SCS-C02 Identity and Access Management Practice Test 12 — 15 Questions

Question 1

Which FOUR are valid ways to restrict access to an S3 bucket using IAM policies? (Choose 4.)

Accepted Answer

Requiring server-side encryption using the 's3:x-amz-server-side-encryption' condition key. Options A, B, C, and E are all valid ways to restrict access to an S3 bucket using IAM policies. A: The 's3:x-amz-server-side-encryption' condition key can enforce server-side encryption in IAM policies. B: The 'aws:PrincipalOrgID' global condition key can be used in IAM identity-based policies to restrict access to principals from a specific AWS Organization. C: The 'aws:SourceVpc' condition key restricts requests to those originating from a specific VPC. E: The 'aws:SourceIp' condition key restricts access to specific IP addresses. Option D is incorrect because 's3:ResourceAccount' checks the account ID of the resource, not a specific bucket; bucket-specific restriction is done via the Resource element.

Answer

Using the 's3:ResourceAccount' condition key to restrict access to a specific bucket

Question 2

Which TWO are characteristics of an IAM role? (Choose 2.)

Accepted Answer

It does not have long-term access keys.. IAM roles do not have long-term access keys; they provide temporary security credentials when assumed. Option D is correct because roles provide temporary security credentials through AWS STS. Option A is incorrect because while a role can be used by an AWS service, it still requires an entity (user, service, or application) to assume it—a role is not 'without a user.' Option C is incorrect because roles can have attached permissions policies that define what actions are allowed. Option E is incorrect because a role is not tied to a specific IAM user; it can be assumed by multiple users, services, or federated identities.

Answer

It can be used to grant permissions to an AWS service without requiring a user.

Answer

It cannot have an attached permissions policy.

Answer

It is associated with a specific IAM user.

Question 3

A company has an AWS Lambda function that processes messages from an Amazon SQS queue. The Lambda function is configured with an execution role that has the following IAM policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "sqs:ReceiveMessage",
        "sqs:DeleteMessage",
        "sqs:GetQueueAttributes"
      ],
      "Resource": "arn:aws:sqs:us-east-1:123456789012:MyQueue"
    },
    {
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents"
      ],
      "Resource": "*"
    }
  ]
}

The Lambda function is also configured with an SQS trigger that uses the same queue. The function code tries to send a message to an Amazon SNS topic, but the send fails with an AccessDenied error. What is the most likely cause?

Accepted Answer

The Lambda execution role does not have permissions to publish to SNS.. The correct answer. The Lambda function's execution role grants permissions for SQS and CloudWatch Logs but does not include any SNS actions (e.g., sns:Publish). Therefore, when the function attempts to send a message to an SNS topic, the request fails with an AccessDenied error. Option A is incorrect because an SQS queue policy cannot deny Lambda from calling SNS; SQS and SNS are separate services. Option C is incorrect because the SNS topic policy might allow or deny, but the primary issue is the missing IAM permission on the Lambda role. Option D is incorrect because SQS does not need configuration for Lambda to call SNS; the Lambda function makes the SNS call directly.

Answer

The SQS queue has a resource-based policy that denies the Lambda function from sending to SNS.

Answer

The SNS topic has a resource-based policy that denies the Lambda function.

Answer

The SQS queue is not configured to allow the Lambda function to send messages to SNS.

Question 4

A company wants to grant a Lambda function access to write logs to CloudWatch Logs in the same AWS account. What is the BEST practice for granting this permission?

Accepted Answer

Create an IAM role with a policy allowing logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents, and attach it to the Lambda function. It follows the principle of least privilege by creating an IAM execution role with the required CloudWatch Logs permissions and attaching it to the Lambda function. This is the standard and secure method. Option A is incorrect because storing access keys in environment variables is insecure and violates best practices. Option B is incorrect because resource-based policies are used to grant other services access to invoke the Lambda function, not for Lambda to write to CloudWatch Logs. Option C is incorrect because using the root user credentials is highly insecure and unnecessary.

Answer

Store AWS access keys in the Lambda environment variables

Answer

Add a resource-based policy to the Lambda function to allow CloudWatch Logs to write logs

Answer

Use the AWS account root user credentials directly in the Lambda function

Question 5

A developer needs to allow an EC2 instance to read from a DynamoDB table named 'Orders' in the same account. The security team requires that the permissions be granted using an instance profile. Which steps should be taken?

