SCS-C02 Identity and Access Management Practice Test 11 — 15 Questions

Question 1

Which THREE statements about IAM roles are correct? (Choose THREE.)

Accepted Answer

IAM roles can be used by federated users.. The correct answers are A, D, and E. IAM roles can be used by federated users (A), can be assumed by AWS services (D), and are global entities not tied to a specific region (E). Option B is incorrect because IAM roles are commonly used for cross-account access. Option C is incorrect because roles are not attached to IAM users directly; instead, users assume roles.

Answer

IAM roles cannot be used for cross-account access.

Answer

IAM roles can be attached to an IAM user.

Question 2

A developer needs to allow an EC2 instance to access an S3 bucket. Which is the best practice for granting permissions?

Accepted Answer

Create an IAM role with S3 access and attach it to the EC2 instance profile.. An IAM role with S3 access attached to the EC2 instance profile provides temporary credentials via the instance metadata service, eliminating the need for long-term access keys. Option A is wrong because storing IAM user access keys on the instance is insecure and violates best practices. Option B is wrong because security groups control network traffic, not IAM permissions. Option C is wrong because an S3 bucket policy cannot grant access based on an EC2 instance ID; the principal must be an IAM user, role, or AWS account.

Answer

Store IAM user access keys in a configuration file on the EC2 instance.

Answer

Use a security group to allow the EC2 instance to access S3.

Answer

Attach an S3 bucket policy that grants access to the EC2 instance ID.

Question 3

A security engineer notices that an IAM user has permissions to create new IAM users and attach policies. What is the most effective way to detect if this user created a backdoor user?

Accepted Answer

Enable AWS CloudTrail and monitor IAM events using Amazon CloudWatch Logs and create a metric filter for CreateUser and AttachUserPolicy events.. AWS CloudTrail logs all IAM API calls, enabling detection of user creation and policy attachment. Option A is wrong because S3 access logs track object-level access, not IAM actions. Option B is wrong because IAM Access Analyzer focuses on resource policies, not user actions. Option C is wrong because AWS Config rules evaluate resource configurations (compliance), not API calls.

Answer

Review S3 access logs for any PutObject calls from the IAM user.

Answer

Use IAM Access Analyzer to review all IAM policies for potential backdoor access.

Answer

Configure an AWS Config rule to check for IAM users with administrative policies.

Question 4

A security team wants to grant a Lambda function access to read from a DynamoDB table in the same account. What is the most secure way to do this?

Accepted Answer

Create an IAM role with a policy that allows only the required DynamoDB actions (e.g., GetItem, Query) on the specific table and assign it to the Lambda function.. The most secure method is D because it follows the principle of least privilege by creating a custom IAM role that grants only the necessary DynamoDB actions (like GetItem, Query) on the specific table. This limits the Lambda function's permissions to only what is required. Option A is incorrect because a VPC endpoint allows network access to DynamoDB but does not grant IAM permissions; the Lambda function still needs an IAM role with appropriate permissions. Option B is incorrect because attaching the managed policy AmazonDynamoDBFullAccess grants full access to all DynamoDB resources, violating least privilege and increasing security risk. Option C is incorrect because storing database access keys in Lambda environment variables exposes credentials and is insecure; the recommended approach is to use an IAM execution role.

Answer

Create a VPC endpoint for DynamoDB and associate it with the Lambda function.

Answer

Attach the AWS managed policy AmazonDynamoDBFullAccess to the Lambda execution role.

Answer

Store the database access keys in the Lambda environment variables.

Question 5

A company wants to allow users to assume a role in another AWS account to access a specific S3 bucket. What must be configured?

Accepted Answer

An IAM role with a trust policy allowing the user's account and a bucket policy granting the role access to the bucket.. Both the trust policy (in the account with the role) and the resource-based policy (on the bucket) must allow access. Option A is wrong because a trust policy alone is insufficient; the bucket policy must also grant access. Option B is wrong because the bucket policy alone is insufficient; the role trust policy must allow the user to assume the role. Option D is wrong because resource-based policies alone cannot grant cross-account role assumption.

Answer

A trust policy on the IAM role that allows the user's account to assume the role.

Answer

An S3 bucket policy that allows the user to access the bucket.

Answer

A resource-based policy on the S3 bucket that allows the user's account.

Question 6

A security engineer is designing a system to allow an EC2 instance to write logs to an S3 bucket. Which TWO steps are required?

