SCS-C02 Identity and Access Management Practice Test 10 — 15 Questions

Question 1

A company uses AWS Organizations with all features enabled. The security team wants to enforce that all IAM users in member accounts must use multi-factor authentication (MFA) to access the AWS Management Console. They create an SCP that denies all actions if the user does not have MFA. The SCP is attached to the root organizational unit. After a few days, users in a member account report that they can still access the console without MFA. The security team reviews the SCP and finds it is correctly configured. What is the MOST likely reason the SCP is not being enforced?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The member account is the management account of the organization, which is not affected by SCPs.. The most likely reason the SCP is not being enforced is that the member account is the management account of the organization, which is not affected by SCPs (B). SCPs do not apply to the management account; they only apply to member accounts. Even if the SCP is attached to the root OU, the management account is exempt. Therefore, users in the management account can still access the console without MFA.

Answer

The member account has a separate SCP attached that allows the actions, overriding the root SCP.

Answer

The SCP is missing an explicit allow for the actions, so the default deny is not taking effect.

Answer

The SCP does not apply to the root user of the member account, so root can bypass MFA.

Question 2

A security engineer is configuring IAM Identity Center (successor to AWS Single Sign-On) for a company with 500 employees. The company wants to assign access to AWS accounts based on the employee's department attribute from their existing Microsoft Active Directory. The engineer has already connected Active Directory as an external identity provider to IAM Identity Center. What should the engineer do next to achieve attribute-based access control?

Accepted Answer

Configure attribute mappings in IAM Identity Center to map the department attribute from Active Directory to an attribute in IAM Identity Center, then use that attribute in permission set policies.. Attribute mappings in IAM Identity Center allow synchronization of user attributes from Active Directory. Once mapped, these attributes can be referenced in permission set policies using condition keys like aws:PrincipalTag, enabling dynamic, attribute-based access to AWS accounts. This avoids manual per-user assignments and scales efficiently for a large workforce.

Answer

Use AWS Organizations SCPs to enforce department-based access across all accounts.

Answer

Create permission sets that map to each department and manually assign them to users.

Answer

Set up a custom SAML application in Active Directory Federation Services (AD FS) that includes department as a SAML claim, then use that claim in IAM policies attached to roles.

Question 3

A security engineer is designing a policy for a large financial services company. The company has an AWS Organizations structure with a root, several OUs, and many member accounts. The security team wants to enforce a rule that no IAM user or role in any member account can create an S3 bucket without server-side encryption enabled. The policy must apply to all existing and future accounts automatically. Which AWS feature should the engineer use to implement this requirement?

Accepted Answer

AWS Organizations service control policies (SCPs) attached to the organization root and OUs.. Service control policies are the only mechanism that centrally enforces permission boundaries across all accounts in an AWS Organization, including future accounts. By attaching an SCP that denies s3:CreateBucket unless the s3:x-amz-server-side-encryption header is present, the security team ensures that no unencrypted bucket can be created. This is a preventive control that operates at the organization level, not on individual identities or resources.

Answer

AWS Config rules with automatic remediation using AWS Systems Manager Automation documents.

Answer

AWS Identity and Access Management (IAM) permission boundaries attached to every IAM user and role.

Answer

AWS CloudFormation StackSets that deploy IAM policies to all accounts.

Question 4

A security engineer is reviewing an IAM policy for a critical application that runs on Amazon EC2 instances. The policy allows the instances to read and write to an Amazon S3 bucket. The engineer notices that the policy includes the condition "aws:SourceIp": "203.0.113.0/24". The instances are launched in a private subnet and access S3 through a VPC endpoint. The engineer wants to ensure that the policy does not inadvertently block legitimate traffic. What is the most likely effect of this condition?

Accepted Answer

The condition will deny all requests because the instances' private IP addresses will not match the public IP range specified.. The aws:SourceIp condition key evaluates the source IP address of the request as seen by AWS. For requests that traverse a VPC endpoint, the source IP is the private IP address of the EC2 instance, not its public IP. If the policy specifies a public IP range, the condition will not match the private IP, causing all requests to be denied. This is a common misconfiguration when securing access to S3 from VPC endpoints.

Answer

The condition will allow requests only if the instances' Elastic IP addresses are within the specified range.

Answer

The condition will allow requests only from the specified IP range, but since the instances use a VPC endpoint, their source IP will be the private IP of the instance, which may not match the range.

Answer

The condition will have no effect because aws:SourceIp is not evaluated for requests that come through a VPC endpoint.

