SCS-C02 Identity and Access Management — 20 Questions

Question 1

A security engineer notices that an IAM role has a trust policy allowing any AWS account to assume it. Which attack is this misconfiguration most likely to enable?

Accepted Answer

Unauthorized access by an external attacker. An IAM role trust policy that allows any AWS account (i.e., `"Principal": {"AWS": "*"}`) to assume the role means that any user or service in any AWS account can call the STS `AssumeRole` API to obtain temporary credentials for the role. This directly enables unauthorized access by an external attacker who can discover the role ARN and assume it, gaining all permissions attached to the role.

Answer

Logging bypass via CloudTrail

Answer

Cross-service confused deputy attack

Answer

Privilege escalation by attaching additional policies

Question 2

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all IAM users in the production account must use multi-factor authentication (MFA) to access the AWS Management Console. Which combination of actions should the security team take to enforce this requirement?

Accepted Answer

Create an IAM policy that denies all console actions unless MFA is present. Attach the policy to the IAM group that contains all production users.. An IAM policy with a condition that denies all console actions unless MFA is present can be attached to an IAM group containing all production users. This enforces MFA at the user level within the account, directly meeting the requirement to ensure all IAM users in the production account must use MFA to access the AWS Management Console.

Answer

Use an SCP to deny access to the AWS Management Console unless MFA is present. Attach the SCP to the production OU.

Answer

Disable password-based access for all IAM users and require federation with an identity provider that enforces MFA.

Answer

Enable MFA on the root user and apply a password policy that requires MFA.

Question 3

A developer is trying to upload an object to an S3 bucket named 'my-bucket' using the AWS CLI. The developer has an IAM user with a policy that includes 's3:PutObject' for 'arn:aws:s3:::my-bucket/*'. However, the upload fails with an 'Access Denied' error. The bucket policy is set to allow all principals from the same AWS account to perform 's3:PutObject'. What is the most likely cause of this failure?

Accepted Answer

The bucket policy denies access because the principal is not explicitly listed.. The IAM user has s3:PutObject permission on the bucket's objects (/*), so option A is incorrect. Option C is incorrect because s3:PutObject is always applied to the object resource (e.g., bucket-name/*); no upload operation requires the same permission on the bucket itself. Option D is incorrect because a region mismatch would result in a NoSuchBucket error, not Access Denied. Option B is correct because the bucket policy, though intended to allow all principals from the same AWS account, typically specifies the AWS account root principal (e.g., "arn:aws:iam::account-id:root"). This principal only grants access to the root user, not to IAM users. Since the IAM user is not an explicitly listed principal, the request is implicitly denied, resulting in the Access Denied error.

Answer

The IAM user is not authorized to perform 's3:PutObject' on the bucket 'my-bucket'.

Answer

The IAM policy grants 's3:PutObject' only on objects (/*), but the request may also require 's3:PutObject' on the bucket itself for some operations.

Answer

The bucket 'my-bucket' does not exist in the same region as the CLI request.

Question 4

A company has a single AWS account with multiple IAM users. The administrator created an IAM policy that allows all users to launch EC2 instances, but only if they use a specific AMI ID (ami-12345678) and a specific instance type (t3.micro). The policy uses a condition that checks the EC2 instance type and AMI ID. However, a user is able to launch an EC2 instance with a different AMI ID and a larger instance type. The administrator reviews the policy and confirms that the condition is correctly written. What is the most likely reason that the policy is not working as expected?

Accepted Answer

The policy does not include an explicit deny statement for non-compliant launches.. The most likely reason is that the user has another IAM policy attached (e.g., a managed policy or group policy) that allows ec2:RunInstances without the condition. IAM evaluates all policies; if any allow statement grants the action, the action is permitted unless explicitly denied. The conditional allow only restricts when that specific statement is used, but a separate unconditional allow overrides the condition. Adding an explicit deny for non-compliant launches would block them regardless of other policies.

Answer

The condition keys used (ec2:InstanceType and ec2:ImageId) are not supported for the RunInstances action in IAM policies.

Answer

The policy is attached to the user but must also be attached to the IAM group.

Answer

The condition is written incorrectly; it should use StringLike instead of StringEquals.

Question 5

A company has an S3 bucket policy that allows cross-account access for a specific IAM role in another account. The bucket policy includes a Principal element with the ARN of the role. However, users in the other account that assume the role are unable to access the bucket. Which of the following is the MOST likely cause?

Accepted Answer

The IAM role does not have a permissions policy granting s3:GetObject on the bucket.. For cross-account access using an S3 bucket policy, the IAM role in the trusted account must have a permissions policy that grants the necessary S3 actions (e.g., s3:GetObject). Without this policy, even if the bucket policy allows the role, the role itself does not have permission to perform the action. Options B, C, and D are less likely: B is possible but not the most common; C is incorrect because the trust policy allows users to assume the role, not the S3 service; D is incorrect because role ARNs are valid principals in S3 bucket policies.

