SCS-C02 Identity and Access Management Practice Test 13 — 15 Questions

Question 1

A security engineer needs to restrict access to an S3 bucket so that only requests from a specific VPC endpoint are allowed. Which condition must be configured?

Accepted Answer

aws:SourceVpce. To restrict access to an S3 bucket so that only requests from a specific VPC endpoint are allowed, the condition key aws:SourceVpce must be used in the bucket policy. This condition checks that the request originates from the specified VPC endpoint ID. Option D (aws:SourceVpc) is incorrect because it allows all traffic from the entire VPC, not just the endpoint. The other options (aws:SourceIp, aws:UserAgent, aws:Referer) are not relevant for VPC endpoint-based restrictions.

Answer

aws:SourceIp

Answer

aws:UserAgent

Answer

aws:SourceVpc

Answer

aws:Referer

Question 2

An IAM policy includes the following statement: 'Effect': 'Allow', 'Action': 's3:GetObject', 'Resource': 'arn:aws:s3:::example-bucket/*', 'Condition': {'IpAddress': {'aws:SourceIp': '192.0.2.0/24'}}. Which TWO statements about this policy are correct?

Accepted Answer

Requests from outside 192.0.2.0/24 will be implicitly denied.. The policy explicitly allows s3:GetObject but only when the condition aws:SourceIp matches 192.0.2.0/24. Any request that does not satisfy the condition (e.g., from a different IP) is implicitly denied by default. Option B correctly states that requests from outside the IP range are implicitly denied, and option E correctly states that the policy allows s3:GetObject from the specified IP range. Options A, C, and D are incorrect because the policy does not allow s3:PutObject, does not check bucket owner, and does not grant anonymous access (it still requires an IAM principal).

Answer

The policy allows s3:PutObject from the IP range 192.0.2.0/24.

Answer

The policy allows s3:GetObject only if the bucket owner matches.

Answer

The policy allows anonymous access.

Question 3

A company wants to enforce that all IAM users must use multi-factor authentication (MFA) to access the AWS Management Console. Which THREE steps should the company take?

Accepted Answer

Create an IAM policy that denies all actions if aws:MultiFactorAuthPresent is false.. The correct steps are to enable MFA for each IAM user (E), create an IAM policy that denies all actions if `aws:MultiFactorAuthPresent` is false (A), and attach the policy to all IAM users or groups (C). Enabling MFA per user is a prerequisite. The policy enforces MFA usage by denying API calls when MFA is not present. Attaching the policy ensures it applies to users. Option B (CloudTrail) is for auditing, not enforcement. Option D (password policy) does not enforce MFA for console access; it only sets password requirements.

Answer

Enable CloudTrail to monitor MFA usage.

Answer

Set the password policy to require MFA.

Question 4

Refer to the exhibit. A developer is trying to list objects in an S3 bucket from an AWS environment. What is the most likely cause of the error?

Accepted Answer

The developer is using the wrong CLI tool (gsutil instead of aws s3).. The error occurs because the developer is using gsutil, a command-line tool for Google Cloud Storage, instead of aws s3, which is the correct CLI tool for interacting with Amazon S3. Using gsutil to access an S3 bucket will fail, hence the error.

Answer

The bucket name is incorrect.

Answer

The IAM role does not have S3 permissions.

Answer

The S3 bucket policy does not allow the user.

Question 5

Refer to the exhibit. This trust policy is attached to an IAM role. What does it allow?

Accepted Answer

The root user of account 123456789012 to assume the role only if MFA is present.. The trust policy specifies the root user of account 123456789012 and includes a condition requiring MFA. Option A is incorrect because the policy applies to the root user, not all IAM users. Option B is incorrect because the policy requires MFA, so the root user cannot assume the role without MFA. Option D is incorrect because the policy does not allow any user and requires MFA.

Answer

All IAM users in account 123456789012 to assume the role with MFA.

Answer

The root user of account 123456789012 to assume the role without MFA.

Answer

Any user in account 123456789012 to assume the role without MFA.

Question 6

A company is using IAM roles to grant EC2 instances access to an S3 bucket. The security team wants to ensure that the instances can only access their own bucket. Which policy should be attached to the IAM role to enforce this?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::my-bucket/*"}]}. The correct approach is to restrict the IAM role's permissions to only the specific S3 bucket. Option D uses a resource ARN that limits access to the 'my-bucket' bucket, ensuring instances can only access their own bucket. Option A allows all S3 actions on all resources, which is too permissive. Option B allows GetObject on all resources, not restricted to a specific bucket. Option C uses an IP address condition, which is not applicable for EC2 instances because they access S3 via the IAM role, not a specific source IP. Therefore, only option D correctly enforces the requirement.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:*","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"*","Condition":{"IpAddress":{"aws:SourceIp":"10.0.0.0/16"}}}]}

Question 7

A developer needs to allow an IAM user to manage their own password in the AWS Management Console. Which IAM policy should be attached to the user?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"iam:ChangePassword","Resource":"arn:aws:iam::*:user/${aws:username}"}]}. It uses the aws:username policy variable to restrict the iam:ChangePassword action to the user's own ARN, allowing the user to change only their own password. Option A is incorrect because it allows any IAM user to change any password. Option B is incorrect because it only allows the user to list users, not change passwords. Option C is incorrect because it denies the ability to change any password.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"iam:ChangePassword","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"iam:ListUsers","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"iam:ChangePassword","Resource":"*"}]}

Question 8

A company has multiple AWS accounts and wants to allow a user in the production account to assume a role in the development account. The role in the development account has a trust policy that allows the production account to assume it. What additional configuration is required?

