SCS-C02 Identity and Access Management — 30 Questions

Question 1

An IAM policy includes the following condition: "StringNotEquals": {"aws:SourceArn": "arn:aws:ec2:us-east-1:123456789012:instance/*"}. What is the effect of this condition when attached to an IAM role?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Denies requests that do not originate from an EC2 instance in the specified account and region. The condition uses `StringNotEquals` with `aws:SourceArn`, meaning it denies access when the source ARN does NOT match the specified pattern. Since the condition is attached to a role's trust policy, it restricts which principals can assume the role. The correct effect is that requests not originating from an EC2 instance in account 123456789012 and region us-east-1 are denied.

Answer

Denies all requests from EC2 instances

Answer

Allows the role to be assumed only by EC2 instances in the specified account and region

Answer

Allows any request that comes from an EC2 instance regardless of account

Question 2

An IAM user receives an 'AccessDenied' error when trying to list objects in an S3 bucket. The user has the following policy attached: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::example-bucket"}]}. What is the most likely reason?

Accepted Answer

The bucket policy explicitly denies the action. The IAM policy grants the s3:ListBucket action on the bucket, which should allow listing objects. However, an explicit deny in a bucket policy overrides any allow, including those from IAM policies. Since the user receives an 'AccessDenied' error, the most likely cause is that the bucket policy explicitly denies the s3:ListBucket action for this user, as explicit denies take precedence over all allows.

Answer

The policy is missing a condition

Answer

The policy does not include s3:GetObject

Answer

The policy has a syntax error

Question 3

Which TWO are valid ways to authenticate to AWS for API calls? (Choose two.)

Accepted Answer

IAM user access keys. IAM user access keys (option B) are a valid authentication method for programmatic API calls to AWS. They consist of an access key ID and a secret access key, which are used to sign requests using Signature Version 4 (SigV4). This is a standard, long-term credential for IAM users to interact with AWS services via CLI, SDK, or direct API calls.

Answer

SSH key pairs

Answer

Database master password

Answer

Root user access keys

Question 4

Refer to the exhibit. A security engineer runs the command above. Which of the following is true about the role MyRole?

Accepted Answer

The role can be assumed by EC2 instances. The command `aws ec2 associate-iam-instance-profile --instance-id i-1234567890abcdef0 --iam-instance-profile Name=MyRole` attaches an IAM instance profile to an EC2 instance. An instance profile is a container for an IAM role that enables EC2 instances to assume that role and obtain temporary credentials via the EC2 metadata service. Therefore, the role MyRole can be assumed by EC2 instances when associated through an instance profile.

Answer

The role has a resource-based policy attached

Answer

The role can be assumed by any IAM user in account 123456789012

Answer

The role can be assumed by any AWS service

Question 5

A company has a multi-account AWS Organization with three accounts: Management, Development, and Production. The Security team uses the Management account to manage IAM policies centrally. They have created a service control policy (SCP) named 'RestrictRootAccess' that denies all actions for the root user in all accounts. The SCP is attached to the root organizational unit. The Development account has an IAM role 'DevAdmin' with full administrator access via an IAM policy. The role's trust policy allows the Management account's 'SecurityAudit' role to assume it. A security engineer in the Management account assumes the 'SecurityAudit' role and then tries to assume the 'DevAdmin' role in the Development account. The assumption fails with an 'AccessDenied' error. What is the most likely cause?

Accepted Answer

The trust policy of the 'DevAdmin' role does not grant sts:AssumeRole to the 'SecurityAudit' role. The error 'AccessDenied' occurs because the trust policy of the 'DevAdmin' role in the Development account does not explicitly grant the 'sts:AssumeRole' action to the 'SecurityAudit' role from the Management account. Even though the 'SecurityAudit' role has permission to call sts:AssumeRole via its IAM policy, the target role's trust policy acts as a resource-based policy that must allow the incoming principal. Without that allow, the assumption fails regardless of permissions in the source account.

Answer

The SCP is attached to the root OU and overrides any allow in the member accounts

Answer

The SCP 'RestrictRootAccess' denies the sts:AssumeRole action for all principals except root

Answer

The 'SecurityAudit' role requires MFA to assume the 'DevAdmin' role

Question 6

A developer is trying to upload an object to an S3 bucket named 'my-bucket' using the AWS CLI. The developer has an IAM user with a policy that includes 's3:PutObject' for 'arn:aws:s3:::my-bucket/*'. However, the upload fails with an 'Access Denied' error. The bucket policy is set to allow all principals from the same AWS account to perform 's3:PutObject'. What is the most likely cause of this failure?