Answer

The bucket policy has an explicit Deny statement that overrides the Allow.

Answer

The role's trust policy does not allow the S3 service to assume the role.

Answer

The bucket policy uses the role ARN in the Principal element instead of the AWS account ID.

Question 6

A security engineer notices that an IAM role has a trust policy allowing any AWS account to assume it. Which attack is this misconfiguration most likely to enable?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

IAM Policy Simulator. IAM Policy Simulator allows you to simulate actions and view the effective permissions for a user, including permissions inherited from groups or roles. It can identify which policy (direct or inherited) grants a specific permission. IAM Access Analyzer, on the other hand, is designed to analyze resource-based policies for unintended access, not to trace the source of user permissions. Therefore, the engineer should use IAM Policy Simulator.

Answer

IAM Roles Anywhere

Answer

CloudTrail Insights

Answer

IAM Access Analyzer

Question 7

A security engineer notices that an IAM role has a trust policy allowing any AWS account to assume it. Which attack is this misconfiguration most likely to enable?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The policy condition key does not match the request context. The likely cause is that the policy condition key does not match the request context (Option D). Even though the role allows s3:PutObject, if the policy includes conditions (e.g., source IP, VPC, encryption) that are not met by the request, the effective permission becomes an implicit deny. Since the bucket policy does not explicitly deny, the problem lies in the role policy's conditions. Option A is incorrect because the stem explicitly states the bucket policy does not explicitly deny. Option B is incorrect because if the instance profile were not attached, the role would not be available; but the role is attached as stated. Option C is incorrect because the role policy does include s3:PutObject.

Answer

The bucket policy denies access

Answer

The instance profile is not attached to the EC2 instance

Answer

The role's policy does not include s3:PutObject

Question 8

A developer creates this CloudFormation stack. An EC2 instance with this role tries to list objects in the bucket. What will happen?

Accepted Answer

The instance can list objects in the bucket. The bucket policy grants `s3:ListBucket` action, which allows listing the objects in the bucket (i.e., the `ListObjects` API). The EC2 instance with that role can therefore list objects in the bucket. However, to upload objects, `s3:PutObject` would be required, which is not granted. Thus, option D is correct.

Answer

The instance can list the bucket but not the objects

Answer

The instance cannot assume the role because the principal is ec2.amazonaws.com

Answer

The instance can upload objects to the bucket

Question 9

A developer needs to allow a Lambda function to write logs to CloudWatch Logs. What is the MINIMUM IAM policy that should be attached to the Lambda execution role?

Accepted Answer

{"Effect":"Allow","Action":["logs:CreateLogGroup","logs:CreateLogStream","logs:PutLogEvents"],"Resource":"*"}. It grants the minimum required actions: logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents, which are all necessary for a Lambda function to write logs to CloudWatch Logs. Option B is wrong because it only grants logs:PutLogEvents but lacks logs:CreateLogGroup and logs:CreateLogStream, which are required if the log group and log stream do not already exist. Option C is wrong because it grants all logs actions (logs:*), which is overly permissive and not the minimum required. Option D is wrong because it grants only describe actions, which do not allow the writing of log events.

Answer

{"Effect":"Allow","Action":"logs:PutLogEvents","Resource":"arn:aws:logs:us-east-1:123456789012:log-group:my-log-group:*"}

Answer

{"Effect":"Allow","Action":"logs:*","Resource":"*"}

Answer

{"Effect":"Allow","Action":["logs:DescribeLogGroups","logs:DescribeLogStreams"],"Resource":"*"}

Question 10

An organization wants to enforce multi-factor authentication (MFA) for all IAM users accessing the AWS Management Console. Which policy should be used?

Accepted Answer

A policy that denies all actions unless aws:MultiFactorAuthPresent is true.. It uses an IAM policy with a Deny effect on all actions when `aws:MultiFactorAuthPresent` is false (or not true). This ensures that any IAM user attempting to perform any action, including ConsoleLogin, must have authenticated with MFA; otherwise, the request is denied. This is the standard approach to enforce MFA for all AWS Management Console access.

Answer

A policy that allows all actions and denies when aws:MultiFactorAuthPresent is true.

Answer

A policy that allows all actions except ConsoleLogin unless MFA is present.

Answer

A policy that allows all actions when aws:MultiFactorAuthPresent is true.

Question 11

A company uses AWS Organizations and wants to restrict all IAM users in all accounts from using the AWS Management Console. What is the most effective way to achieve this?