Question 5

A security engineer is designing an IAM policy for a new application that runs on Amazon EC2. The application must access an Amazon DynamoDB table and an Amazon SQS queue. The engineer wants to follow the principle of least privilege. Which TWO actions should be included in the IAM policy? (Choose two.)

Accepted Answer

sqs:SendMessage. Least privilege means granting only the permissions required for the application to function. For read access to DynamoDB, GetItem is the narrowest action. For sending messages to SQS, SendMessage is appropriate. Scan, DeleteQueue, and PutItem are broader or destructive actions not needed for basic read and send operations. These two actions satisfy the application's needs without excessive permissions.

Answer

dynamodb:PutItem

Answer

sqs:DeleteQueue

Answer

dynamodb:Scan

Question 6

A security engineer is designing a strategy to manage IAM permissions for a large organization with multiple AWS accounts. The organization wants to enforce that certain IAM actions are never allowed, regardless of policies attached to IAM users or roles. The engineer plans to use AWS Organizations service control policies (SCPs). Which TWO statements about SCPs are correct? (Choose two.)

Accepted Answer

SCPs can be used to deny access to specific AWS services or actions across all accounts in an organization.. SCPs can be attached to the root, OUs, or accounts, and they can deny access to specific services or actions across accounts. They do not grant permissions, do not apply to the management account, and do not override identity-based policies. Understanding these characteristics is essential for designing effective permission guardrails in AWS Organizations.

Answer

SCPs grant permissions to IAM users and roles, allowing them to perform actions they otherwise could not.

Answer

SCPs are evaluated before identity-based policies and can only restrict, not allow, permissions.

Answer

SCPs apply to all principals in an account, including the management account and service-linked roles.

Question 7

A security engineer needs to grant a Lambda function permission to read objects from an S3 bucket. The Lambda function assumes an IAM role. The engineer wants to follow the principle of least privilege and ensure that the role can only access the specific bucket and only for read operations. Which combination of policy elements should the engineer use?

Accepted Answer

An IAM policy attached to the role that allows s3:GetObject on the bucket's ARN, and a trust policy that allows lambda.amazonaws.com to assume the role.. To grant a Lambda function access to S3, you need an IAM role with a trust policy that allows the Lambda service to assume it, and an identity-based policy that grants the necessary permissions. Following least privilege, the policy should allow only s3:GetObject on the specific bucket ARN. This ensures the function can read objects but cannot perform other actions or access other buckets.

Answer

An IAM policy attached to the role that allows s3:GetObject on the bucket's ARN, and a resource-based policy on the bucket that allows the role.

Answer

An IAM policy attached to the role that allows s3:GetObject on the bucket's ARN, and a permissions boundary that allows s3:GetObject.

Answer

An IAM policy attached to the role that allows s3:* on all buckets, and a trust policy that allows lambda.amazonaws.com to assume the role.

Question 8

A security engineer is configuring a permissions boundary for a set of IAM roles used by developers. The developer roles have an identity-based policy that allows them to create and manage IAM users and policies. The engineer wants to ensure that the developers cannot escalate their own privileges. Which action should the engineer take?

Accepted Answer

Attach a permissions boundary that allows only the specific IAM actions required for their job, excluding privilege escalation actions.. A permissions boundary defines the maximum permissions an IAM entity can have. It is an advanced feature that does not grant permissions but limits them. By allowing only the necessary actions and excluding privilege escalation actions, the boundary ensures that even if the identity-based policy allows broader permissions, the effective permissions are the intersection, preventing the developers from escalating privileges.

Answer

Attach a permissions boundary that denies iam:CreateUser, iam:AttachUserPolicy, and iam:PutUserPolicy.

Answer

Create an IAM policy that denies iam:CreateUser, iam:AttachUserPolicy, and iam:PutUserPolicy and attach it to the developer roles.

Answer

Use an SCP to deny iam:CreateUser, iam:AttachUserPolicy, and iam:PutUserPolicy for the developers' account.

Question 9

A security engineer is auditing an AWS account and discovers that several IAM roles have overly permissive trust policies. The engineer wants to identify which of the following statements are true regarding IAM role trust policies and how they can be used to enhance security. (Choose two.)

Accepted Answer

A trust policy can restrict role assumption to a specific VPC endpoint using the aws:SourceVpce condition key.. Trust policies can enforce MFA and restrict role assumption to specific VPC endpoints using condition keys. These controls enhance security by ensuring that only authenticated and authorized requests can assume the role. Options that suggest trust policies grant resource permissions, attach to users, or safely use wildcard principals are incorrect because trust policies only define who can assume the role, and wildcard principals are overly permissive.