Accepted Answer

Add a bucket policy that allows the IAM role to perform s3:PutObject.. Options C and D are correct. The EC2 instance needs an IAM role with permissions to write to the bucket (D), and the bucket policy must allow the role to write (C). Option A is incorrect because a security group controls network traffic but does not grant IAM permissions. Option B is incorrect because a VPC endpoint provides private connectivity but is not required for this task. Option E is incorrect because CloudTrail is for API logging, not application logs.

Answer

Configure the security group of the EC2 instance to allow outbound HTTPS traffic to S3.

Answer

Create a VPC endpoint for S3 in the same subnet as the EC2 instance.

Answer

Enable AWS CloudTrail to capture log write events.

Question 7

An organization wants to enforce that all IAM users must use MFA to access the AWS API. Which TWO steps should be taken?

Accepted Answer

Attach the policy to all IAM users or to a group that all users belong to.. Options B and C are correct. An IAM policy with a condition that denies access if MFA is not present (C) must be attached to all users or groups (B). Option A is wrong because rotating access keys does not enforce MFA. Option D is wrong because password policy only affects console login. Option E is wrong because SCPs cannot enforce MFA for IAM users in the same account; they apply to member accounts.

Answer

Rotate all IAM user access keys.

Answer

Configure the account password policy to require MFA.

Answer

Create a service control policy (SCP) that requires MFA for all API calls.

Question 8

A company wants to grant a set of developers the ability to launch EC2 instances but only in a specific subnet. Which THREE steps should be taken?

Accepted Answer

Add a condition to the policy that restricts the subnet ID using ec2:Subnet.. To grant developers the ability to launch EC2 instances only in a specific subnet, you need to create an IAM role with a policy that allows ec2:RunInstances (E) and add a condition to restrict the subnet ID using ec2:Subnet (B). The developers must be allowed to assume this role via an IAM policy or trust relationship (C). Option A is incorrect because a VPC endpoint does not grant IAM permissions; it provides private connectivity. Option D is incorrect because security groups control network traffic, not IAM permissions.

Answer

Create a VPC endpoint for EC2.

Answer

Configure a security group to allow outbound traffic from the subnet.

Question 9

A company has an S3 bucket that contains sensitive data. The security team wants to ensure that all objects uploaded to the bucket are encrypted at rest using server-side encryption with AWS KMS (SSE-KMS). What should the security team do to enforce this requirement?

Accepted Answer

Use an S3 bucket policy with a condition that denies PutObject if the x-amz-server-side-encryption header is not set to 'aws:kms'.. An S3 bucket policy with a condition that denies PutObject requests unless the x-amz-server-side-encryption header is set to 'aws:kms' ensures that only objects encrypted with SSE-KMS can be uploaded. Option A is incorrect because requiring a specific KMS key ID is not necessary; the policy should enforce the use of SSE-KMS, not a specific key. Option B is incorrect because requiring the header to be present does not enforce SSE-KMS; it could be 'AES256' for SSE-S3. Option C is incorrect because default encryption only encrypts objects that lack encryption headers; it does not prevent uploads that specify SSE-S3 or no encryption.

Answer

Use an S3 bucket policy that requires the x-amz-server-side-encryption-aws-kms-key-id header to match a specific KMS key.

Answer

Use an S3 bucket policy with a condition that requires the x-amz-server-side-encryption header to be present.

Answer

Configure the bucket's default encryption to use SSE-KMS.

Question 10

An AWS Lambda function needs to read from a DynamoDB table. What is the best practice for granting the Lambda function the necessary permissions?

Accepted Answer

Create an IAM role with the necessary permissions and attach it as the Lambda function's execution role.. Attaching an IAM role as the Lambda function's execution role is the standard and secure method for granting permissions to AWS services. The Lambda service assumes the role to obtain temporary credentials for accessing DynamoDB. Option A is wrong because resource-based policies are used for services like S3 buckets or SQS queues, not for DynamoDB table access by Lambda. Option B is wrong because IAM users are for human identities, not for service-to-service access; using an execution role is the proper approach. Option D is wrong because embedding credentials in code is insecure and violates best practices.

Answer

Use a resource-based policy on the DynamoDB table to allow the Lambda function.

Answer

Create an IAM user with the necessary permissions and assign it to the Lambda function.

Answer

Embed the IAM user's access key and secret key in the Lambda function code.

Question 11

A company wants to allow cross-account access to an S3 bucket in Account A for a user in Account B. What is the correct combination of steps?

