SCS-C02 Practice Exam 59 — 20 Questions

Question 1

Refer to the exhibit. An IAM policy is attached to a user. The user is trying to download an object from 'example-bucket' from an IP address of 10.1.1.1. What will happen?

Accepted Answer

Access is denied because the IP address is not in the allowed range. Option B is correct because the condition restricts access to the IP range 10.0.0.0/16, and the user's IP is outside that range, so access is denied by default. Option A is incorrect because the condition is evaluated. Option C is incorrect because there is no explicit deny. Option D is incorrect because the condition key is valid.

Answer

Access is denied because the policy does not include an explicit deny

Answer

Access is allowed because the condition key is misspelled

Answer

Access is allowed because the policy allows s3:GetObject

Question 2

A company has an S3 bucket with a bucket policy that grants access to a specific IAM role. The role is used by an application running on an EC2 instance. The application is unable to access the bucket, but the role can access other resources. What is the most likely cause?

Accepted Answer

The EC2 instance does not have an instance profile associated with the role. Option A is correct because an EC2 instance profile is required to provide the role to the instance. Option B is incorrect because the role can access other resources, so the trust policy is likely correct. Option C is incorrect because the bucket policy is not denying access, it's granting. Option D is incorrect because SCPs are not mentioned.

Answer

A service control policy (SCP) denies access to the bucket

Answer

The bucket policy denies access to the role

Answer

The role's trust policy does not allow EC2 to assume the role

Question 3

A security engineer needs to design an IAM policy that allows an IAM user to launch EC2 instances only if they specify a specific security group ID (sg-12345) and a specific instance type (t2.micro). Which policy achieves this?

Accepted Answer

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:RunInstances",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "ec2:InstanceType": "t2.micro",
          "ec2:SecurityGroup": "sg-12345"
        }
      }
    }
  ]
}. Option B is correct because it uses condition keys ec2:InstanceType and ec2:SecurityGroup to restrict the RunInstances action. Option A does not restrict instance type. Option C uses the wrong condition key for security group. Option D uses RequestTag but security group is not a tag.

Answer

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:RunInstances",
      "Resource": "arn:aws:ec2:*:*:security-group/sg-12345",
      "Condition": {
        "StringEquals": { "ec2:InstanceType": "t2.micro" }
      }
    }
  ]
}

Answer

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:RunInstances",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "ec2:InstanceType": "t2.micro",
          "aws:RequestTag/security-group": "sg-12345"
        }
      }
    }
  ]
}

Answer

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:RunInstances",
      "Resource": "*",
      "Condition": {
        "StringEquals": { "ec2:InstanceType": "t2.micro" }
      }
    }
  ]
}

Question 4

A developer is trying to push an image to Amazon ECR but receives an 'AccessDeniedException' error. The developer's IAM user has the 'AmazonEC2ContainerRegistryPowerUser' managed policy attached. What is the most likely reason for the failure?

Accepted Answer

The developer needs to call 'ecr:GetAuthorizationToken' and authenticate to the registry.. Option B is correct because ECR requires authentication via 'ecr:GetAuthorizationToken' which is not included in the PowerUser policy. Option A is wrong because the error is not about resource policy. Option C is wrong because the error is access denied, not unsupported media type. Option D is wrong because the error is not about image size.

Answer

The developer is pushing from an unsupported region.

Answer

The ECR repository has a resource policy that denies the push.

Answer

The image is too large for ECR.

Question 5

A company has an S3 bucket with a bucket policy that grants access to an IAM role. The security team wants to restrict access to only requests that originate from the company's VPC. How can this be achieved?

Accepted Answer

Add a condition in the bucket policy using aws:SourceVpce with the VPC endpoint ID.. Option A is correct: use a VPC endpoint and the aws:SourceVpce condition. Option B is wrong because aws:SourceIp is not effective for VPC traffic from S3. Option C is wrong because the condition is on the bucket policy, not the role policy. Option D is wrong because allowing only specific instances is not granular.

Answer

Create a new IAM role that can only be assumed by instances in the VPC.

Answer

Add a condition in the IAM role policy using aws:SourceVpce.

Answer

Add a condition in the bucket policy using aws:SourceIp with the VPC CIDR range.

Question 6

Refer to the exhibit. A security engineer runs the 'simulate-custom-policy' command to test a policy. The output shows 'explicitDeny' for ec2:RunInstances. What is the most likely reason?

Accepted Answer

The policy does not include ec2:RunInstances in the Action list. Option A is correct because the policy only allows Describe actions, and RunInstances is not allowed, resulting in an explicit deny from the simulation. Option B is incorrect because the policy does not deny. Option C is incorrect because the policy allows Describe* but not RunInstances. Option D is incorrect because there is no resource restriction.

Answer

The policy includes an explicit Deny statement for ec2:RunInstances

Answer

The policy allows ec2:Describe* but the action ec2:RunInstances is not a Describe action

Answer

The policy uses a Resource of '*' which does not include the required resources

Question 7

A developer is trying to upload a file to an S3 bucket using the AWS CLI, but receives an 'AccessDenied' error. The IAM policy attached to the user includes 's3:PutObject' on the bucket. The bucket policy has a Deny statement with the condition 'aws:Referer': ['example.com']. The CLI command does not include a referer header. What is the cause of the error?