Accepted Answer

The bucket policy denies access because the principal is not explicitly listed.. The IAM user has s3:PutObject permission on the bucket's objects (/*), so option A is incorrect. Option C is incorrect because s3:PutObject is always applied to the object resource (e.g., bucket-name/*); no upload operation requires the same permission on the bucket itself. Option D is incorrect because a region mismatch would result in a NoSuchBucket error, not Access Denied. Option B is correct because the bucket policy, though intended to allow all principals from the same AWS account, typically specifies the AWS account root principal (e.g., "arn:aws:iam::account-id:root"). This principal only grants access to the root user, not to IAM users. Since the IAM user is not an explicitly listed principal, the request is implicitly denied, resulting in the Access Denied error.

Answer

The IAM user is not authorized to perform 's3:PutObject' on the bucket 'my-bucket'.

Answer

The IAM policy grants 's3:PutObject' only on objects (/*), but the request may also require 's3:PutObject' on the bucket itself for some operations.

Answer

The bucket 'my-bucket' does not exist in the same region as the CLI request.

Question 7

An IAM policy is attached to a user. The user is trying to change their own password in the IAM console but receives an 'Access Denied' error. The user has an MFA device configured and is logged in with MFA. Why is the password change failing?

Accepted Answer

The Deny statement uses 'BoolIfExists' which evaluates to true if the condition key is not present. In the IAM console, the 'aws:MultiFactorAuthPresent' key may not be set, causing the Deny to apply even when the user has MFA.. The Deny statement uses the `BoolIfExists` condition operator with the `aws:MultiFactorAuthPresent` key. In the IAM console, the `aws:MultiFactorAuthPresent` key may not be present in the request context (e.g., during the initial password change flow before MFA is re-validated), causing `BoolIfExists` to evaluate to true when the key is absent. This triggers the Deny even though the user has an MFA device and is logged in with MFA, blocking the `iam:ChangePassword` action.

Answer

The Allow statement for iam:ChangePassword is not sufficient because the Deny statement explicitly denies all actions.

Answer

The Deny statement denies all actions unconditionally, so the Allow statement cannot override it.

Answer

The user does not have permission to change their own password because the Allow statement is not specific enough.

Question 8

A security engineer is designing a solution to allow an external auditor to access logs in an S3 bucket in the company's AWS account. The auditor does not have an AWS account. The engineer needs to grant read-only access to the specific bucket for a limited time. Which TWO actions should the engineer take? (Choose two.)

Accepted Answer

Use AWS STS to issue temporary credentials that the auditor can use to access the bucket.. Option C is correct because AWS STS (Security Token Service) can issue temporary, time-limited credentials (e.g., via AssumeRole, GetSessionToken, or federation) that grant read-only S3 access without requiring the auditor to have an AWS account, and the credentials automatically expire after the defined duration. Option D is correct because S3 pre-signed URLs embed the creator's credentials in a signed request, allowing an unauthenticated party such as the auditor to perform a specific read (GET) on individual log objects for a limited validity period, which fits the read-only, time-bound requirement. Option A is not appropriate because S3 Access Analyzer generates findings about bucket access policies and does not itself grant access to the auditor. Option B is not appropriate because a cross-account IAM role requires the auditor to have an AWS account with an identity that can assume the role, which the scenario explicitly rules out. Option E is not appropriate because a bucket policy granting Principal '*' with only an IP condition is not a secure or time-limited mechanism for granting read-only access to a specific external auditor.

Answer

Enable S3 Access Analyzer on the bucket to generate findings for the auditor.

Answer

Create a cross-account IAM role in the company's account and share the role ARN with the auditor.

Answer

Configure the bucket policy to grant access to 'Principal': '*' with a condition that limits access to the auditor's IP address.

Question 9

Drag and drop the steps to configure AWS CloudTrail for logging across all regions and accounts in the correct order.

Accepted Answer

Create an S3 bucket, then create a CloudTrail trail, then configure the trail to apply to all regions, then enable log file integrity validation, then create an organization trail.. CloudTrail setup requires S3 bucket, trail creation, multi-region selection, integrity validation, and organization trail.