Accepted Answer

Create an SCP with a condition that denies access if the user is signing in using the AWS Management Console.. A service control policy (SCP) with a condition that denies access when the user is signing in via the AWS Management Console can be applied at the organizational level to restrict all IAM users across all accounts. Option B is incorrect because an IAM password policy only sets password requirements; it does not prevent users from signing in to the console. Option C is incorrect because an SCP that denies iam:CreateLoginProfile would only stop new login profile creation; existing users with login profiles could still access the console. Additionally, SCPs cannot be overridden by account administrators. Option D is incorrect because restricting a region does not block console access; users could still sign in to the console in other regions.

Answer

Set an IAM password policy that requires strong passwords.

Answer

Create a service control policy (SCP) that denies the 'iam:CreateLoginProfile' action and attach it to all accounts.

Answer

Create an SCP that denies the 'aws:RequestedRegion' condition for us-east-1.

Question 12

An IAM policy allows a user to pass a specific role and launch EC2 instances. The user tries to launch an EC2 instance with the role 'ec2-full-access' but receives an error: 'You are not authorized to perform iam:PassRole'. What is the MOST likely cause?

Accepted Answer

The user is attempting to pass a role with an ARN that does not exactly match the one in the policy. The error 'You are not authorized to perform iam:PassRole' indicates that the IAM policy does not allow the user to pass the role. The most likely cause is that the role ARN the user is trying to pass does not exactly match the ARN specified in the policy. Option A is incorrect because if the role didn't exist, the error would be different (e.g., 'The role does not exist'). Option C is incorrect because ec2:InstanceProfile is not a condition key for PassRole; it's a resource attribute. Option D is incorrect because the error is about PassRole, not RunInstances.

Answer

The role 'ec2-full-access' does not exist in the account

Answer

The policy is missing a condition key such as ec2:InstanceProfile

Answer

The user does not have permission to call ec2:RunInstances

Question 13

A developer needs to access an S3 bucket from an EC2 instance. The developer creates an IAM role with the necessary S3 permissions and attaches it to the instance profile. However, applications running on the instance can still not access the bucket. What is the most likely cause?

Accepted Answer

The IAM role is not attached to the EC2 instance's instance profile.. The IAM role must be associated with the EC2 instance's instance profile. If the role is not attached to the instance profile, the instance cannot assume the role, and applications will not have the necessary permissions to access S3. Option A is incorrect because the instance metadata service is not required to be enabled for IAM roles to work; it is used to retrieve temporary credentials but is often enabled by default. Option C is incorrect because an IAM role can be attached to an existing instance via modifying the instance profile, not just at launch. Option D is incorrect because while a bucket policy can grant access to a specific role, it is not necessary if the role already has S3 permissions via an IAM policy.

Answer

The IAM role cannot be attached after the EC2 instance is launched.

Answer

The instance metadata service is disabled on the EC2 instance.

Answer

The S3 bucket policy does not explicitly grant access to the IAM role.

Question 14

A company wants to allow its users to assume an IAM role in a different AWS account. What must the company configure to enable cross-account access?

Accepted Answer

In the target account, create an IAM role with a trust policy that allows the source account, and attach a permissions policy to that role. In the source account, allow users to call sts:AssumeRole.. Cross-account access requires creating an IAM role in the target account with a trust policy that specifies the source account as a trusted entity, and attaching a permissions policy that defines what actions the role can perform. The source account must then have a policy that allows its users to call sts:AssumeRole for that role. Option A is incorrect because S3 bucket policies are used for resource-based access, not for role assumption. Option C is incorrect because sharing access keys violates security best practices and does not provide the controlled, temporary access that IAM roles offer. Option D is incorrect because trust policies are attached to roles, not IAM groups.

Answer

In the source account, create an S3 bucket policy that allows access from the target account.

Answer

In the target account, create an IAM user and share the access keys securely with the source account users.

Answer

In the target account, attach a trust policy to an IAM group that allows the source account.

Question 15

A security engineer notices that a developer's IAM user has full administrator access. The engineer wants to implement the principle of least privilege for the developer. What is the best way to proceed?

Accepted Answer

Use IAM Access Advisor to review the developer's historical usage and create a custom policy that only includes the services and actions used.. Starting with a minimal set of permissions and gradually adding based on actual usage is the principle of least privilege. Option A is wrong because creating a group with AdministratorAccess still grants full admin permissions, not least privilege. Option C is wrong because PowerUserAccess grants broad permissions that may exceed what the developer actually needs. Option D is wrong because simply removing administrative access without an automated analysis of actual usage may disrupt the developer's work and is less efficient than using Access Advisor to create a tailored policy.

Answer

Create a new IAM group with the AdministratorAccess policy and add the developer to the group.

Answer

Replace the AdministratorAccess policy with a managed job function policy such as PowerUserAccess.

Answer

Remove the administrative access and ask the developer to request permissions as needed.

Question 16

Refer to the exhibit. An IAM user 'ExternalUser' from account 111111111111 tries to assume the role 'MyRole' in account 123456789012 but receives an error. The user has a policy that allows sts:AssumeRole. What is the most likely reason for the failure?

