SCS-C02 Identity and Access Management Practice Test 10 — 15 Questions

Question 1

A company has an S3 bucket with a bucket policy that grants access to a specific IAM role. The role is used by an application running on an EC2 instance. The application is unable to access the bucket, but the role can access other resources. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The EC2 instance does not have an instance profile associated with the role. An EC2 instance must have an instance profile associated with the IAM role to grant the role's permissions to applications running on the instance. Without the instance profile, the application cannot inherit the role's permissions, even though the role itself can access other resources. Option A is incorrect because SCPs are not mentioned and would affect all resources in the account, not just the bucket. Option B is incorrect because the bucket policy grants access, not denies. Option D is incorrect because the role's trust policy is likely correct since the role can access other resources.

Answer

A service control policy (SCP) denies access to the bucket

Answer

The bucket policy denies access to the role

Answer

The role's trust policy does not allow EC2 to assume the role

Question 2

Refer to the exhibit. This is an S3 bucket policy. The CrossAccountRole in account 111111111111 has an IAM policy that allows s3:GetObject on 'my-bucket'. A user in account 111111111111 assumes the role and tries to get an object. What will happen?

Accepted Answer

Access is allowed because both the bucket policy and the IAM policy allow. Access is allowed only when both the bucket policy and the IAM policy grant the required permission. In this scenario, the bucket policy grants s3:GetObject to the CrossAccountRole, and the IAM policy attached to the role also allows s3:GetObject on the bucket. Therefore, both policies allow the action, making option C correct. Option A is incorrect because it states that the bucket policy alone is sufficient; however, the IAM policy must also allow access for the role. Option B is incorrect because the IAM policy does grant access. Option D is incorrect because the bucket policy grants access to the role (not the user directly, but the user assumes the role, so the role's permissions apply).

Answer

Access is allowed because the bucket policy allows access to the role

Answer

Access is denied because the IAM policy does not grant access to the bucket

Answer

Access is denied because the bucket policy does not grant access to the user

Question 3

A company needs to provide temporary credentials to mobile app users to access AWS resources. Which AWS service should be used to issue these credentials?

Accepted Answer

AWS Security Token Service (STS). AWS Security Token Service (STS) is specifically designed to issue temporary credentials for IAM users or federated users. Option A is incorrect because IAM is for managing users and roles, not for generating temporary credentials directly. Option B is incorrect because AWS Cognito is for user identity and authentication; while it can use STS to get temporary credentials, the primary service for issuing temporary credentials is STS. Option D is incorrect because KMS is for encryption key management.

Answer

AWS IAM

Answer

AWS Cognito

Answer

AWS Key Management Service (KMS)

Question 4

A security engineer discovers that an IAM policy allows 'iam:CreateUser' and 'iam:CreateAccessKey' for all users in the account. Which risk does this pose?

Accepted Answer

Users can create new IAM users and programmatic access keys. The IAM policy allows 'iam:CreateUser' and 'iam:CreateAccessKey', which enables users to create new IAM users and programmatic access keys, leading to unauthorized access and privilege escalation. Option B is incorrect because the policy does not grant permissions to disable CloudTrail logging. Option C is incorrect because creating users/keys does not allow decrypting data in S3. Option D is incorrect because it does not allow modifying VPC security groups.

Answer

Users can disable CloudTrail logging

Answer

Users can decrypt data in S3

Answer

Users can modify VPC security groups

Question 5

A company wants to allow an IAM user to list only the objects in a specific S3 bucket named 'my-bucket'. Which IAM policy statement should be used?

Accepted Answer

{"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::my-bucket"}. It grants the s3:ListBucket action on the bucket resource, which is required to list objects in a bucket without allowing other actions. Option A is incorrect because it grants s3:GetObject, which is for downloading objects, not listing. Option C is incorrect because it uses a resource ARN with a wildcard and a condition that is unnecessary and may prevent listing. Option D is incorrect because it grants all S3 actions, which is overly permissive.

Answer

{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::my-bucket/*"}

Answer

{"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::my-bucket/*","Condition":{"StringEquals":{"s3:prefix":""}}}

Answer

{"Effect":"Allow","Action":"s3:*","Resource":"arn:aws:s3:::my-bucket/*"}

Question 6

An IAM policy grants access to a DynamoDB table with a condition that the request must originate from a specific VPC endpoint. However, requests from an EC2 instance in that VPC are being denied. What is the most likely cause?

Accepted Answer

The EC2 instance is not using the VPC endpoint to access DynamoDB; it is using an internet gateway.. The IAM policy condition requires the request to originate from a specific VPC endpoint. If the EC2 instance accesses DynamoDB via an internet gateway instead of the VPC endpoint, the source IP will not match the VPC endpoint, causing denial even though the instance is in the same VPC. Option A is incorrect because a public IP is not required to use a VPC endpoint. Option B is incorrect because the security group's outbound rules affect network reachability, not the IAM condition on the VPC endpoint. Option D is incorrect because the VPC endpoint policy must allow the action, but the IAM condition is separate; the issue here is about the source not matching the VPC endpoint.

