SCS-C02 Identity and Access Management Practice Test 10 — 15 Questions

Question 1

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all IAM users in the member accounts must have multi-factor authentication (MFA) enabled to access the AWS Management Console. Which approach should be used?

Accepted Answer

Attach an SCP to the root OU that denies all AWS actions unless the request includes MFA authentication. Option B is correct because a Service Control Policy (SCP) can deny all actions if a condition for MFA is not met, effectively enforcing MFA across all accounts. Option A is wrong because an SCP cannot attach IAM policies to users; it only sets permission boundaries. Option C is wrong because IAM policies in each account would require manual management and may not be enforced consistently. Option D is wrong because AWS Config rules can detect non-compliance but cannot enforce MFA at the time of access.

Answer

Use AWS Config rules to detect users without MFA and automatically disable their access

Answer

Create an IAM policy in each account that allows console access only if MFA is present and attach it to all users

Answer

Attach an SCP to the root OU that adds an IAM policy requiring MFA to all users

Question 2

A developer needs to allow an EC2 instance to read from a DynamoDB table named 'Orders' in the same account. The security team requires that the permissions be granted using an instance profile. Which steps should be taken?

Accepted Answer

Create an IAM role with a policy that allows dynamodb:GetItem on the 'Orders' table, create an instance profile, add the role to the profile, and launch the EC2 instance with the instance profile. Option A is correct because the instance profile is created, the IAM role is attached, and the EC2 instance is launched with that profile. Option B is wrong because the role itself is not attached directly to the instance; the instance profile must be used. Option C is wrong because storing credentials on the instance is insecure. Option D is wrong because the instance profile is not just for the root user; the role is assumed automatically.

Answer

Create an instance profile and attach a policy to it, then launch the EC2 instance with the instance profile

Answer

Create an IAM role with the required policy, then attach the role directly to the EC2 instance during launch

Answer

Create an IAM user with programmatic access, store the access key in a secure S3 bucket, and have the EC2 instance retrieve the credentials at startup

Question 3

A security engineer needs to allow an IAM user to rotate their own access keys. Which TWO IAM actions must be allowed in the user's policy? (Choose TWO.)

Accepted Answer

iam:DeleteAccessKey. Option A and Option E are correct. To rotate access keys, the user needs to create a new key and delete the old one. Option B is wrong because UpdateAccessKey can change the status (Active/Inactive) but is not required for rotation. Option C is wrong because ListAccessKeys is not strictly necessary; it helps but is not required. Option D is wrong because GetAccessKeyLastUsed is not needed.

Answer

iam:GetAccessKeyLastUsed

Answer

iam:ListAccessKeys

Answer

iam:UpdateAccessKey

Question 4

A company has an S3 bucket that contains sensitive data. The security team wants to enforce that all access to the bucket must use HTTPS and that requests originating from outside the corporate network (as defined by a specific IP range 203.0.113.0/24) must be denied. Which THREE conditions should be included in the S3 bucket policy? (Choose THREE.)

Accepted Answer

"Condition": {"Bool": {"aws:SecureTransport": "true"}}. Options A, B, and D are correct. To enforce HTTPS, use the condition aws:SecureTransport. To deny non-corporate IPs, use a Deny statement with aws:SourceIp condition and the NotIpAddress operator for the corporate range. Option C is wrong because aws:Referer is for referrer header, not network location. Option E is wrong because using IpAddress with a Deny effect would deny the corporate IPs, which is opposite of the requirement.

Answer

"Condition": {"IpAddress": {"aws:SourceIp": "203.0.113.0/24"}}

Answer

"Condition": {"StringLike": {"aws:Referer": "https://corporate.internal/*"}}

Question 5

A developer wants to allow an IAM role to be assumed by an EC2 instance that is part of an Auto Scaling group. Which TWO AWS services or features are required? (Choose TWO.)

Accepted Answer

Instance profile. An instance profile is required to attach an IAM role to an EC2 instance. When an EC2 instance is launched with an instance profile, the AWS credentials provider on the instance can retrieve temporary security credentials from the IAM role via the instance metadata service (IMDS). This allows the instance to assume the role and perform authorized API actions without embedding long-term credentials.

Answer

AWS Config

Answer

AWS CloudFormation

Answer

AWS Single Sign-On (SSO)

Question 6

A company uses AWS KMS to encrypt objects in an S3 bucket. The security team wants to ensure that only users with the appropriate KMS key permissions can decrypt objects. Which THREE conditions should be included in the S3 bucket policy to enforce this? (Choose THREE.)