Accepted Answer

The bucket policy denies requests that do not include the required referer header.. Option B is correct because the Deny statement with a condition that does not match the request (no referer header) still denies the request if the condition is not met? Actually, the Deny statement with a condition only denies if the condition evaluates to true. Since the request has no referer, the condition 'StringNotEquals'? Wait, typical bucket policy is: Deny unless referer equals example.com. But if the request has no referer, the condition fails, so the Deny does not apply. However, the error persists. Possibly the bucket policy has an explicit Deny for all requests without the referer. In that case, the Deny applies. So Option B is correct: the Deny is blocking requests without the referer. Option A is wrong because CLI uses HTTPS. Option C is irrelevant. Option D is not the cause.

Answer

The user’s access keys are expired.

Answer

The IAM policy does not include s3:PutObjectAcl.

Answer

The CLI is not using HTTPS.

Question 8

Refer to the exhibit. An IAM user has this policy attached. Can the user create a new IAM user in the us-east-1 region?

Accepted Answer

No, because the Deny statement blocks all IAM actions in us-east-1.. Option C is correct. The Deny statement applies to all IAM actions in us-east-1, which overrides the Allow for CreateUser. Since the Deny is explicit, it blocks the action even though there is an Allow. The request fails.

Answer

Yes, because the Allow statement explicitly permits CreateUser.

Answer

No, because IAM is a global service and region conditions do not apply.

Answer

Yes, because the Deny only applies to us-east-1.

Question 9

An organization wants to enforce multi-factor authentication (MFA) for all IAM users who perform sensitive actions. Which condition key should be used in an IAM policy to require MFA?

Accepted Answer

aws:MultiFactorAuthPresent. Option B is correct: aws:MultiFactorAuthPresent is the condition key. Option A is wrong because it checks the time. Option C is wrong because it checks the user agent. Option D is wrong because it checks the source IP.

Answer

aws:SourceIp

Answer

aws:UserAgent

Answer

aws:CurrentTime

Question 10

A company needs to provide temporary credentials to mobile app users to access AWS resources. Which AWS service should be used to issue these credentials?

Accepted Answer

AWS Security Token Service (STS). Option B is correct because AWS STS is used to issue temporary credentials. Option A is incorrect because IAM is for managing users and roles, not issuing temporary credentials. Option C is incorrect because AWS Cognito is for identity pools but uses STS internally; the direct service is STS. Option D is incorrect because AWS KMS is for encryption keys.

Answer

AWS IAM

Answer

AWS Cognito

Answer

AWS Key Management Service (KMS)

Question 11

A developer needs to grant an EC2 instance read-only access to an S3 bucket. Which of the following is the most secure way to provide these permissions?

Accepted Answer

Create an IAM role with read-only access and attach it to the EC2 instance profile.. Option B is correct because an IAM role attached to the EC2 instance via instance profile avoids long-term credentials. Option A is wrong because storing access keys on the instance is less secure. Option C is wrong because a bucket policy grants access to all principals, not just the instance. Option D is wrong because storing keys in SSM Parameter Store still exposes credentials to the instance.

Answer

Use an IAM role and store the credentials in AWS Systems Manager Parameter Store, then retrieve them at instance launch.

Answer

Create a bucket policy that grants read-only access to the instance's public IP address.

Answer

Create an IAM user with read-only access and store the access keys in the instance's user data.

Question 12

An organization uses AWS KMS to encrypt S3 objects. They want to allow a developer to decrypt objects only if the request comes from a specific IP address range. Which IAM policy condition should be used?

Accepted Answer

Condition with kms:ViaService and aws:SourceIp.. Option A is correct because kms:ViaService condition ensures the request goes through S3, and aws:SourceIp restricts IP. Option B is wrong because kms:EncryptionContext is for encryption context, not IP. Option C is wrong because kms:CallerAccount is for account, not IP. Option D is wrong because kms:GrantOperations is for grants, not IP.

Answer

Condition with kms:GrantOperations and aws:SourceIp.

Answer

Condition with kms:CallerAccount and aws:SourceIp.

Answer

Condition with kms:EncryptionContext and aws:SourceIp.

Question 13

A security engineer is configuring a VPC endpoint for Amazon S3 and wants to ensure that only traffic from specific IAM roles can access the S3 bucket through the endpoint. Which policy element should the engineer use?

Accepted Answer

aws:PrincipalArn. Option A is correct because VPC endpoint policies can use 'aws:PrincipalArn' condition to restrict access to specific IAM roles. Option B is wrong because 'aws:SourceVpc' restricts to a specific VPC, not IAM role. Option C is wrong because 'aws:SourceVpce' restricts to a specific endpoint, not role. Option D is wrong because 'aws:username' is for IAM users, not roles.