Accepted Answer

The user's AWS account has a service control policy (SCP) that denies sts:AssumeRole.. A Service Control Policy (SCP) in the user's account can deny the sts:AssumeRole action even if the user has an IAM policy allowing it. The trust policy in the target account allows the specific user ARN, so the issue is not with the trust policy. Option A is incorrect because the role exists (otherwise the error would be different). Option C is incorrect because there is no MFA requirement stated. Option D is incorrect because the trust policy does specify a principal (the user ARN).

Answer

The role does not exist in the target account.

Answer

The user must have MFA enabled to assume the role.

Answer

The trust policy does not specify a principal.

Question 17

A company wants to enforce that all IAM users use MFA. Which THREE actions should be taken to achieve this?

Accepted Answer

Enable MFA devices for all IAM users.. To enforce MFA for all IAM users, three key actions are needed. First, enable MFA devices for each user (B) so they have a device to authenticate with. Second, create an IAM policy that denies all actions unless the request includes MFA authentication (C); this policy uses the aws:MultiFactorAuthPresent condition key. Third, use AWS Single Sign-On (SSO) with MFA (E) as a centralized approach to enforce MFA, which can be applied to both federated and IAM users if migrated. Options A (password policy) does not enforce MFA, and D (IAM Access Analyzer) analyzes policies for unintended access, not MFA enforcement.

Answer

Set an IAM password policy requiring MFA.

Answer

Use IAM Access Analyzer to validate policies.

Question 18

A company uses AWS Organizations with multiple accounts. The security team has created an SCP that denies access to all DynamoDB actions except for the 'prod' account. The SCP is attached to the root OU. The 'prod' account has an IAM role that allows full DynamoDB access. A developer in the 'prod' account tries to create a DynamoDB table but receives an 'AccessDenied' error. The developer has the correct IAM permissions. What is the MOST likely cause and what should be done to resolve the issue?

Accepted Answer

The SCP denies DynamoDB by default; the 'prod' account needs an explicit allow in the SCP.. The SCP is attached to the root OU and applies to all accounts, including 'prod'. SCPs act as a permission boundary that cannot be overridden by IAM policies. Therefore, even though the developer's IAM role allows DynamoDB full access, the SCP deny takes precedence, resulting in the AccessDenied error. To resolve, the SCP should be modified to exclude the 'prod' account (e.g., by adding a condition to the deny statement) or the 'prod' account should be moved to a different OU without the deny SCP. Option C correctly identifies that the SCP cannot be overridden and suggests using a different account as a workaround, making it the most accurate choice among the options.

Answer

The DynamoDB table has a resource-based policy that denies access.

Answer

The SCP is attached to the OU and cannot be overridden; the developer must use a different account.

Answer

The IAM role's permissions boundary is blocking access.

Question 19

A large enterprise has multiple AWS accounts managed via AWS Organizations. The security team wants to enforce that all IAM roles in all accounts must have a maximum session duration of 1 hour. They create an SCP that denies creating or updating roles if the MaxSessionDuration is greater than 3600 seconds. The SCP is attached to the root OU. After applying the SCP, the development team reports that they cannot create any new IAM roles, even with a session duration of 1 hour. They are using CloudFormation to create roles. What is the MOST likely reason for the failure?

Accepted Answer

The SCP is not effective; the issue is with the IAM permissions boundary.. The most likely reason. The SCP condition only denies role creation when the MaxSessionDuration parameter is explicitly provided and exceeds 3600 seconds. If not specified, the condition does not apply, so the SCP should allow role creation. Therefore, the failure is not caused by the SCP itself but rather by an IAM permissions boundary that restricts the development team's ability to create roles. Option A is incorrect because SCPs can be attached to OUs. Option C is incorrect because the condition does not trigger when MaxSessionDuration is absent. Option D is incorrect because CloudFormation supports creating IAM roles.

Answer

The SCP cannot be attached to the root OU; it must be attached to individual accounts.

Answer

The SCP denies role creation when MaxSessionDuration is not explicitly set, even if it defaults to 1 hour.

Answer

CloudFormation does not support creating IAM roles.

Question 20

A developer needs to grant an IAM user read-only access to an S3 bucket named 'my-bucket'. Which policy should be attached to the IAM user?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::my-bucket/*"}]}. Option D grants s3:GetObject, which allows the IAM user to read (download) objects from the bucket. Although full read-only access typically includes s3:ListBucket to list objects, the question asks for read access, and s3:GetObject is the essential read action. Option A only allows listing, not reading object data. Option B grants full access, and option C grants write access. Thus, D is the best choice for read-only access.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::my-bucket"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:*","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:PutObject","Resource":"arn:aws:s3:::my-bucket/*"}]}