Accepted Answer

Create an IAM role with a policy that allows dynamodb:GetItem on the 'Orders' table, create an instance profile, add the role to the profile, and launch the EC2 instance with the instance profile. The instance profile is created, the IAM role is attached, and the EC2 instance is launched with that profile. Option B is wrong because the role itself is not attached directly to the instance; the instance profile must be used. Option C is wrong because storing credentials on the instance is insecure. Option D is wrong because the instance profile is not just for the root user; the role is assumed automatically.

Answer

Create an instance profile and attach a policy to it, then launch the EC2 instance with the instance profile

Answer

Create an IAM role with the required policy, then attach the role directly to the EC2 instance during launch

Answer

Create an IAM user with programmatic access, store the access key in a secure S3 bucket, and have the EC2 instance retrieve the credentials at startup

Question 6

A security engineer needs to allow an IAM user to rotate their own access keys. Which TWO IAM actions must be allowed in the user's policy? (Choose TWO.)

Accepted Answer

iam:DeleteAccessKey. To rotate access keys, the user needs to create a new access key (iam:CreateAccessKey) and delete the old one (iam:DeleteAccessKey). Therefore, options B and E are correct. Option A (iam:GetAccessKeyLastUsed) is not required for rotation. Option C (iam:ListAccessKeys) is not strictly required, though it may be useful. Option D (iam:UpdateAccessKey) can change the status of a key but is not necessary for rotation.

Answer

iam:GetAccessKeyLastUsed

Answer

iam:ListAccessKeys

Answer

iam:UpdateAccessKey

Question 7

A company has an S3 bucket that contains sensitive data. The security team wants to enforce that all access to the bucket must use HTTPS and that requests originating from outside the corporate network (as defined by a specific IP range 203.0.113.0/24) must be denied. Which THREE conditions should be included in the S3 bucket policy? (Choose THREE.)

Accepted Answer

"Condition": {"Bool": {"aws:SecureTransport": "true"}}. Options C, D, and E are correct. Option C uses the `aws:SecureTransport` condition to enforce HTTPS, which matches the requirement to deny non-HTTPS requests. Option D is a complete Deny statement with the `NotIpAddress` condition specifying the corporate IP range; this denies requests from outside that range. Option E is also correct as a condition element that, when used in a Deny statement, effectively denies requests from non-corporate IPs. Options A and B are incorrect: Option A uses `IpAddress` with the corporate range, which would only allow that range but not deny others; Option B uses `aws:Referer`, which checks the referrer header and not the source IP, thus not meeting the requirement.

Answer

"Condition": {"IpAddress": {"aws:SourceIp": "203.0.113.0/24"}}

Answer

"Condition": {"StringLike": {"aws:Referer": "https://corporate.internal/*"}}

Question 8

A developer wants to allow an IAM role to be assumed by an EC2 instance that is part of an Auto Scaling group. Which TWO AWS services or features are required? (Choose TWO.)

Accepted Answer

Instance profile. An instance profile is required to attach an IAM role to an EC2 instance. When an EC2 instance is launched with an instance profile, the AWS credentials provider on the instance can retrieve temporary security credentials from the IAM role via the instance metadata service (IMDS). This allows the instance to assume the role and perform authorized API actions without embedding long-term credentials.

Answer

AWS Config

Answer

AWS CloudFormation

Answer

AWS Single Sign-On (SSO)

Question 9

A company uses AWS KMS to encrypt objects in an S3 bucket. The security team wants to ensure that only users with the appropriate KMS key permissions can decrypt objects. Which TWO conditions should be included in the S3 bucket policy to enforce this? (Choose TWO.)

Accepted Answer

"Condition": {"StringEquals": {"kms:ViaService": "s3.us-east-1.amazonaws.com"}}. Options A and E are the only distinct conditions that can be used in an S3 bucket policy to enforce that only users with appropriate KMS key permissions can decrypt objects. kms:ViaService restricts the use of the KMS key to requests coming via the S3 service, and kms:EncryptionContext restricts decryption to requests that include the specific S3 bucket ARN. Option C is identical to A and thus does not provide an additional constraint, making it redundant. Options B and D are not valid condition keys for S3 bucket policies.

Answer

"Condition": {"StringEquals": {"kms:KeySpec": "SYMMETRIC_DEFAULT"}}

Answer

"Condition": {"StringEquals": {"kms:ViaService": "s3.us-east-1.amazonaws.com"}}

Answer

"Condition": {"StringEquals": {"kms:GranteePrincipal": "arn:aws:iam::123456789012:role/Admin"}}

Question 10

An administrator runs the AWS CLI command shown in the exhibit. What does this command do?