Answer

aws:SourceVpc

Answer

aws:username

Answer

aws:SourceVpce

Question 14

An IAM policy includes the following statement: 'Effect': 'Deny', 'Action': 's3:*', 'Resource': '*', 'Condition': {'Bool': {'aws:SecureTransport': 'false'}}. What does this policy do?

Accepted Answer

Denies all S3 actions when the request is not using HTTPS.. Option D is correct because the policy denies all S3 actions when the request is not using HTTPS. Option A is wrong because it denies, not allows. Option B is wrong because it denies all S3 actions, not just certain ones. Option C is wrong because it denies all S3 actions, not just to a specific bucket.

Answer

Denies all S3 actions to a specific bucket.

Answer

Denies all S3 actions for all users.

Answer

Allows all S3 actions only when using HTTPS.

Question 15

Which TWO actions are valid ways to grant an IAM user access to an S3 bucket owned by another AWS account? (Choose TWO.)

Accepted Answer

Have the user assume an IAM role in the bucket-owning account with appropriate permissions.. Correct answers are B and C. Bucket policies allow cross-account access when the bucket policy grants access to the user's account, and the user must have explicit permission. ACLs are legacy but can grant cross-account access. Role assumption is also valid.

Answer

Attach an IAM policy to the user in their own account allowing access to the bucket.

Answer

Add the user's ARN to the bucket's ACL.

Answer

Use an S3 access point with a policy that allows the user.

Question 16

A company needs to implement a cross-account access strategy where users in Account A can assume a role in Account B. Which TWO steps are necessary? (Choose TWO.)

Accepted Answer

Attach an IAM policy to the users or groups in Account A that allows sts:AssumeRole targeting the role ARN in Account B.. Options A and D are correct: the trust policy in Account B allows Account A to assume the role, and users in Account A need permission to call sts:AssumeRole. Option B is unnecessary. Option C is for resource-based policies. Option E is not required.

Answer

Create an IAM user in Account B with the same name as the users in Account A.

Answer

Enable MFA for all users in Account A.

Answer

Attach a resource-based policy to the IAM role in Account B.

Question 17

A company has an S3 bucket with a bucket policy that grants access to an IAM role used by an application running on EC2. The application is unable to read objects from the bucket, even though the IAM role has the necessary permissions. What is the most likely cause?

Accepted Answer

The bucket policy denies access to the IAM role.. Option C is correct because S3 bucket policies and IAM policies must both allow access; if either denies, access is denied. Option A is wrong because explicit deny overrides allow, but the bucket policy might not have an explicit deny. Option B is wrong because the bucket policy might not allow the role. Option D is wrong because service control policies apply at organization level, not directly.

Answer

The bucket is in a different AWS account.

Answer

The bucket policy does not explicitly allow the IAM role.

Answer

The IAM role has an explicit deny statement.

Question 18

A company has a requirement that all IAM users must use multi-factor authentication (MFA) to access the AWS Management Console. Which TWO steps should the company take to enforce this?

Accepted Answer

Enable MFA devices for each IAM user.. Option A and D are correct. Option A: enabling MFA on each user is the first step. Option D: an IAM policy with a condition for aws:MultiFactorAuthPresent denies access if MFA is not present. Option B is wrong because the root user should not be used for daily tasks. Option C is wrong because password policy does not force MFA. Option E is wrong because SCPs do not enforce MFA at the user level.

Answer

Use a service control policy (SCP) to require MFA for all users.

Answer

Enable MFA for the root user only.

Answer

Configure an IAM password policy that requires MFA.

Question 19

A security engineer discovers that an IAM policy allows 'iam:CreateUser' and 'iam:CreateAccessKey' for all users in the account. Which risk does this pose?

Accepted Answer

Users can create new IAM users and programmatic access keys. Option C is correct because creating access keys allows programmatic access, and creating users allows creation of new identities. Option A is incorrect because it does not directly affect logging. Option B is incorrect because it does not directly affect encryption. Option D is incorrect because it does not directly affect network traffic.

Answer

Users can disable CloudTrail logging

Answer

Users can decrypt data in S3

Answer

Users can modify VPC security groups

Question 20

An IAM policy grants access to a DynamoDB table with a condition that the request must originate from a specific VPC endpoint. However, requests from an EC2 instance in that VPC are being denied. What is the most likely cause?

Accepted Answer

The EC2 instance is not using the VPC endpoint to access DynamoDB; it is using an internet gateway.. Option A is correct because the EC2 instance needs to have a route to the VPC endpoint; if not, traffic goes through the internet and doesn't use the endpoint. Option B is wrong because the instance does not need a public IP. Option C is wrong because the endpoint policy must allow the action. Option D is wrong because security groups control network traffic, not IAM conditions.

Answer

The EC2 instance does not have a public IP address.

Answer

The security group on the EC2 instance does not allow outbound traffic to the DynamoDB endpoint.

Answer

The VPC endpoint policy does not allow the specific DynamoDB action.

SCS-C02 Practice Exam 59 — 20 Questions

Exhibit

SCS-C02 Practice Exam 59 — 20 Questions

Exhibit