SCS-C02 Identity and Access Management Practice Test 11 — 15 Questions

Question 1

A company has an AWS Lambda function that processes sensitive data stored in an Amazon S3 bucket. The Lambda function needs to read objects from the S3 bucket and write results to a different S3 bucket. The security engineer is configuring IAM permissions for the Lambda execution role. The engineer wants to follow the principle of least privilege. The Lambda function is triggered by S3 events from the source bucket. The engineer creates an IAM policy that grants s3:GetObject on the source bucket and s3:PutObject on the destination bucket. However, when testing, the Lambda function fails with an access denied error when trying to process an object. The error message indicates that the Lambda function does not have permission to list the objects in the source bucket. The engineer checks the S3 event notification configuration and confirms that the event is configured correctly. What should the engineer do to resolve the issue?

Accepted Answer

Add s3:ListBucket permission for the source bucket to the Lambda execution role.. C: Correct – The Lambda function needs s3:ListBucket permission to list objects in the source bucket when triggered by S3 events; the event notification provides the object key but the function may still need list permission for certain operations (e.g., if it uses S3 batch operations or if the SDK performs a list). A: Incorrect – Adding s3:PutObject on the source bucket is unnecessary and grants extra permission. B: Incorrect – Granting full S3 access violates least privilege. D: Incorrect – The issue is not with the destination bucket; the error is about listing source bucket.

Answer

Add s3:GetObject permission for the destination bucket to the Lambda execution role.

Answer

Add s3:* permission for both buckets to the Lambda execution role.

Answer

Add s3:PutObject permission for the source bucket to the Lambda execution role.

Question 2

A company runs a critical application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application processes financial transactions and must store transaction logs in an Amazon S3 bucket. The security team requires that all API calls to AWS services are logged and that the logs are stored in a secure, tamper-proof manner. The team enables AWS CloudTrail to log management events and Amazon S3 server access logs for the S3 bucket. They also enable AWS Config to track resource changes. The compliance team wants to ensure that no one can disable CloudTrail logging or delete the CloudTrail log files. The security engineer proposes a solution using an SCP in AWS Organizations to deny actions that would disable CloudTrail or delete log files. However, the engineer is concerned that the SCP might be applied too broadly and affect legitimate administrative actions. The engineer wants to ensure that only the security team’s IAM role (SecurityAdminRole) can perform these restricted actions, while all other principals (including IAM users, roles, and the root user) are denied. The engineer creates an SCP that denies cloudtrail:StopLogging, cloudtrail:DeleteTrail, and s3:DeleteObject on the CloudTrail S3 bucket. The SCP includes a condition that allows the action if the principal is SecurityAdminRole. However, after applying the SCP, the security team finds that even SecurityAdminRole is unable to stop CloudTrail logging. What is the most likely cause of this issue?

Accepted Answer

The condition in the SCP is incorrectly scoped, causing the deny to apply to all principals including SecurityAdminRole.. C: Correct – The root user is not affected by SCPs by default, but if the condition incorrectly references the root user, it may block all principals including SecurityAdminRole. However, the more common issue is that the SCP was applied without an explicit allow for the SecurityAdminRole, or the condition was not properly scoped. In this scenario, the most likely cause is that the condition in the SCP is not correctly scoped to allow SecurityAdminRole. The SCP should use a condition like "StringNotEquals": {"aws:PrincipalArn": "arn:aws:iam::*:role/SecurityAdminRole"} to deny only when the principal is not that role. If the condition is incorrectly written, it may deny all principals. Alternatively, the SCP might be applied to the management account where root user cannot be denied, but the issue is that SecurityAdminRole is denied. The typical mistake is using "Deny" without a proper condition that excludes the allowed role. A: Incorrect – If the SCP is applied to the root OU, it applies to all accounts including the security team's account. B: Incorrect – S3 bucket policies can grant access, but if the SCP denies, the deny overrides. D: Incorrect – The correct answer is that the SCP is too restrictive; the condition is flawed.

Answer

The SCP is applied to the root organizational unit (OU), which includes the management account where the root user is not affected by SCPs.

Answer

The SecurityAdminRole does not have the necessary IAM permissions to stop CloudTrail logging.

Answer

The S3 bucket policy on the CloudTrail bucket denies access to the SecurityAdminRole.

Question 3

A company wants to allow its development team to have full access to Amazon S3 buckets that are tagged with 'Environment: Dev'. Which IAM policy element should be used to restrict access based on tags?