Answer

Create a CloudTrail trail, then create an S3 bucket, then configure the trail to apply to all regions, then enable log file integrity validation, then create an organization trail.

Answer

Create an S3 bucket, then create a CloudTrail trail, then enable log file integrity validation, then configure the trail to apply to all regions, then create an organization trail.

Answer

Create an S3 bucket, then create an organization trail, then create a CloudTrail trail, then configure the trail to apply to all regions, then enable log file integrity validation.

Question 10

Match each AWS KMS key type to its description.

Accepted Answer

Customer managed key: You create, manage, and control the key lifecycle, including rotation, deletion, and policies.. Customer managed keys give you full control over the key lifecycle and policies. AWS managed keys are created and managed by AWS but allow you to view and audit usage. AWS owned keys are fully managed by AWS and used across many accounts. Custom key store keys are stored in a CloudHSM cluster under your control. Distractors swap the definitions of customer and AWS managed keys.

Answer

Customer managed key: AWS creates and manages the key, but you can view it and audit its usage.

Answer

AWS managed key: You create, manage, and control the key lifecycle.

Question 11

Match each AWS CloudHSM feature to its description.

Accepted Answer

Dedicated HSM: Each customer gets exclusive access to a hardware security module.. CloudHSM provides dedicated hardware security modules that are FIPS 140-2 Level 3 validated and support automatic key replication across clusters. Common confusions include mistaking single-tenant as multi-tenant or assuming a software emulator is used.

Answer

Multi-tenant: Multiple customers share the same HSM.

Answer

HSM client: CloudHSM provides a software-based HSM emulator.

Question 12

A security engineer notices that an IAM user has permissions that are not explicitly granted through any policy. The engineer suspects that the user might have inherited permissions from a group or role. Which IAM feature should the engineer use to identify the source of these permissions?

Accepted Answer

IAM Policy Simulator. The IAM Policy Simulator evaluates the effective permissions for a principal against a specified action and resource, and it explicitly shows which policies (identity-based, group-attached, permission boundaries, SCPs) grant or deny the action. This makes it the correct tool to trace the source of an unexpected permission. It answers 'why does this principal have this permission?' by listing every matching statement.

Answer

IAM Roles Anywhere

Answer

CloudTrail Insights

Answer

IAM Access Analyzer

Question 13

An organization wants to enforce that all IAM users use MFA. The security team creates an IAM policy that denies all actions unless MFA is present. However, some users report they cannot even change their own password to enable MFA. What should the security team do to resolve this?

Accepted Answer

Add an exception statement that allows iam:ChangePassword without MFA.. IAM users need the ability to change their password to set up MFA even when MFA is not yet enabled. The policy should include an exception for the iam:ChangePassword action to allow this action without MFA. Option A would allow all actions without MFA, defeating the purpose of enforcement. Option C is impractical as users without MFA cannot access the console to enable it. Option D removes MFA enforcement entirely, violating the requirement.

Answer

Add a statement that allows all actions when MFA is present.

Answer

Assign the policy only after users have enabled MFA.

Answer

Remove the MFA condition from the policy.

Question 14

Which THREE are valid ways to grant cross-account access to an S3 bucket? (Choose three.)

Accepted Answer

Create an IAM role in the target account and allow the source account to assume it.. Option B is correct because creating an IAM role in the target (bucket-owning) account with a trust policy that permits the source account's principals to call sts:AssumeRole is the standard, credential-free way to delegate cross-account S3 access. Option C is correct because S3 access points have their own access point policies that can explicitly grant permissions to principals in other accounts, providing a scalable cross-account access mechanism. Option D is correct because a bucket policy is a resource-based policy that can name another AWS account's root user (arn:aws:iam::<account-id>:root) as Principal, delegating permission to that account and its IAM users. Option A is not a cross-account grant mechanism—access keys belong to a single IAM user in one account and do not by themselves authorize access to another account's bucket. Option E is not valid because S3 bucket ACLs can only grant permissions to predefined S3 grantees (like the bucket owner or Log Delivery group), not to arbitrary other AWS accounts, and ACLs are legacy and cannot reference account IDs for cross-account grants.

Answer

Use an IAM user in the source account with access keys.

Answer

Set the bucket ACL to grant full control to the other account.

Question 15

A security engineer is designing a cross-account access solution. An IAM role in Account A needs to be assumed by users from Account B. Which two components are required?