Answer

The EC2 instance does not have a public IP address.

Answer

The security group on the EC2 instance does not allow outbound traffic to the DynamoDB endpoint.

Answer

The VPC endpoint policy does not allow the specific DynamoDB action.

Question 7

A company uses cross-account IAM roles to allow a third-party auditor to access a specific S3 bucket. The auditor reports that they are getting 'Access Denied' errors when trying to list objects. The bucket policy allows access to the auditor's account. What additional configuration is needed?

Accepted Answer

Attach an IAM policy to the auditor's IAM user that allows s3:ListBucket on the specific bucket.. For cross-account access to an S3 bucket using a bucket policy, the bucket policy grants access to the entire AWS account (e.g., "AWS": "arn:aws:iam::auditor-account-id:root"). However, the IAM user or role in the auditor account must also have an IAM policy that allows the S3 action (e.g., s3:ListBucket). The auditor's IAM user lacks this identity-based policy, causing an 'Access Denied' error. Option C correctly identifies that an IAM policy must be attached to the auditor's IAM user to allow s3:ListBucket on the specific bucket. Option A is incorrect because modifying the trust policy is relevant for IAM role assumption, not for bucket policy-based access. Option B is incorrect because SCPs apply at the organizational level and are not the typical additional configuration needed for this specific issue; they could cause denial but the question asks for what additional configuration is needed given the bucket policy allows the account. Option D is incorrect because adding a bucket policy granting access to the auditor's IAM user ARN would work, but it is not necessary if the bucket policy already allows the entire account; the missing piece is the user's IAM policy.

Answer

Modify the trust policy of the IAM role to include the auditor's account.

Answer

Ensure the auditor's account does not have a service control policy (SCP) denying S3 actions.

Answer

Add a bucket policy that grants access to the auditor's IAM user ARN.

Question 8

A security administrator needs to ensure that all IAM users in the account use multi-factor authentication (MFA) to access the AWS Management Console. What is the most effective way to enforce this?

Accepted Answer

Create an IAM policy that denies all actions unless MFA is present, and attach it to all users.. Attaching an IAM policy that denies all actions unless MFA is present (using the condition 'aws:MultiFactorAuthPresent':'true') to all users ensures MFA is required for console access. Option A is wrong because the password policy cannot enforce MFA for console access. Option B is wrong because while SCPs can deny access, the condition must be properly set in a policy attached to users or groups for the most effective enforcement. Option C is wrong because requiring users to use root credentials is not a secure or practical approach.

Answer

Set the IAM password policy to require MFA.

Answer

Use an SCP to deny access if MFA is not present, with a condition "aws:MultiFactorAuthPresent":"true".

Answer

Enable MFA for the root user and require all IAM users to use the root user credentials.

Question 9

A company has an IAM policy that allows a user to launch EC2 instances only in a specific Availability Zone (us-east-1a). The user is able to launch instances, but the instances are launched in us-east-1b instead. What is the most likely reason?

Accepted Answer

The policy uses the condition key "aws:RequestedAvailabilityZone" which is not valid; it should be "ec2:AvailabilityZone".. The condition key "aws:RequestedAvailabilityZone" is not a valid AWS condition key for EC2 actions. The proper condition key to restrict an Availability Zone is "ec2:AvailabilityZone". If the policy uses an invalid key, the condition is never evaluated, so the policy effectively allows launching instances in any AZ. Options A, B, and C are less likely because they describe scenarios that would either still allow enforcement or are not as common a mistake.

Answer

The policy is not attached to the user; it is attached to a group.

Answer

The user is using an IAM role that overrides the policy.

Answer

The policy uses a condition with ec2:Region instead of ec2:AvailabilityZone.

Question 10

An organization uses AWS KMS to encrypt S3 objects. They want to allow a developer to decrypt objects only if the request comes from a specific IP address range. Which IAM policy condition should be used?

Accepted Answer

Condition with kms:ViaService and aws:SourceIp.. Kms:ViaService ensures the KMS request is made through an integrated AWS service (in this case, S3), and aws:SourceIp restricts the request to a specific IP address range. Option A is incorrect because kms:GrantOperations is used for managing grants, not for restricting based on IP or service. Option B is incorrect because kms:CallerAccount checks the account number of the caller, not the IP. Option C is incorrect because kms:EncryptionContext is used to specify encryption context, not for IP restrictions.

Answer

Condition with kms:GrantOperations and aws:SourceIp.

Answer

Condition with kms:CallerAccount and aws:SourceIp.