Accepted Answer

Use 'aws:ResourceTag' in the Condition element. Option B is correct because IAM policies can use Condition blocks with 'aws:ResourceTag' to restrict actions based on resource tags. Option A is incorrect because 'aws:RequestTag' is used to require specific tags on requests, not on resources. Option C is incorrect because 'aws:SourceTag' is not a valid condition key. Option D is incorrect because 'aws:PrincipalTag' is used to restrict based on the principal's tags.

Answer

Use 'aws:PrincipalTag' in the Condition element

Answer

Use 'aws:SourceTag' in the Condition element

Answer

Use 'aws:RequestTag' in the Condition element

Question 4

A security engineer is troubleshooting an issue where an IAM role used by an EC2 instance cannot access an S3 bucket, even though the role has an attached policy that grants s3:GetObject on the bucket. The bucket policy does not explicitly deny access. What is the most likely cause?

Accepted Answer

The bucket policy does not grant access to the IAM role. Option D is correct because for cross-account access or access from EC2, the bucket policy must explicitly grant access to the role. Option A is incorrect because explicit deny is not present. Option B is incorrect because the policy is attached to the role, not the user. Option C is incorrect because service control policies (SCPs) are not mentioned and would be an organization-level deny.

Answer

A service control policy (SCP) is denying access

Answer

The IAM policy is attached to the user instead of the role

Answer

The bucket has an explicit deny in its policy

Question 5

A company has multiple AWS accounts managed through AWS Organizations. The security team wants to enforce that all users must use multi-factor authentication (MFA) to access the AWS Management Console. Which combination of actions should the security team take to enforce this requirement?

Accepted Answer

Apply a service control policy (SCP) at the organization root that denies actions unless MFA is present. Option B is correct because a service control policy (SCP) can be applied to all accounts to deny access if MFA is not present. Option A is incorrect because IAM policies in individual accounts can be overridden by account administrators. Option C is incorrect because an SCP cannot directly enable MFA; it can only deny access. Option D is incorrect because while AWS CloudTrail can log, it does not enforce.

Answer

Use AWS CloudTrail to monitor and alert on console logins without MFA

Answer

Enable MFA through the AWS Account Management console for each account

Answer

Create an IAM policy in each account that denies access without MFA

Question 6

A company is designing an IAM policy to grant a group of developers access to manage EC2 instances and RDS databases. Which TWO actions should be included to follow the principle of least privilege?

Accepted Answer

ec2:StartInstances. Options B and C are correct because they specify the minimum actions needed. Option A is not a valid action. Option D is too broad. Option E is not a valid action.

Answer

rds:CreateDBInstance

Answer

ec2:CreateInstances

Answer

ec2:*

Question 7

A security engineer is reviewing an IAM policy that allows access to an S3 bucket. The policy includes a condition that checks 'aws:SourceIp'. However, users report they can still access the bucket from IP addresses not in the allowed list. Which THREE possible reasons could explain this behavior?

Accepted Answer

The policy is attached to an IAM role that is used by an AWS service, and the condition does not apply to service principals. Option C is correct because when an IAM role is assumed by an AWS service (e.g., AWS Lambda, EC2), the `aws:SourceIp` condition key does not apply to requests made by the service principal. The source IP address in such cases is the service's internal IP, not the end user's IP, and the condition is evaluated against the service's principal context, which does not include a source IP. This means the condition is effectively ignored for service-invoked actions, allowing access from any IP.

Answer

The policy is attached to an IAM group, but the user is not a member of that group

Answer

The 'aws:SourceIp' condition key is not supported for S3 actions

Question 8

A company wants to allow a Lambda function to read messages from an SQS queue and write logs to CloudWatch Logs. Which TWO IAM actions should be included in the Lambda execution role?

Accepted Answer

sqs:ReceiveMessage. Options B and D are correct because they are the specific actions needed. Option A is for writing to SQS, not reading. Option C is too broad for CloudWatch Logs. Option E is for deleting logs, which is not needed.

Answer

logs:DeleteLogGroup

Answer

cloudwatch:*

Answer

sqs:SendMessage

Question 9

Refer to the exhibit. An IAM policy is attached to a user. The user is trying to download an object from 'example-bucket' from an IP address of 10.1.1.1. What will happen?

Accepted Answer

Access is denied because the IP address is not in the allowed range. Option B is correct because the condition restricts access to the IP range 10.0.0.0/16, and the user's IP is outside that range, so access is denied by default. Option A is incorrect because the condition is evaluated. Option C is incorrect because there is no explicit deny. Option D is incorrect because the condition key is valid.