Accepted Answer

Add a bucket policy in Account A allowing access to the user in Account B, and attach an IAM policy to the user in Account B allowing access to the bucket.. Cross-account access to an S3 bucket requires two key permissions: a resource-based policy (bucket policy) in the owning account (Account A) that grants access to the specific IAM user in Account B, and an identity-based policy (IAM policy) attached to that user in Account B that permits the necessary S3 actions. Option A correctly describes this combination. Option D grants the bucket policy to the entire Account B, which may work but is less secure and not the recommended least-privilege approach; furthermore, the bucket policy to 'Account B' alone does not grant access to a specific user unless accompanied by the correct IAM policy, but the phrasing is ambiguous and not as precise as Option A. Option B suggests using an IAM role in Account A, which would require the user to assume the role, a different pattern not matching the question's scenario. Option C is incorrect because the user in Account B must have an explicit IAM policy; the bucket policy alone is insufficient.

Answer

Create an IAM role in Account A with access to the bucket, and have the user in Account B assume that role.

Answer

Add a bucket policy in Account A allowing access to Account B, and no action is needed in Account B because the user already has permissions.

Answer

Add a bucket policy in Account A allowing access to Account B, and attach an IAM policy to the user in Account B allowing access to the bucket.

Question 12

A security team needs to audit all changes to IAM resources in their AWS account. Which AWS service should they use?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls made in the AWS account, including changes to IAM resources. Therefore, option B is correct. Option A is wrong because VPC Flow Logs capture network traffic, not IAM changes. Option C is wrong because AWS Config records resource configuration changes but does not capture all API calls; it can be used to track IAM changes but CloudTrail is the primary service for API audit. Option D is wrong because CloudWatch Logs stores logs from various sources but does not capture API calls by default; it can be integrated with CloudTrail but is not the service that directly records IAM changes.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 13

An IAM user reports that they are unable to launch an EC2 instance in a specific VPC. The user has an IAM policy that allows ec2:RunInstances but does not grant permission for the subnet resource. The VPC has a network ACL that allows all inbound and outbound traffic. What is the most likely cause of the failure?

Accepted Answer

The IAM policy does not grant permission to use the subnet.. To launch an instance into a specific subnet, the IAM user needs permission for the subnet resource (ec2:Subnet) in addition to the ec2:RunInstances action. Even though the policy allows ec2:RunInstances for all resources, if the policy does not also grant permission for the subnet, the launch will fail. Option A is incorrect because the VPC itself is not a resource that requires IAM permission for RunInstances; the subnet is the resource. Option B is incorrect because security groups do not affect the ability to launch an instance; they only control traffic to/from the instance after launch. Option D is incorrect because network ACLs operate at the subnet level and do not prevent the launch request; they filter traffic after the instance is running.

Answer

The IAM policy does not grant permission to use the VPC.

Answer

The security group associated with the instance is blocking the launch.

Answer

The network ACL is blocking the launch request.

Question 14

Which TWO actions are valid ways to grant an IAM user in Account A access to an S3 bucket in Account B? (Choose 2.)

Accepted Answer

Add a bucket policy in Account B that grants access to the user's ARN in Account A.. Options B and D are correct. B: A bucket policy can grant cross-account access to a specific user. D: A role in Account B can be assumed by the user in Account A. Option A is wrong because IAM policies in Account A cannot grant access to resources in another account; the resource account must also grant access. Option C is wrong because SCPs are used in AWS Organizations to set permissions boundaries, not to grant access across accounts. Option E is wrong because you cannot attach an IAM policy to an S3 bucket; you use bucket policies instead.

Answer

Attach an IAM policy to the user in Account A that allows access to the S3 bucket.

Answer

Use a service control policy (SCP) in Account B to allow access from Account A.

Answer

Add an IAM policy to the S3 bucket in Account B granting access to the user.

Question 15

Which TWO are valid IAM identity-based policies? (Choose 2.)

Accepted Answer

Inline policy. Options B and E are correct. Inline policies are identity-based policies that are embedded directly in an IAM user, group, or role. AWS managed policies are standalone identity-based policies that are created and managed by AWS. Option A is wrong because a trust policy is a resource-based policy attached to a role to define trust relationships. Option C is wrong because an S3 bucket policy is a resource-based policy attached to an S3 bucket. Option D is wrong because a service control policy (SCP) is an organization-level policy used in AWS Organizations, not an identity-based policy.

Answer

Trust policy

Answer

S3 bucket policy

Answer

Service control policy (SCP)