Accepted Answer

Lists the managed policies attached to the role 'MyRole'. The command `aws iam list-attached-role-policies --role-name MyRole` lists the managed policies attached to the role named MyRole. Option C is correct. Option A is incorrect because the command outputs only policies attached to a specific role, not all policies in the account. Option B is incorrect because the command targets a role, not a user. Option D is incorrect because the command lists managed policies, not inline policies.

Answer

Lists all IAM policies in the account

Answer

Lists the managed policies attached to the user 'MyRole'

Answer

Lists all inline policies attached to the role 'MyRole'

Question 11

A large enterprise uses AWS Organizations to manage multiple accounts. The security team has implemented a Service Control Policy (SCP) at the root level that denies all actions unless the request originates from the corporate IP range (10.0.0.0/8). Recently, a developer in a member account tried to launch an EC2 instance from the AWS Management Console while connected via a VPN that provides an IP address within the corporate range. However, the launch failed with an 'AccessDenied' error. The developer is using an IAM user with full EC2 permissions (ec2:*). The SCP is as follows: {"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"*","Resource":"*","Condition":{"NotIpAddress":{"aws:SourceIp":"10.0.0.0/8"}}}]}. What is the MOST likely reason for the failure?

Accepted Answer

The aws:SourceIp condition key does not work correctly for requests made via the AWS Management Console because the console may use a different IP.. The SCP uses the aws:SourceIp condition, but when accessing the Management Console, the IP address seen by AWS is the console's IP, which may not be the same as the developer's VPN IP if the console uses a proxy or if the VPN is configured incorrectly. Option A is wrong because SCPs affect all principals, including the root user. Option B is wrong because the SCP denies actions, not allows them; an explicit deny overrides allows. Option D is wrong because the SCP denies all actions, so even if the developer has permissions, the SCP denies them.

Answer

The SCP allows actions only from the specified IP range, but the developer's IP is not in that range.

Answer

The SCP does not apply to IAM users in member accounts; it only applies to the root user.

Answer

The IAM user does not have the necessary permissions because the SCP explicitly denies all actions.

Question 12

A company has a requirement to grant cross-account access to an S3 bucket named 'shared-data' in Account A (111111111111) to users in Account B (222222222222). The security team has set up a bucket policy in Account A that grants read-only access to the IAM role 'DataReader' in Account B. The bucket policy is as follows: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::222222222222:role/DataReader"},"Action":["s3:GetObject"],"Resource":"arn:aws:s3:::shared-data/*"}]}. A user in Account B assumes the 'DataReader' role, but when trying to read an object from the bucket, they receive an 'Access Denied' error. What is the MOST likely reason for this error?

Accepted Answer

The IAM role 'DataReader' does not have an IAM policy that allows s3:GetObject on the bucket.. For cross-account S3 access, both the resource-based policy (bucket policy) in the owning account and the identity-based policy (IAM policy) attached to the IAM role in the accessing account must grant the necessary permissions. The bucket policy in Account A allows the 'DataReader' role to perform s3:GetObject, but the IAM role itself in Account B must also have an IAM policy that allows s3:GetObject on the bucket. Without this identity-based policy, the role lacks permission to perform the action, resulting in 'Access Denied'. Option A is incorrect because the bucket policy can specify an IAM role ARN as principal. Option B is incorrect because s3:ListBucket is not required to read objects; s3:GetObject is sufficient. Option D is incorrect because there is no mention of KMS encryption in the scenario, and even if there were, the issue is the missing IAM policy on the role.

Answer

The bucket policy principal must be the IAM user ARN, not the role ARN.

Answer

The bucket policy is missing the 's3:ListBucket' action, which is required to read objects.

Answer

The bucket objects are encrypted with a KMS key, and the role does not have permission to decrypt.

Question 13

A company runs a serverless application using AWS Lambda functions that access an Amazon DynamoDB table. The Lambda functions are part of a microservices architecture and need to read and write to the DynamoDB table. The security team wants to ensure that the Lambda functions have the minimum required permissions. Initially, the team attached the AWS managed policy 'AWSLambdaDynamoDBExecutionRole' to the Lambda execution role, but later discovered that this policy grants more permissions than needed. The team decides to create a custom policy with only the required actions: GetItem, PutItem, UpdateItem, and DeleteItem. However, after attaching the custom policy, the Lambda functions start failing with 'AccessDeniedException' when trying to access DynamoDB. The CloudWatch logs show that the Lambda function is unable to write logs to CloudWatch Logs. What is the MOST likely cause of the failures?