Answer

Condition with kms:EncryptionContext and aws:SourceIp.

Question 11

A security engineer needs to design a system where an EC2 instance can write logs to a CloudWatch log group. Which TWO steps are required?

Accepted Answer

Attach the IAM role to the EC2 instance profile.. The correct steps are to create an IAM role with the necessary CloudWatch Logs permissions (logs:CreateLogStream and logs:PutLogEvents) and attach that role to the EC2 instance profile. This grants the EC2 instance the ability to write logs to CloudWatch Logs without needing a resource policy or encryption configuration. The CloudWatch agent is not required for writing logs via the AWS SDK or CLI, but the IAM role is essential. Options A and C are not required; server-side encryption is optional, and CloudWatch log groups do not support resource policies for EC2 instances. Option D is incorrect because the CloudWatch agent is not strictly required for writing logs, though it is commonly used.

Answer

Enable server-side encryption for the log group.

Answer

Create a CloudWatch log group resource policy that allows the EC2 instance to write logs.

Answer

Install and configure the CloudWatch agent on the EC2 instance.

Question 12

A company wants to enforce that all IAM users in an AWS Organization must have a password policy that includes a minimum length of 12 characters. Which THREE steps are part of implementing this using SCPs?

Accepted Answer

Include a condition in the SCP that checks if the requested minimum password length is less than 12.. Options A, D, and E are correct. Option A is correct because you can use a condition in the SCP to deny changes to the password policy if the minimum length is less than 12; for example, using a condition like `aws:RequestedRegion` is not relevant here. Option D is correct because SCPs can deny the `iam:UpdateAccountPasswordPolicy` action, effectively preventing users from modifying the policy. Option E is correct because attaching the SCP to the root OU ensures it applies to all accounts in the organization. Option B is incorrect because IAM is a global service and cannot be restricted to a specific Region via SCPs. Option C is incorrect because SCPs cannot directly set a password policy; they only allow or deny actions.

Answer

Use an SCP condition to restrict password policy changes to a specific Region.

Answer

Write an SCP that sets the password policy to require minimum length 12.

Question 13

An IAM user has the policy shown in the exhibit. The user tries to launch an m5.large instance in us-east-1, but gets an 'AccessDenied' error. Why does this happen?

Accepted Answer

The policy restricts RunInstances to instance type t2.micro, but the user requested m5.large.. The policy only allows RunInstances for instance type t2.micro, so requesting m5.large results in an AccessDenied error. Option A correctly identifies that the user requested an instance type that is not allowed. Option B is incorrect because the condition StringEquals is correctly applied and the issue is not case sensitivity but the value mismatch. Option C is incorrect because the policy does allow RunInstances for the allowed instance type. Option D is incorrect because the resource ARN is valid for EC2 instances.

Answer

The condition uses StringEquals, which is case-sensitive and the instance type is in the wrong case.

Answer

The policy does not allow the RunInstances action at all.

Answer

The resource ARN in the policy is incorrect for launching instances.

Question 14

An IAM administrator ran the simulate-custom-policy command shown in the exhibit. The result shows an 'explicitDeny' for s3:ListBucket. What is the most likely reason?

Accepted Answer

The policy does not include an action that allows s3:ListBucket, so it is implicitly denied.. The policy does not allow s3:ListBucket, so it is implicitly denied; but the simulator shows 'explicitDeny' because there might be an attached policy that denies it. However, in this simulation, the policy only allows s3:GetObject, so ListBucket is not allowed. The 'explicitDeny' could be due to an SCP or a different policy attached to the user. Option A is wrong because the resource ARN is correct. Option B is wrong because the policy does not include ListBucket. Option D is wrong because the action is spelled correctly.

Answer

The simulation incorrectly evaluates the policy due to a syntax error.

Answer

The resource ARN for ListBucket is incorrect; it should include a wildcard.

Answer

The s3:ListBucket action is not valid for S3.

Question 15

An IAM policy allows the iam:PassRole action for a specific role only when the role is passed to EC2. A developer tries to launch an EC2 instance with this role, but fails. What is the most likely missing permission?

Accepted Answer

The developer does not have ec2:RunInstances permission.. The developer must have the ec2:RunInstances permission to launch an EC2 instance. The iam:PassRole permission is only part of the process; without RunInstances, the launch fails. Option B is incorrect because the role already exists. Option C is incorrect because the policy explicitly grants iam:PassRole for that role to EC2, so the permission is present. Option D is incorrect because the condition using 'ec2.amazonaws.com' is correct for allowing PassRole to EC2; the issue is not with the condition but with the missing RunInstances permission.

Answer

The developer needs to create the role first.

Answer

The developer does not have iam:PassRole permission for the role.

Answer

The condition in the policy is incorrect; it should use 'ec2.amazonaws.com' as the service.