SCS-C02 Identity and Access Management Practice Test 13 — 15 Questions

Question 1

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that no IAM user in any account can create or modify IAM roles. What is the MOST effective way to enforce this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an SCP that denies iam:CreateRole and iam:UpdateAssumeRolePolicy and attach it to the root organizational unit.. The most effective way to enforce a deny across all accounts in AWS Organizations is a Service Control Policy (SCP) attached to the root organizational unit, denying iam:CreateRole and iam:UpdateAssumeRolePolicy. SCPs set the maximum permissions boundary for all principals in member accounts, so attaching a deny SCP at the root OU ensures no IAM user in any account can create or modify roles, regardless of their IAM policies. This is centralized, preventive, and cannot be bypassed by account-level admins.

Answer

Use AWS Config rules to detect role creation and automatically delete the roles.

Answer

Set up a Lambda function that monitors CloudTrail and revokes role creation permissions.

Answer

Create an IAM policy that denies role creation and attach it to each user in every account.

Question 2

A company wants to allow its employees to authenticate to the AWS Management Console using their existing corporate credentials. Which AWS service should be used to integrate with the company's identity provider?

Accepted Answer

AWS IAM Identity Center (AWS SSO). AWS IAM Identity Center (formerly AWS SSO) is the correct service because it is specifically designed to enable single sign-on (SSO) from an external identity provider (IdP) to AWS accounts and business applications. It supports federation via SAML 2.0 or OIDC, allowing employees to authenticate using their existing corporate credentials and then access the AWS Management Console without needing separate IAM users.

Answer

AWS Secrets Manager

Answer

AWS Directory Service for Microsoft Active Directory

Answer

AWS Certificate Manager

Question 3

A security engineer is troubleshooting an issue where an IAM user is unable to list objects in an S3 bucket even though the user has an IAM policy that allows s3:ListBucket. What is the MOST likely cause?

Accepted Answer

The bucket policy explicitly denies the action for that user.. In AWS, an explicit deny in a bucket policy overrides any allow in an IAM policy. Even if the IAM user has s3:ListBucket allowed, if the bucket policy explicitly denies that action for that user, the user will be unable to list objects. This is the most likely cause given the scenario.

Answer

The user's IAM policy is not attached to the user.

Answer

The bucket is in a different AWS region.

Answer

The user needs to use MFA.

Question 4

An application running on an EC2 instance needs to read from an S3 bucket. What is the BEST practice for granting permissions to the EC2 instance?

Accepted Answer

Use an IAM role and attach it to the EC2 instance profile.. The best practice is to use an IAM role attached to the EC2 instance via an instance profile. This provides temporary, automatically rotated credentials to the instance, eliminating the need to hardcode or distribute long-term access keys. The instance profile allows the EC2 instance to assume the role and obtain credentials from the Instance Metadata Service (IMDS), which the AWS SDK and CLI use automatically. This approach follows the principle of least privilege and is the most secure and manageable method for granting AWS permissions to EC2 instances.

Answer

Store AWS access keys in the application code.

Answer

Create an IAM user and give access keys to the developer.

Answer

Use the root account credentials.

Question 5

A company uses cross-account IAM roles to allow a third-party vendor to access resources in the company's AWS account. The security team wants to ensure that the vendor can only access the specific S3 bucket named 'vendor-bucket'. What should the security team do?

Accepted Answer

In the trust policy of the role, specify the vendor's AWS account and attach a permissions policy that allows s3:* on 'vendor-bucket'. Also create a bucket policy that allows the role.. The correct approach is to create a cross-account IAM role for the vendor. In the role's trust policy, specify the vendor's AWS account as the trusted entity. Attach a permissions policy to the role that grants access only to the specific S3 bucket 'vendor-bucket' (e.g., s3:GetObject, s3:PutObject). Additionally, create a bucket policy on 'vendor-bucket' that allows the role to access the bucket. This ensures the vendor can only assume the role and access the designated bucket.

Answer

Create an IAM user for the vendor and attach a policy that allows access to 'vendor-bucket'.

Answer

Use an SCP to deny access to all S3 buckets except 'vendor-bucket'.

Answer

Create a new AWS account for the vendor and use VPC peering.

Question 6

Which TWO of the following are valid ways to grant an IAM user permissions to access an S3 bucket? (Choose 2.)

Accepted Answer

Attach an IAM policy to the user.. Option C is correct because attaching an IAM identity-based policy directly to the user grants that user the specified S3 permissions, which is the standard way to authorize an IAM principal. Option D is correct because adding the user to an IAM group that has an S3 policy attached means the user inherits those permissions through group membership, another standard identity-based authorization method. Option A is incorrect because an instance profile is a container for an IAM role used by EC2 instances (and similar compute), not a mechanism for granting permissions to an IAM user. Option B is incorrect because a VPC endpoint policy controls which principals can access the service through that endpoint; it does not grant an IAM user permissions to an S3 bucket. Option E is incorrect because an SCP sets the maximum permissions boundary for accounts in an AWS Organization; it only restricts permissions and never grants access on its own.

Answer

Assign an instance profile to the user.

Answer

Create a VPC endpoint policy.

Answer

Use an SCP to allow access.

Question 7

Which THREE of the following are characteristics of IAM roles? (Choose 3.)

Accepted Answer

Roles can be assumed by IAM users in another AWS account.. Option C is correct because IAM roles are designed for cross-account access: a role in Account A can have a trust policy granting the principal in Account B permission to call sts:AssumeRole, so users in another AWS account can assume it. Option D is correct because every IAM role has a trust policy (the AssumeRolePolicyDocument) that defines which principals (users, accounts, services, federated identities) are allowed to assume the role. Option E is correct because an instance profile delivers a role's temporary credentials to an EC2 instance, letting applications on that instance call AWS APIs with the role's permissions without embedding long-term keys. Option A is wrong because roles do not have long-term credentials like access keys; they issue temporary credentials via AWS STS. Option B is wrong because assuming a role uses the sts:AssumeRole API and the trust policy, not a password.

