastUsed

Answer

iam:ListAccessKeys

Answer

iam:UpdateAccessKey

Question 15

A security engineer is designing IAM policies for a data analytics platform that uses Amazon S3, Amazon Athena, and AWS Glue. The platform must allow data scientists to query data in S3 using Athena, but only from specific VPC subnets. Additionally, the data must be encrypted at rest using AWS KMS. Which TWO actions should the engineer take to meet these requirements? (Choose TWO.)

Accepted Answer

Grant kms:Decrypt permission in the IAM policy and configure the KMS key policy to allow the IAM role to use the key.. A: Correct – Using a VPC endpoint for Athena with a bucket policy that restricts access to the VPC endpoint ensures that queries are only allowed from the specified VPC subnets. D: Correct – Granting kms:Decrypt permission in the IAM policy and ensuring the KMS key policy allows the IAM role enables Athena to decrypt S3 objects encrypted with a customer-managed KMS key. B: Incorrect – The s3:SourceIp condition key does not work for VPC endpoints; use aws:SourceVpce instead. C: Incorrect – The kms:EncryptionContext condition is not used for restricting encryption at rest; it is used for encryption context in KMS operations. E: Incorrect – S3 default encryption (SSE-S3) does not use KMS, so the KMS key policy would not be relevant.

Answer

Add kms:EncryptionContext condition to the IAM policy to require a specific encryption context.

Answer

Use the s3:SourceIp condition key in the IAM policy to restrict access to the private IP ranges of the VPC subnets.

Answer

Enable default encryption on the S3 bucket using SSE-S3 and configure the KMS key policy to allow the IAM role.

Question 16

A security engineer needs to grant cross-account access to an S3 bucket in Account A to a role in Account B. Which combination of IAM entities must be configured?

Accepted Answer

IAM role in Account A with trust policy for Account B. Cross-account access requires an IAM role in the trusting account (Account A) with a trust policy that allows the trusted account (Account B) to assume it, and an IAM policy in Account B that allows the user or role to call sts:AssumeRole. Option C is correct. Option A is wrong because the bucket policy alone is not sufficient; the role must also allow the action. Option B is wrong because the role is in Account A, not Account B. Option D is wrong because an IAM user in Account B cannot directly access a role in Account A without assuming it.

Answer

Bucket policy in Account A and IAM user policy in Account B

Answer

IAM role in Account B with trust policy for Account A

Answer

IAM user in Account B with permissions to the bucket

Question 17

Which THREE statements about IAM roles are correct? (Choose THREE.)

Accepted Answer

IAM roles can be used by federated users.. The correct answers are A, B, and D. IAM roles are global and not region-specific, can be assumed by AWS services, and can be used by federated users. Option C is wrong because roles cannot be attached to IAM users directly; users assume roles. Option E is wrong because roles can be used by cross-account access.

Answer

IAM roles cannot be used for cross-account access.

Answer

IAM roles can be attached to an IAM user.

Question 18

A security team needs to audit all changes to IAM resources in their AWS account. Which AWS service should they use?

Accepted Answer

AWS CloudTrail. Option C is correct because AWS CloudTrail records API calls, including IAM changes. Option A is wrong because AWS Config records resource configurations but not all API calls. Option B is wrong because CloudWatch Logs stores logs but does not capture API calls by default. Option D is wrong because VPC Flow Logs capture network traffic, not IAM changes.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 19

A security engineer notices that an IAM user has permissions to create new IAM users and attach policies. What is the most effective way to detect if this user created a backdoor user?

Accepted Answer

Enable AWS CloudTrail and monitor IAM events using Amazon CloudWatch Logs and create a metric filter for CreateUser and AttachUserPolicy events.. Option A is correct because AWS CloudTrail logs all IAM API calls, enabling detection of user creation and policy attachment. Option B is wrong because IAM Access Analyzer focuses on resource policies, not user actions. Option C is wrong because AWS Config rules evaluate resource configurations, not API calls. Option D is wrong because S3 server access logs track object-level access, not IAM actions.

Answer

Review S3 access logs for any PutObject calls from the IAM user.

Answer

Use IAM Access Analyzer to review all IAM policies for potential backdoor access.

Answer

Configure an AWS Config rule to check for IAM users with administrative policies.

Question 20

A company uses AWS Organizations and wants to restrict all IAM users in all accounts from using the AWS Management Console. What is the most effective way to achieve this?

Accepted Answer

Create an SCP with a condition that denies access if the user is signing in using the AWS Management Console.. Option A is correct because an SCP can deny console access for all users across all accounts. Option B is wrong because it only applies to the root user. Option C is wrong because IAM policies are per-account and can be overridden by administrators. Option D is wrong because password policies do not prevent console access if the user has a password.

Answer

Set an IAM password policy that requires strong passwords.

Answer

Create a service control policy (SCP) that denies the 'iam:CreateLoginProfile' action and attach it to all accounts.

Answer

Create an SCP that denies the 'aws:RequestedRegion' condition for us-east-1.