SCS-C02 Practice Exam 62 — 20 Questions

Question 1

Refer to the exhibit. An IAM user has this policy attached. The user tries to download an object from the S3 bucket using the AWS CLI from an on-premises server with IP address 198.51.100.50. What will happen?

Accepted Answer

The request will fail because the user's IP is not in the allowed range.. Option D is correct because the policy allows s3:GetObject only if the request comes from the specified IP range. Since the user's IP is outside that range, the request will be denied. Option A is wrong because the policy does not allow all IPs. Option B is wrong because there is no requirement for MFA. Option C is wrong because the policy does not require HTTPS; it only checks IP.

Answer

The request will succeed because the policy allows s3:GetObject.

Answer

The request will fail because the user must use HTTPS.

Answer

The request will fail because the user must use MFA.

Question 2

An IAM policy includes: { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/MyRole" }. What does this allow?

Accepted Answer

Allows the user to pass the role MyRole to an AWS service like Lambda.. Option C is correct because PassRole allows passing a role to an AWS service. Option A is wrong because it's not about assuming. Option B is wrong because it's not about creating. Option D is wrong because it's not about attaching to users.

Answer

Allows the user to create the role MyRole.

Answer

Allows the user to assume the role MyRole.

Answer

Allows the user to attach the role to an IAM user.

Question 3

Refer to the exhibit. An IAM policy is attached to a group. A user in the group accesses the S3 bucket from an IP address 203.0.113.5 using HTTPS. What will be the result?

Accepted Answer

The user will be denied access because the source IP is not in the allowed ranges.. Option D is correct. The policy allows only from 192.0.2.0/24 and 198.51.100.0/24. The user's IP 203.0.113.5 does not match, so access is denied even though HTTPS is used. Option A is wrong because the IP is not within allowed ranges. Option B is wrong because the condition is AND; all conditions must be met. Option C is wrong because the action is explicitly allowed only under conditions.

Answer

The user can access objects because an Allow with conditions grants access by default.

Answer

The user will be denied access because the policy does not allow the action explicitly.

Answer

The user can access objects because the condition for SecureTransport is met.

Question 4

Refer to the exhibit. This trust policy is attached to an IAM role. What does it allow?

Accepted Answer

The root user of account 123456789012 to assume the role only if MFA is present.. Option D is correct because the trust policy allows the root user of account 123456789012 to assume the role only if MFA is present. Option A is wrong because it requires MFA. Option B is wrong because it allows the root user, not all users. Option C is wrong because it allows the root user, not specific users.

Answer

All IAM users in account 123456789012 to assume the role with MFA.

Answer

The root user of account 123456789012 to assume the role without MFA.

Answer

Any user in account 123456789012 to assume the role without MFA.

Question 5

A company uses AWS Organizations with SCPs. The SCP for the production OU denies all actions on DynamoDB. An IAM policy attached to a user in that OU allows dynamodb:PutItem. What is the effective access?

Accepted Answer

The user cannot perform PutItem because the SCP denies all DynamoDB actions and IAM allows are overridden.. Option D is correct because SCPs are deny-by-default; they override any allow in IAM policies. Option A is wrong because SCPs apply to all principals. Option B is wrong because explicit deny in SCP overrides allow. Option C is wrong because the SCP applies to the user.

Answer

The user can perform PutItem because the IAM policy allows it.

Answer

The user cannot perform PutItem because the SCP applies only to the root account.

Answer

The user can perform PutItem only if the SCP has an explicit allow.

Question 6

A company wants to grant temporary credentials to mobile app users to access their own data in an S3 bucket. Which AWS service should be used to achieve this securely?

Accepted Answer

Amazon Cognito identity pools. Option A is correct because Cognito Identity Pools can issue temporary AWS credentials for authenticated users. Option B is wrong because IAM users are not suitable for millions of mobile users. Option C is wrong because KMS is for encryption keys. Option D is wrong because CloudFront is a CDN, not for issuing credentials.