Answer

Access is denied because the policy does not include an explicit deny

Answer

Access is allowed because the condition key is misspelled

Answer

Access is allowed because the policy allows s3:GetObject

Question 10

Refer to the exhibit. A security engineer runs the 'simulate-custom-policy' command to test a policy. The output shows 'explicitDeny' for ec2:RunInstances. What is the most likely reason?

Accepted Answer

The policy does not include ec2:RunInstances in the Action list. Option A is correct because the policy only allows Describe actions, and RunInstances is not allowed, resulting in an explicit deny from the simulation. Option B is incorrect because the policy does not deny. Option C is incorrect because the policy allows Describe* but not RunInstances. Option D is incorrect because there is no resource restriction.

Answer

The policy includes an explicit Deny statement for ec2:RunInstances

Answer

The policy allows ec2:Describe* but the action ec2:RunInstances is not a Describe action

Answer

The policy uses a Resource of '*' which does not include the required resources

Question 11

Refer to the exhibit. This IAM policy is attached to a user. The user attempts to assume the AdminRole without using MFA. What is the result?

Accepted Answer

The user cannot assume the role because the Deny statement blocks all actions when MFA is not present. Option D is correct because the Deny statement applies to all actions if MFA is not present, so the AssumeRole action is denied. Option A is incorrect because the Allow statement is overridden by the Deny. Option B is incorrect because the Deny is explicit. Option C is incorrect because the Deny applies to all actions including AssumeRole.

Answer

The user can assume the role because the Allow statement grants it

Answer

The user can assume the role because the Deny statement does not apply to sts:AssumeRole

Answer

The user cannot assume the role because the Allow statement requires MFA

Question 12

A company uses AWS Organizations and wants to delegate administration of IAM Access Analyzer to a member account. Which AWS service should be used to enable this delegation?

Accepted Answer

AWS Organizations. Option A is correct because IAM Access Analyzer can be delegated through AWS Organizations. Option B is incorrect because AWS CloudTrail is for logging. Option C is incorrect because AWS Config is for resource compliance. Option D is incorrect because AWS Service Catalog is for creating and managing catalogs of IT services.

Answer

AWS Service Catalog

Answer

AWS CloudTrail

Answer

AWS Config

Question 13

A security engineer needs to ensure that an IAM role can only be assumed by a specific EC2 instance. The instance has a tag 'Environment=Production'. Which condition key should be used in the trust policy of the role?

Accepted Answer

ec2:ResourceTag. Option B is correct because 'aws:EC2InstanceSourceVPC' is not a valid key; the correct key is 'ec2:ResourceTag' to check instance tags. Option A is incorrect because 'aws:SourceArn' is used for services like Lambda. Option C is incorrect because 'aws:SourceAccount' checks the account. Option D is incorrect because 'aws:UserAgent' checks the user agent.

Answer

aws:SourceArn

Answer

aws:UserAgent

Answer

aws:SourceAccount

Question 14

A company has an S3 bucket with a bucket policy that grants access to a specific IAM role. The role is used by an application running on an EC2 instance. The application is unable to access the bucket, but the role can access other resources. What is the most likely cause?

Accepted Answer

The EC2 instance does not have an instance profile associated with the role. Option A is correct because an EC2 instance profile is required to provide the role to the instance. Option B is incorrect because the role can access other resources, so the trust policy is likely correct. Option C is incorrect because the bucket policy is not denying access, it's granting. Option D is incorrect because SCPs are not mentioned.

Answer

A service control policy (SCP) denies access to the bucket

Answer

The bucket policy denies access to the role

Answer

The role's trust policy does not allow EC2 to assume the role

Question 15

Refer to the exhibit. This is an S3 bucket policy. The CrossAccountRole in account 111111111111 has an IAM policy that allows s3:GetObject on 'my-bucket'. A user in account 111111111111 assumes the role and tries to get an object. What will happen?

Accepted Answer

Access is allowed because the bucket policy allows access to the role. Option A is correct because both the bucket policy and the IAM policy allow access, and there is no explicit deny. Option B is incorrect because the bucket policy grants access to the role. Option C is incorrect because both policies allow. Option D is incorrect because the bucket policy is valid.

Answer

Access is denied because the IAM policy does not grant access to the bucket

Answer

Access is denied because the bucket policy does not grant access to the user