Accepted Answer

Trust policy allowing Account B to assume the role, and IAM policy in Account B allowing sts:AssumeRole. For cross-account IAM role access, two components are required: (1) a trust policy on the role in Account A that grants permissions for principals in Account B to assume the role, and (2) an IAM policy in Account B that allows its users to call sts:AssumeRole on the role ARN in Account A. Option A is incorrect because a permissions boundary is optional and not a required component. Option B is incorrect because Service Control Policies (SCPs) are used to restrict permissions at the organizational level, not to allow actions; they cannot explicitly allow AssumeRole. Option D is incorrect because IAM roles do not support resource-based policies; only trust policies are used for cross-account access.

Answer

Permissions boundary on the role to limit permissions

Answer

Service control policy in Account A allowing AssumeRole

Answer

Resource-based policy on the role allowing cross-account access

Question 16

An IAM user needs to rotate their own access keys. Which IAM policy action should be allowed?

Accepted Answer

iam:UpdateAccessKey. IAM:UpdateAccessKey is used to rotate access keys (e.g., changing the status from Active to Inactive). Option A is incorrect because IAM:DeleteAccessKey removes a key entirely, not part of rotation. Option C is incorrect because IAM:CreateAccessKey creates a new key but does not handle the deactivation step. Option D is incorrect because IAM:ChangePassword is for password changes, not access keys.

Answer

iam:DeleteAccessKey

Answer

iam:CreateAccessKey

Answer

iam:ChangePassword

Question 17

A security engineer notices that an IAM role for an EC2 instance has a policy that allows s3:PutObject on a bucket. However, the application reports access denied when trying to upload. The bucket policy does not explicitly deny access. What is a likely cause?

Accepted Answer

The policy condition key does not match the request context. The most likely cause is that the policy condition key does not match the request context, such as a condition requiring a specific VPC endpoint, source IP, or MFA that the request does not satisfy. Even though the role allows s3:PutObject, the condition in the policy (or bucket policy) may evaluate to false, resulting in access denied. This is a common issue when conditions like aws:SourceVpce or aws:PrincipalArn are misconfigured.

Answer

The bucket policy denies access

Answer

The instance profile is not attached to the EC2 instance

Answer

The role's policy does not include s3:PutObject

Question 18

A security engineer needs to ensure that an IAM role can be assumed only from a specific VPC. Which IAM policy condition key should be used?

Accepted Answer

aws:SourceVpc. The aws:SourceVpc condition key restricts access based on the VPC endpoint (via VPC endpoint ID) from which the request originates. It is used in IAM policies to allow actions only when the request comes through a specified VPC endpoint, which is the correct way to ensure an IAM role can be assumed only from a specific VPC. This key works with VPC endpoint policies and IAM trust policies.

Answer

aws:RequestedRegion

Answer

aws:VpcSourceIp

Answer

aws:SourceIp

Question 19

Which TWO of the following are valid IAM policy condition keys? (Choose TWO.)

Accepted Answer

aws:RequestedRegion. Option A, aws:RequestedRegion, is a valid global IAM condition key that lets you restrict access based on the AWS Region the request is sent to, commonly used to enforce regional data-residency or deny calls outside approved Regions. Option C, aws:SourceIp, is a valid condition key that compares the requester's IP address against a specified CIDR range, typically used to restrict API calls to corporate network ranges. The other options are not real IAM condition keys: aws:RequestedService, aws:PrincipalService, and aws:SourceArn do not exist in the IAM condition key namespace (the closest real keys are aws:PrincipalArn and aws:SourceArn is actually valid only in some service-specific contexts like SNS/SQS policies, but it is not a global IAM condition key as presented here).

Answer

aws:RequestedService

Answer

aws:PrincipalService

Answer

aws:SourceArn

Question 20

A security engineer attaches this policy to an IAM user. The user tries to download an object from the bucket from an IP address 10.1.0.5. What will happen?

Accepted Answer

The user will be denied access because the condition does not match. The policy's condition likely restricts access to a specific IP range (e.g., 10.0.0.0/8 or a specific CIDR) that does not include 10.1.0.5, so the condition evaluates to false and the Allow statement does not apply. With no matching Allow and default implicit deny, the request is denied. The correct answer is that the user is denied because the condition does not match.

Answer

The user will be allowed access because the policy allows s3:GetObject

Answer

The policy is invalid and will cause an error

Answer

The user will be denied access because there is an explicit deny