Answer

AWS Key Management Service (KMS)

Answer

IAM users with long-term access keys

Answer

Amazon CloudFront signed URLs

Question 7

A developer needs to access an S3 bucket from an EC2 instance. The developer creates an IAM role with the necessary S3 permissions and attaches it to the instance profile. However, applications running on the instance can still not access the bucket. What is the most likely cause?

Accepted Answer

The IAM role is not attached to the EC2 instance's instance profile.. Option C is correct because the instance profile must be associated with the EC2 instance at launch or by attaching the profile. Option A is wrong because instance metadata is used by the AWS CLI to obtain credentials. Option B is wrong because a bucket policy with a condition for a specific principal is not required. Option D is wrong because the IAM role can be attached to an existing instance via the instance profile.

Answer

The IAM role cannot be attached after the EC2 instance is launched.

Answer

The instance metadata service is disabled on the EC2 instance.

Answer

The S3 bucket policy does not explicitly grant access to the IAM role.

Question 8

A security engineer notices that a developer's IAM user has full administrator access. The engineer wants to implement the principle of least privilege for the developer. What is the best way to proceed?

Accepted Answer

Use IAM Access Advisor to review the developer's historical usage and create a custom policy that only includes the services and actions used.. Option B is correct because starting with a minimal set of permissions and gradually adding based on actual usage is the principle of least privilege. Option A is wrong because using the managed policy for job function may grant more permissions than needed. Option C is wrong because removing administrative access without providing alternative permissions would break the developer's work. Option D is wrong because IAM Access Analyzer helps analyze existing policies but does not provide automated least privilege.

Answer

Create a new IAM group with the AdministratorAccess policy and add the developer to the group.

Answer

Replace the AdministratorAccess policy with a managed job function policy such as PowerUserAccess.

Answer

Remove the administrative access and ask the developer to request permissions as needed.

Question 9

A company wants to allow an external auditor to read all objects in a specific S3 bucket for a limited time. What is the most secure way to grant this access?

Accepted Answer

Generate pre-signed URLs for the objects the auditor needs to read, with an expiration time.. Option C is correct because a pre-signed URL can grant temporary access to specific objects, and the URL can have an expiration time. Option A is wrong because making the bucket public is not secure. Option B is wrong because creating an IAM user for the auditor and sharing credentials is not ideal for external parties. Option D is wrong because a bucket policy with a condition for a specific IP address is an option but requires the auditor's IP and may not be as granular.

Answer

Use a bucket policy that allows access only from the auditor's IP address.

Answer

Make the bucket public and restrict access via IP address in the bucket policy.

Answer

Create an IAM user for the auditor with read-only access to the bucket and share the access keys.

Question 10

A security engineer needs to grant an IAM user in Account A (111111111111) access to an S3 bucket in Account B (222222222222). The bucket policy in Account B allows cross-account access from Account A. Which additional step is required?

Accepted Answer

Attach an IAM policy to the IAM user in Account A granting s3:GetObject on the bucket.. Option B is correct because cross-account access requires both a resource-based policy (bucket policy) and a permissions policy in the requesting account. Option A is wrong because you cannot attach a bucket policy to a user. Option C is wrong because S3 access points are not required. Option D is wrong because cross-account roles are an alternative, but the IAM user policy is the standard approach when using resource-based policies.

Answer

Create a cross-account role in Account B and have the user assume it.

Answer

Attach the bucket policy to the IAM user in Account A.

Answer

Create an S3 access point in Account B and grant the IAM user access.

Question 11

A security engineer is troubleshooting an issue where an IAM user cannot assume a role in another AWS account. The trust policy of the role allows the user's account to assume the role, and the user has a policy that allows sts:AssumeRole. The user receives an error: 'Access denied: User is not authorized to perform sts:AssumeRole.' What is the MOST likely cause?

Accepted Answer

The user's policy does not specify the resource ARN of the role.. Option C is correct because if the user's IAM policy does not explicitly allow the specific role ARN, sts:AssumeRole will fail. Option A is wrong because external ID is optional unless required by the trust policy. Option B is wrong because MFA is not required unless the policy specifies it. Option D is wrong because the trust policy already allows the account.

Answer

The role requires an external ID that the user did not provide.