Answer

A trust policy can grant permissions to the role to access AWS resources.

Answer

A trust policy can specify a wildcard principal (*) to allow any AWS account to assume the role, which is secure if combined with an external ID condition.

Answer

A trust policy can be attached to an IAM user to allow the user to assume multiple roles.

Question 10

A developer needs to grant an IAM user read-only access to an S3 bucket named 'my-bucket'. Which policy should be attached to the IAM user?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::my-bucket/*"}]}. Option D grants s3:GetObject, which allows the IAM user to read (download) objects from the bucket. Although full read-only access typically includes s3:ListBucket to list objects, the question asks for read access, and s3:GetObject is the essential read action. Option A only allows listing, not reading object data. Option B grants full access, and option C grants write access. Thus, D is the best choice for read-only access.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::my-bucket"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:*","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:PutObject","Resource":"arn:aws:s3:::my-bucket/*"}]}

Question 11

A security engineer notices that an IAM role has a trust policy allowing any AWS account to assume it. Which attack is this misconfiguration most likely to enable?

Accepted Answer

Unauthorized access by an external attacker. An IAM role trust policy that allows any AWS account (i.e., `"Principal": {"AWS": "*"}`) to assume the role means that any user or service in any AWS account can call the STS `AssumeRole` API to obtain temporary credentials for the role. This directly enables unauthorized access by an external attacker who can discover the role ARN and assume it, gaining all permissions attached to the role.

Answer

Logging bypass via CloudTrail

Answer

Cross-service confused deputy attack

Answer

Privilege escalation by attaching additional policies

Question 12

A company wants to allow users from its corporate Active Directory to access AWS resources. The company has set up an IAM identity provider for SAML. What must be created in IAM to map users to permissions?

Accepted Answer

An IAM role with a trust policy for the SAML provider. A is correct because when using SAML-based federation, IAM roles are the mechanism to grant permissions to federated users. The role must have a trust policy that specifies the SAML identity provider as the principal, allowing users authenticated by the corporate Active Directory to assume the role and obtain temporary AWS credentials. This maps the SAML assertion attributes (such as the user's group or role) to IAM permissions via the role's permissions policy.

Answer

An OIDC identity provider

Answer

An IAM user for each Active Directory user

Answer

A federation role type

Question 13

An IAM policy has the following statement: {"Effect":"Deny","Action":"*","Resource":"*","Condition":{"Bool":{"aws:SecureTransport":"false"}}}. What does this policy achieve?

Accepted Answer

Denies all actions that are not made over HTTPS. This policy statement uses the `aws:SecureTransport` condition key with a `Bool` condition set to `false`. When the condition evaluates to true (i.e., the request is not using HTTPS/TLS), the `Deny` effect applies to all actions on all resources. This effectively denies any API call made over HTTP (non-secure transport), ensuring that only HTTPS requests are allowed. The policy does not explicitly allow anything; it only denies non-HTTPS traffic, so all actions are implicitly allowed when made over HTTPS.

Answer

Allows all actions only when using HTTPS

Answer

Enforces HTTPS for S3 bucket policies only

Answer

Blocks all actions for a specific AWS service

Question 14

A solutions architect needs to design a system where an EC2 instance can write logs to CloudWatch Logs. Which IAM entity should be used to grant permissions to the EC2 instance?

Accepted Answer

An IAM role with an instance profile. An IAM role with an instance profile is the correct approach because it allows the EC2 instance to assume temporary, rotated credentials via the AWS Security Token Service (STS). The instance profile is attached to the EC2 instance, and the AWS SDK or CLI automatically retrieves credentials from the instance metadata service (IMDS) to authenticate API calls to CloudWatch Logs. This eliminates the need to store long-term credentials on the instance and follows the principle of least privilege.

Answer

A resource-based policy on the EC2 instance

Answer

An IAM user with access keys stored on the instance

Answer

An IAM group

Question 15

A security administrator discovers that an IAM user has been deleted accidentally. What is the correct way to restore the user's access?

Accepted Answer

Create a new IAM user with the same name and attach the same policies. IAM does not support undeletion or restoration of deleted users. When an IAM user is deleted, all associated credentials, permissions, and metadata are permanently removed. The only way to restore access is to create a new IAM user with the same name and manually reattach the same policies, groups, and tags, and then regenerate access keys and passwords as needed.

Answer

Contact AWS Support to undo the deletion

Answer

Use the AWS IAM console to undelete the user

Answer

Restore the user from a backup of IAM