Accepted Answer

Attach a policy to the user in the production account allowing sts:AssumeRole for the development role ARN.. The user in the production account must have an IAM policy that allows sts:AssumeRole targeting the development account role ARN. Option B is wrong because the trust policy is already set. Option C is wrong because the role must be created in the development account. Option D is wrong because the trust policy should reference the production account.

Answer

Modify the trust policy of the role in the development account to allow the user ARN instead of the account ARN.

Answer

Set up a VPC peering connection between the accounts.

Answer

Create a new IAM user in the development account with the same name.

Question 9

An organization wants to enforce multi-factor authentication (MFA) for all IAM users who perform sensitive actions. Which condition key should be used in an IAM policy to require MFA?

Accepted Answer

aws:MultiFactorAuthPresent. Aws:MultiFactorAuthPresent is the IAM condition key that checks whether multi-factor authentication (MFA) was used for the request. Option A (aws:SourceIp) is incorrect because it checks the IP address of the requester, not MFA status. Option C (aws:UserAgent) is incorrect because it checks the user agent string, not MFA. Option D (aws:CurrentTime) is incorrect because it checks the date and time of the request, not MFA.

Answer

aws:SourceIp

Answer

aws:UserAgent

Answer

aws:CurrentTime

Question 10

A security engineer notices that an IAM role allows an EC2 instance to access a DynamoDB table. The instance is compromised. What is the best way to immediately revoke the instance's access without affecting other resources that use the same role?

Accepted Answer

Attach a permissions boundary to the role that denies all DynamoDB actions.. Attaching a permissions boundary to the role that denies all DynamoDB actions immediately revokes the instance's access to DynamoDB without affecting other resources using the same role, provided those resources do not require DynamoDB access. Option B is wrong because stopping the instance does not revoke access; it only stops the instance, and access could resume when it restarts. Option C is wrong because modifying the trust policy to deny the instance's ARN would prevent the instance from assuming the role entirely, but it could take effect only after the current session ends and may not be immediate, and it does not address the compromised instance's ongoing session. Option D is wrong because deleting the role would affect all resources using that role.

Answer

Stop the EC2 instance.

Answer

Modify the trust policy of the role to deny the instance's ARN.

Answer

Delete the IAM role.

Question 11

A company wants to allow a Lambda function to read objects from an S3 bucket in the same account. What should be done?

Accepted Answer

Create an IAM role with an S3 read policy and attach it to the Lambda function.. Lambda functions require an IAM role (execution role) to obtain temporary AWS credentials via the AWS Security Token Service (STS). Attaching a policy with s3:GetObject permissions to this role grants the Lambda function the necessary access to read objects from the S3 bucket without hardcoding long-term credentials.

Answer

Store IAM user access keys in the Lambda function's environment variables.

Answer

Add a bucket policy allowing s3:GetObject for the Lambda service principal.

Answer

Configure the S3 bucket to be public.

Question 12

A company has an S3 bucket with a bucket policy that grants access to an IAM role. The security team wants to restrict access to only requests that originate from the company's VPC. How can this be achieved?

Accepted Answer

Add a condition in the bucket policy using aws:SourceVpce with the VPC endpoint ID.. To restrict S3 bucket access to only requests from the company's VPC, you must use a VPC endpoint for S3 (Gateway Endpoint) and add a condition in the bucket policy using the aws:SourceVpce key with the VPC endpoint ID. Option D correctly implements this. Option A is incorrect because creating a new IAM role does not restrict the source network. Option B is incorrect because aws:SourceVpce is used in resource-based policies (like bucket policies), not in IAM role trust policies. Option C is incorrect because the aws:SourceIp condition key is not effective for traffic that travels through a VPC endpoint, as the source IP is a private IP within the VPC and does not reliably represent the original client IP.

Answer

Create a new IAM role that can only be assumed by instances in the VPC.

Answer

Add a condition in the IAM role policy using aws:SourceVpce.

Answer

Add a condition in the bucket policy using aws:SourceIp with the VPC CIDR range.

Question 13

Which IAM entity can be used to grant temporary access to AWS resources for users from a different AWS account?

Accepted Answer

IAM role. An IAM role is the correct entity because it is specifically designed to grant temporary, cross-account access to AWS resources. When a user from a different AWS account assumes a role, AWS STS (Security Token Service) issues temporary security credentials (access key, secret key, and session token) that are valid for a configurable duration (default 1 hour, max 12 hours). This avoids the need to create permanent IAM users or share long-term credentials across accounts.

Answer

IAM group

Answer

IAM policy

Answer

IAM user

Question 14

Which THREE are best practices for securing IAM in an AWS environment? (Choose THREE.)

Accepted Answer

Use IAM roles for applications running on EC2.. Using IAM roles for EC2 instances eliminates the need to store long-term AWS credentials (access keys) on the instance. Instead, the instance assumes the role via the EC2 metadata service, which automatically rotates temporary security credentials (via AWS STS). This follows the principle of least privilege and reduces the risk of credential leakage.

Answer

Use the AWS account root user for daily administrative tasks.

Answer

Grant broad permissions to simplify management.

Question 15

Which TWO services can be used to manage identity and access across multiple AWS accounts? (Choose TWO.)

Accepted Answer

AWS Organizations. AWS Organizations centrally manages multiple AWS accounts and can apply service control policies (SCPs) to restrict permissions. AWS Single Sign-On (SSO) provides a single sign-on experience across accounts and integrates with identity sources. Together, these two services manage identity and access across accounts. AWS Config is a configuration auditing service, not an access management service.

Answer

Amazon Cognito

Answer

AWS Config

Answer

AWS CloudTrail