Answer

The user must use multi-factor authentication (MFA).

Answer

The trust policy does not include the user's IAM user ARN.

Question 12

A developer is trying to use the AWS CLI to list objects in an S3 bucket but receives an AccessDenied error. The developer has an IAM user with a policy that allows s3:ListBucket on the bucket. What could be causing the error?

Accepted Answer

The S3 bucket has a bucket policy that denies access to the developer's IAM user.. Option A is correct because even if the IAM policy allows the action, the bucket policy may explicitly deny access. Option B is wrong because MFA is not required unless a condition exists. Option C is wrong because the developer can have multiple policies that combine. Option D is wrong because the bucket exists if the error is AccessDenied.

Answer

The developer has not enabled MFA on their IAM user.

Answer

The S3 bucket does not exist in the same AWS region as the CLI is configured.

Answer

The IAM policy is attached to a group, not directly to the user.

Question 13

A company wants to allow an IAM role from Account A to access an S3 bucket in Account B. Which THREE conditions must be met?

Accepted Answer

The S3 bucket policy in Account B must grant access to the IAM role in Account A.. Option A, C, and E are correct. Option A: the role must have a trust policy allowing the bucket's account to assume it? Actually, the role is in Account A, and the bucket in Account B. The role needs to be allowed by the bucket policy. So option A is incorrect: the bucket policy in Account B must allow the IAM role. Option B is correct? Let's re-evaluate: To grant cross-account access to an S3 bucket, the bucket policy in Account B must grant access to the IAM role in Account A. The IAM role in Account A must have a permissions policy that allows S3 actions, but the trust policy on the role is not needed for S3 access because S3 uses resource-based policies. So the correct conditions are: Option B: IAM role in Account A must have a permissions policy allowing S3 actions. Option C: S3 bucket policy in Account B must grant access to the IAM role. Option E: The IAM role must be assumed by a user or service in Account A. So the correct combination is B, C, E. Option A is incorrect because trust policy is for the role to be assumed by another account, not for S3 access. Option D is incorrect because an SCP could deny but is not required.

Answer

The IAM role in Account A must have a trust policy that allows the S3 bucket's account to assume the role.

Answer

A service control policy (SCP) must allow the cross-account access.

Question 14

Which IAM feature allows you to grant temporary, limited-privilege credentials for a specific role?

Accepted Answer

AWS STS. Option A is correct because STS is used for temporary credentials. Option B is wrong because IAM roles are the entity, not the feature. Option C is wrong because SCPs are for Organizations. Option D is wrong because resource-based policies are for granting to other accounts.

Answer

Resource-based policies

Answer

IAM roles

Answer

Service control policies

Question 15

A company has an S3 bucket with a bucket policy that allows access to a specific IAM role. However, users assume the role but still get access denied. Which THREE factors could cause this?

Accepted Answer

A service control policy (SCP) denies the required actions.. Options B, C, and D are correct. B: The bucket policy must explicitly allow the role, and if it refers to a user instead, it will fail. C: If the role's trust policy does not allow the user's account, the role cannot be assumed. D: A service control policy (SCP) can block access even if IAM allows. Option A is wrong because the bucket policy does not need the role's trust policy. Option E is wrong because bucket policies do not have condition key for role session name.

Answer

The bucket policy does not reference the role's trust policy.

Answer

The bucket policy has a condition on aws:RoleSessionName that does not match.

Question 16

A company wants to grant cross-account access to an S3 bucket. The bucket policy allows access from account 111111111111. An IAM user in account 111111111111 has a policy allowing s3:GetObject on that bucket. However, the user gets AccessDenied. What is the most likely reason?

Accepted Answer

The bucket policy grants access to the account, but the IAM user's ARN is not explicitly listed.. Option A is correct because the S3 bucket policy must explicitly grant access to the IAM user ARN, not just the account. Option B is wrong because explicit deny in the IAM policy would be unusual. Option C is wrong because S3 does not require VPC endpoints. Option D is wrong because the user is in the same account as the policy.

Answer

The S3 bucket is in a different region and requires a VPC endpoint.