Accepted Answer

"Condition": {"StringEquals": {"kms:ViaService": "s3.us-east-1.amazonaws.com"}}. Options A, C, and D are correct. To require use of a specific KMS key, you can use kms:ViaService and kms:EncryptionContext conditions. Option B is wrong because kms:GranteePrincipal is used in grants, not in bucket policies. Option E is wrong because S3 does not have a condition key kms:KeySpec.

Answer

"Condition": {"StringEquals": {"kms:KeySpec": "SYMMETRIC_DEFAULT"}}

Answer

"Condition": {"StringEquals": {"kms:GranteePrincipal": "arn:aws:iam::123456789012:role/Admin"}}

Question 7

An IAM policy allows a user to pass a specific role and launch EC2 instances. The user tries to launch an EC2 instance with the role 'ec2-full-access' but receives an error: 'You are not authorized to perform iam:PassRole'. What is the MOST likely cause?

Accepted Answer

The user is attempting to pass a role with an ARN that does not exactly match the one in the policy. Option B is correct. The policy allows iam:PassRole on the exact ARN, but the condition 'Resource: "*"' for ec2:RunInstances does not include the role. However, the error is about iam:PassRole, which means the user tried to pass a role that is not the exact ARN. The most common issue is that the user is trying to pass a role that is different or the ARN is incorrect. Option A is wrong because the policy does not require a condition key for PassRole. Option C is wrong because the policy allows ec2:RunInstances on all resources. Option D is wrong because the role may exist but the ARN mismatch causes the failure.

Answer

The role 'ec2-full-access' does not exist in the account

Answer

The policy is missing a condition key such as ec2:InstanceProfile

Answer

The user does not have permission to call ec2:RunInstances

Question 8

An administrator runs the AWS CLI command shown in the exhibit. What does this command do?

Accepted Answer

Lists the managed policies attached to the role 'MyRole'. Option B is correct. The command lists the managed policies attached to a role named 'MyRole'. Option A is wrong because it lists attached policies, not inline policies. Option C is wrong because it lists the policies attached to a role, not a user. Option D is wrong because it lists attached policies, not all policies in the account.

Answer

Lists all IAM policies in the account

Answer

Lists the managed policies attached to the user 'MyRole'

Answer

Lists all inline policies attached to the role 'MyRole'

Question 9

A company runs a multi-tier web application on AWS. The application consists of an Application Load Balancer (ALB) that distributes traffic to a fleet of EC2 instances in an Auto Scaling group. The EC2 instances need to read from an Amazon RDS MySQL database and write logs to an S3 bucket. The security team wants to ensure that the EC2 instances have only the minimum required permissions. Currently, the EC2 instances are launched with an IAM role that has an attached policy allowing full S3 access (s3:*) and full RDS access (rds:*). The security team has identified that this is overly permissive and wants to restrict access to only the specific resources needed. Additionally, the team wants to ensure that the EC2 instances can only access the RDS database using SSL/TLS. Which combination of actions should the security team take?

Accepted Answer

Update the IAM role to have two policies: one that allows s3:PutObject on the specific S3 bucket with a prefix, and another that allows rds:Connect on the specific RDS instance ARN with a condition requiring rds:ForceSsl. Also, ensure the RDS instance requires SSL.. Option B is correct. It creates separate policies for S3 and RDS, restricts S3 to the specific bucket and prefix, and restricts RDS to the specific resource and enforces SSL. Option A is wrong because using an IAM user and storing credentials on EC2 is insecure. Option C is wrong because using a single policy with wildcards is still overly permissive and does not enforce SSL. Option D is wrong because resource-based policies on the S3 bucket and RDS instance would not be sufficient without the IAM role permissions; also, S3 bucket policies are not the primary method for granting EC2 access.

Answer

Remove the IAM role from the EC2 instances and instead use resource-based policies on the S3 bucket and RDS instance to grant access to the EC2 instances' VPC or subnet.

Answer

Create an IAM user with the required permissions, generate access keys, and store them in a secure S3 bucket. Have the EC2 instances retrieve the credentials at startup using an instance profile.

Answer

Create a single IAM policy that allows s3:PutObject on the specific bucket and rds:Connect on the specific RDS instance without any conditions. Attach it to the IAM role.

Question 10

A large enterprise uses AWS Organizations to manage multiple accounts. The security team has implemented a Service Control Policy (SCP) at the root level that denies all actions unless the request originates from the corporate IP range (10.0.0.0/8). Recently, a developer in a member account tried to launch an EC2 instance from the AWS Management Console while connected via a VPN that provides an IP address within the corporate range. However, the launch failed with an 'AccessDenied' error. The developer is using an IAM user with full EC2 permissions (ec2:*). The SCP is as follows: {"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"*","Resource":"*","Condition":{"NotIpAddress":{"aws:SourceIp":"10.0.0.0/8"}}}]}. What is the MOST likely reason for the failure?