Accepted Answer

The custom policy does not include permissions for CloudWatch Logs actions (logs:CreateLogGroup, logs:CreateLogStream, logs:PutLogEvents), which are required for Lambda to write logs.. The custom policy only grants DynamoDB permissions but does not include permissions for CloudWatch Logs, which are needed for Lambda to write logs. The managed policy included both DynamoDB and CloudWatch Logs permissions. Option B is wrong because the Lambda function does not need VPC permissions unless it is in a VPC. Option C is wrong because the Lambda function does not need to list tables to perform read/write operations. Option D is wrong because the condition keys are not the issue; the problem is missing permissions.

Answer

The custom policy does not include dynamodb:ListTables, which is required for the DynamoDB SDK to work.

Answer

The DynamoDB table has a resource-based policy that denies access from Lambda functions without a specific condition key.

Answer

The Lambda function is attached to a VPC and requires permissions to create Elastic Network Interfaces (ec2:CreateNetworkInterface).

Question 14

A company is using Amazon API Gateway to expose a set of REST APIs. The APIs are backed by AWS Lambda functions. The security team wants to control access to the APIs using IAM authorization. The team has created an IAM policy for a group of developers that allows them to invoke the APIs only from within the corporate network (IP range 203.0.113.0/24). The policy is attached to an IAM group, and the developers are members of the group. However, when a developer tries to invoke the API from the corporate network, they receive a '403 Forbidden' error. The API Gateway endpoint is configured with IAM authorization. The IAM policy is as follows: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"execute-api:Invoke","Resource":"arn:aws:execute-api:us-east-1:123456789012:api-id/*","Condition":{"IpAddress":{"aws:SourceIp":"203.0.113.0/24"}}}]}. What is the MOST likely reason for the failure?

Accepted Answer

The resource ARN in the policy does not include the stage and method; it should be 'arn:aws:execute-api:us-east-1:123456789012:api-id/stage/GET/resource'.. The resource ARN in the IAM policy must include the stage and HTTP method to match the API Gateway endpoint. The current policy uses 'api-id/*', which is a wildcard but may not cover all paths correctly if the stage and method are not specified. In this case, the developers receive a 403 error because the policy's resource ARN does not match the actual API resource path. Option B is incorrect because IAM policies can be attached to groups, and the developers inherit them. Option C is incorrect because the 'aws:SourceIp' condition works with API Gateway IAM authorization. Option D is incorrect because API Gateway IAM authorization supports resource-level conditions; the issue is the resource ARN format.

Answer

The IAM policy must be attached directly to the IAM user, not to a group.

Answer

The condition key aws:SourceIp does not work for API Gateway; you must use a custom header.

Answer

API Gateway IAM authorization does not support resource-level conditions; you must use a Lambda authorizer.

Question 15

A security engineer is designing IAM policies for a data analytics platform that uses Amazon S3, Amazon Athena, and AWS Glue. The platform must allow data scientists to query data in S3 using Athena, but only from specific VPC subnets. Additionally, the data must be encrypted at rest using AWS KMS. Which TWO actions should the engineer take to meet these requirements? (Choose TWO.)

Accepted Answer

Grant kms:Decrypt permission in the IAM policy and configure the KMS key policy to allow the IAM role to use the key.. A: Correct – Granting kms:Decrypt permission in the IAM policy and ensuring the KMS key policy allows the IAM role enables Athena to decrypt S3 objects encrypted with a customer-managed KMS key. C: Correct – Creating a VPC endpoint for Athena (or S3) and attaching a bucket policy that restricts access to that endpoint ensures queries are only allowed from the specified VPC subnets. B: Incorrect – The s3:SourceIp condition key does not work for requests made via VPC endpoints; use aws:SourceVpce instead. D: Incorrect – The kms:EncryptionContext condition is not used for restricting encryption at rest; it is used for encryption context in KMS operations. E: Incorrect – SSE-S3 does not use KMS, so the KMS key policy would not be relevant.

Answer

Add kms:EncryptionContext condition to the IAM policy to require a specific encryption context.

Answer

Use the s3:SourceIp condition key in the IAM policy to restrict access to the private IP ranges of the VPC subnets.

Answer

Enable default encryption on the S3 bucket using SSE-S3 and configure the KMS key policy to allow the IAM role.