Answer

The IAM user policy is attached to a group, not directly to the user.

Answer

The IAM user policy has an explicit deny for s3:GetObject.

Question 17

A security engineer needs to restrict access to an S3 bucket so that only requests from a specific VPC are allowed. Which TWO steps are required?

Accepted Answer

Add a bucket policy that denies access unless the request source VPC endpoint matches the created endpoint.. Options B and D are correct. B: Create a VPC endpoint for S3 and attach it to the VPC. D: Add a bucket policy that denies access unless the request comes from the VPC endpoint. Option A is wrong because a bucket policy can reference the VPC endpoint. Option C is wrong because a VPC endpoint policy is not required; the bucket policy can enforce the condition. Option E is wrong because bucket policies do not have condition keys for VPC ID directly.

Answer

Add a bucket policy with aws:SourceVpc condition.

Answer

Attach a VPC endpoint policy that allows the required actions.

Answer

Create a bucket policy that allows access from the VPC ID.

Question 18

A security engineer is designing a CI/CD pipeline that deploys AWS infrastructure using AWS CloudFormation. The pipeline must assume an IAM role in each target account to create and update stacks. Which TWO steps are required to allow cross-account access for CloudFormation? (Choose TWO.)

Accepted Answer

Use AWS STS AssumeRole in the pipeline to obtain temporary credentials for the target account role.. Option A is correct because the IAM role in the target account must have a trust policy that allows the pipeline account to assume it. Option D is correct because the pipeline (using AWS CodeBuild or similar) must call STS AssumeRole with the role ARN. Option B is wrong because CloudFormation itself does not assume roles for stack operations; the entity calling CloudFormation assumes the role. Option C is wrong because the pipeline's role does not need a trust policy for the target account. Option E is wrong because cross-account role assumption does not require root user credentials.

Answer

Create a service role for CloudFormation in the pipeline account with a trust policy for the target account.

Answer

Store the target account root credentials in AWS Secrets Manager and retrieve them in the pipeline.

Answer

Configure the pipeline's IAM role with a trust policy that allows the target account to access it.

Question 19

A company uses S3 to store sensitive customer data. The security team requires that all objects uploaded to S3 be encrypted at rest using server-side encryption with AWS KMS managed keys (SSE-KMS). A developer reports that some objects are being stored unencrypted. What is the MOST effective way to enforce this requirement?

Accepted Answer

Use a bucket policy to deny s3:PutObject if encryption is not set to aws:kms. Option D is correct because an S3 bucket policy with a Deny condition for s3:PutObject without the x-amz-server-side-encryption header set to aws:kms will block unencrypted uploads. Option A is wrong because SSE-C uses customer-provided keys, not KMS. Option B is wrong because bucket policies are more direct than service control policies for this. Option C is wrong because default encryption only applies when no encryption is specified, but a PUT request can still override it.

Answer

Enable default encryption on the bucket using SSE-S3

Answer

Use an SCP to deny s3:PutObject without encryption

Answer

Set a bucket policy to require the x-amz-server-side-encryption header

Question 20

A company has a requirement to automatically rotate encryption keys for S3 objects every 90 days. They are using SSE-KMS with a customer managed key. Which combination of actions will meet the requirement without breaking access to existing objects? (Choose two.)

Accepted Answer

Use S3 Batch Operations to re-encrypt existing objects with the new key. Options A and D are correct because enabling automatic key rotation in KMS rotates the key material annually (but not 90 days), and re-encrypting existing objects with the new key ensures they are encrypted with the latest key. Option B is incorrect because deleting the old key breaks access. Option C is incorrect because S3 does not automatically re-encrypt. Option E is incorrect because manual rotation every 90 days is not necessary if automatic rotation is enabled, and re-encryption is needed.

Answer

Configure an S3 lifecycle policy to re-encrypt objects

Answer

Manually rotate the key every 90 days and re-encrypt all objects

Answer

Delete the existing key and create a new one each 90 days

SCS-C02 Practice Exam 62 — 20 Questions

Exhibit

SCS-C02 Practice Exam 62 — 20 Questions

Exhibit