Accepted Answer

The aws:SourceIp condition key does not work correctly for requests made via the AWS Management Console because the console may use a different IP.. Option C is correct. The SCP uses the aws:SourceIp condition, but when accessing the Management Console, the IP address seen by AWS is the console's IP, which may not be the same as the developer's VPN IP if the console uses a proxy or if the VPN is configured incorrectly. Option A is wrong because SCPs affect all principals, including the root user. Option B is wrong because the SCP denies actions, not allows them; an explicit deny overrides allows. Option D is wrong because the SCP denies all actions, so even if the developer has permissions, the SCP denies them.

Answer

The SCP allows actions only from the specified IP range, but the developer's IP is not in that range.

Answer

The SCP does not apply to IAM users in member accounts; it only applies to the root user.

Answer

The IAM user does not have the necessary permissions because the SCP explicitly denies all actions.

Question 11

A company has a requirement to grant cross-account access to an S3 bucket named 'shared-data' in Account A (111111111111) to users in Account B (222222222222). The security team has set up a bucket policy in Account A that grants read-only access to the IAM role 'DataReader' in Account B. The bucket policy is as follows: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::222222222222:role/DataReader"},"Action":["s3:GetObject"],"Resource":"arn:aws:s3:::shared-data/*"}]}. A user in Account B assumes the 'DataReader' role, but when trying to read an object from the bucket, they receive an 'Access Denied' error. What is the MOST likely reason for this error?

Accepted Answer

The IAM role 'DataReader' does not have an IAM policy that allows s3:GetObject on the bucket.. Option D is correct. For cross-account access, the IAM role in Account B must have an IAM policy that allows the action (s3:GetObject) on the target bucket. Even if the bucket policy grants access, the role itself must also allow the action. Option A is wrong because the bucket policy uses the correct principal format. Option B is wrong because S3 does not require KMS for access unless encryption is involved. Option C is wrong because the bucket policy allows all principals in the role, not just specific users.

Answer

The bucket policy principal must be the IAM user ARN, not the role ARN.

Answer

The bucket policy is missing the 's3:ListBucket' action, which is required to read objects.

Answer

The bucket objects are encrypted with a KMS key, and the role does not have permission to decrypt.

Question 12

A company runs a serverless application using AWS Lambda functions that access an Amazon DynamoDB table. The Lambda functions are part of a microservices architecture and need to read and write to the DynamoDB table. The security team wants to ensure that the Lambda functions have the minimum required permissions. Initially, the team attached the AWS managed policy 'AWSLambdaDynamoDBExecutionRole' to the Lambda execution role, but later discovered that this policy grants more permissions than needed. The team decides to create a custom policy with only the required actions: GetItem, PutItem, UpdateItem, and DeleteItem. However, after attaching the custom policy, the Lambda functions start failing with 'AccessDeniedException' when trying to access DynamoDB. The CloudWatch logs show that the Lambda function is unable to write logs to CloudWatch Logs. What is the MOST likely cause of the failures?

Accepted Answer

The custom policy does not include permissions for CloudWatch Logs actions (logs:CreateLogGroup, logs:CreateLogStream, logs:PutLogEvents), which are required for Lambda to write logs.. Option A is correct. The custom policy only grants DynamoDB permissions but does not include permissions for CloudWatch Logs, which are needed for Lambda to write logs. The managed policy included both DynamoDB and CloudWatch Logs permissions. Option B is wrong because the Lambda function does not need VPC permissions unless it is in a VPC. Option C is wrong because the Lambda function does not need to list tables to perform read/write operations. Option D is wrong because the condition keys are not the issue; the problem is missing permissions.

Answer

The custom policy does not include dynamodb:ListTables, which is required for the DynamoDB SDK to work.

Answer

The DynamoDB table has a resource-based policy that denies access from Lambda functions without a specific condition key.

Answer

The Lambda function is attached to a VPC and requires permissions to create Elastic Network Interfaces (ec2:CreateNetworkInterface).

Question 13

A company is using Amazon API Gateway to expose a set of REST APIs. The APIs are backed by AWS Lambda functions. The security team wants to control access to the APIs using IAM authorization. The team has created an IAM policy for a group of developers that allows them to invoke the APIs only from within the corporate network (IP range 203.0.113.0/24). The policy is attached to an IAM group, and the developers are members of the group. However, when a developer tries to invoke the API from the corporate network, they receive a '403 Forbidden' error. The API Gateway endpoint is configured with IAM authorization. The IAM policy is as follows: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"execute-api:Invoke","Resource":"arn:aws:execute-api:us-east-1:123456789012:api-id/*","Condition":{"IpAddress":{"aws:SourceIp":"203.0.113.0/24"}}}]}. What is the MOST likely reason for the failure?

Accepted Answer

The resource ARN in the policy does not include the stage and method; it should be 'arn:aws:execute-api:us-east-1:123456789012:api-id/stage/GET/resource'.. Option B is correct. For API Gateway IAM authorization, the resource ARN must include the stage and method, or use wildcards. The policy uses 'api-id/*' which may not match the actual resource path. Option A is wrong because the condition is correct for IP restriction. Option C is wrong because the policy is attached to the group, so the developers should inherit it. Option D is wrong because API Gateway IAM authorization works with IAM policies; the issue is likely the resource ARN.

Answer

The IAM policy must be attached directly to the IAM user, not to a group.

Answer

The condition key aws:SourceIp does not work for API Gateway; you must use a custom header.

Answer

API Gateway IAM authorization does not support resource-level conditions; you must use a Lambda authorizer.

Question 14

A security engineer is designing IAM policies for a data analytics platform that uses Amazon S3, Amazon Athena, and AWS Glue. The platform must allow data scientists to query data in S3 using Athena, but only from specific VPC subnets. Additionally, the data must be encrypted at rest using AWS KMS. Which TWO actions should the engineer take to meet these requirements? (Choose TWO.)

Accepted Answer

Grant kms:Decrypt permission in the IAM policy and configure the KMS key policy to allow the IAM role to use the key.. A: Correct – Using a VPC endpoint for Athena with a bucket policy that restricts access to the VPC endpoint ensures that queries are only allowed from the specified VPC subnets. D: Correct – Granting kms:Decrypt permission in the IAM policy and ensuring the KMS key policy allows the IAM role enables Athena to decrypt S3 objects encrypted with a customer-managed KMS key. B: Incorrect – The s3:SourceIp condition key does not work for VPC endpoints; use aws:SourceVpce instead. C: Incorrect – The kms:EncryptionContext condition is not used for restricting encryption at rest; it is used for encryption context in KMS operations. E: Incorrect – S3 default encryption (SSE-S3) does not use KMS, so the KMS key policy would not be relevant.

Answer

Add kms:EncryptionContext condition to the IAM policy to require a specific encryption context.

Answer

Use the s3:SourceIp condition key in the IAM policy to restrict access to the private IP ranges of the VPC subnets.

Answer

Enable default encryption on the S3 bucket using SSE-S3 and configure the KMS key policy to allow the IAM role.

Question 15

A company manages a multi-account AWS environment using AWS Organizations. The security team wants to enforce that all Amazon S3 buckets in the organization are encrypted with AWS KMS customer managed keys (CMKs) and that no unencrypted buckets can be created. They also want to ensure that the encryption settings cannot be changed by account administrators. The team uses AWS CloudTrail to log all S3 API calls and wants to detect any attempts to create unencrypted buckets. The security team creates a service control policy (SCP) that denies s3:PutBucketEncryption and s3:PutBucketPolicy unless the request includes a specific encryption setting. However, they find that a developer in a member account was able to create an unencrypted bucket using the AWS Management Console. The CloudTrail logs show that the bucket was created with the s3:CreateBucket API call without specifying any encryption parameters. What should the security team do to prevent this from happening?

Accepted Answer

Modify the SCP to deny s3:CreateBucket unless the request includes the x-amz-server-side-encryption-aws-kms-key-id header.. D: Correct – The SCP should deny s3:CreateBucket if the request does not include the x-amz-server-side-encryption-aws-kms-key-id header. This prevents creation of unencrypted buckets. A: Incorrect – CloudTrail is already logging; additional logging does not prevent the action. B: Incorrect – IAM permissions boundary does not override SCP; the SCP should already prevent the action, but it was not effective because the SCP did not deny s3:CreateBucket without encryption. C: Incorrect – S3 Block Public Access does not enforce encryption.

Answer

Enable CloudTrail Insights to detect unusual S3 activity and create a CloudWatch alarm.

Answer

Attach an IAM permissions boundary to all IAM roles used by developers that denies s3:CreateBucket.

Answer

Enable S3 Block Public Access at the account level to prevent unencrypted bucket creation.