Answer

Roles have long-term credentials like access keys.

Answer

Roles require a password for assumption.

Question 8

Which TWO of the following are AWS best practices for managing access keys? (Choose 2.)

Accepted Answer

Delete unused access keys.. AWS best practices recommend deleting unused access keys to reduce the risk of unauthorized access. Unused keys represent a potential attack vector, as they may be forgotten and left active, allowing an attacker who discovers them to gain access to AWS resources. By regularly auditing and removing keys that are no longer in use, you minimize the exposure of long-lived credentials.

Answer

Use the same access key for multiple users.

Answer

Share access keys via email.

Answer

Embed access keys directly in application code.

Question 9

A company wants to allow an IAM user to list objects in an S3 bucket named 'my-bucket'. Which IAM policy statement grants the minimum required permissions?

Accepted Answer

{"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::my-bucket"}. The s3:ListBucket action is the specific permission required to list objects in an S3 bucket, and the resource ARN must be the bucket itself (arn:aws:s3:::my-bucket) without a trailing /*. This grants the minimum necessary permission to perform the ListObjects (or ListObjectsV2) API call, which returns the object keys in the bucket.

Answer

{"Effect":"Allow","Action":"s3:PutObject","Resource":"arn:aws:s3:::my-bucket/*"}

Answer

{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::my-bucket/*"}

Answer

{"Effect":"Allow","Action":"s3:*","Resource":"arn:aws:s3:::my-bucket"}

Question 10

A developer needs to allow a Lambda function to write logs to CloudWatch Logs. What is the MINIMUM IAM policy that should be attached to the Lambda execution role?

Accepted Answer

{"Effect":"Allow","Action":["logs:CreateLogGroup","logs:CreateLogStream","logs:PutLogEvents"],"Resource":"*"}. The minimum policy for a Lambda function to write logs to CloudWatch Logs must include logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents. Lambda creates the log group and stream on first invocation, so all three actions are required. Resource '*' is acceptable because the log group name is not known in advance and Lambda needs to create it dynamically.

Answer

{"Effect":"Allow","Action":"logs:PutLogEvents","Resource":"arn:aws:logs:us-east-1:123456789012:log-group:my-log-group:*"}

Answer

{"Effect":"Allow","Action":"logs:*","Resource":"*"}

Answer

{"Effect":"Allow","Action":["logs:DescribeLogGroups","logs:DescribeLogStreams"],"Resource":"*"}

Question 11

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that no IAM user in any account can create new IAM users. Which approach should be used?

Accepted Answer

Apply a service control policy (SCP) at the root organizational unit that denies IAM:CreateUser.. Service control policies (SCPs) are the correct mechanism because they allow you to centrally restrict permissions across all accounts in an AWS Organization. By attaching an SCP at the root organizational unit that denies the `iam:CreateUser` action, you ensure that no IAM user in any member account can create new IAM users, regardless of any IAM policies applied within those accounts. SCPs act as a guardrail that overrides any allow permissions granted by IAM policies.

Answer

Apply an IAM policy to the root user of each account.

Answer

Use an SCP attached to each IAM user.

Answer

Use an IAM permissions boundary on each IAM user.

Question 12

A company has an IAM policy that allows s3:GetObject on all buckets. However, a specific S3 bucket policy explicitly denies s3:GetObject to all principals. An IAM user with the IAM policy tries to read an object from that bucket. What is the result?

Accepted Answer

The request is denied because the explicit deny in the bucket policy overrides the allow in the IAM policy.. D is correct because AWS IAM policy evaluation logic follows an explicit deny override: any explicit deny in any applicable policy (resource-based or identity-based) overrides any allow. The S3 bucket policy explicitly denies s3:GetObject to all principals, so even though the IAM policy allows the action, the explicit deny takes precedence, resulting in a denied request.

Answer

The request is allowed because the IAM policy is more specific.

Answer

The request is allowed because the IAM policy allows the action.

Answer

The request is denied because the bucket policy applies only to IAM users.

Question 13

A security engineer notices that an IAM role has a trust policy that allows 'sts:AssumeRole' from any AWS account. What is the security risk?

Accepted Answer

Any IAM user in any AWS account can assume the role and gain its permissions.. A trust policy with a Principal of "*" (or an account root without conditions) allows sts:AssumeRole from any AWS account, meaning any IAM principal in any account that knows the role ARN can call AssumeRole and obtain temporary credentials scoped to that role's permissions. This is a classic cross-account confused-deputy vulnerability: the role's identity-based policies determine what the assumer can do, so the blast radius is exactly the role's permissions. The risk is not that permissions are 'exposed' in a read sense, but that they can be actively exercised by untrusted external principals.

Answer

The role can be assumed by any AWS service.

Answer

The role's permissions are exposed to all AWS accounts.

Answer

The role can be used to access resources in other accounts.

Question 14

Which TWO actions can be used to restrict access to an S3 bucket to only requests that originate from a specific VPC?

Accepted Answer

Use an IAM policy with a condition key aws:SourceVpce to restrict access to the VPC endpoint.. The `aws:SourceVpce` condition key in an IAM policy allows you to restrict access to an S3 bucket to requests that originate from a specific VPC endpoint (VPC Endpoint ID). This ensures that only traffic coming through that VPC endpoint can access the bucket, effectively limiting access to the VPC. Option C is also correct because you can configure a VPC endpoint for S3 and attach a bucket policy that explicitly allows access only from that endpoint using the `aws:SourceVpce` condition, achieving the same restriction.

Answer

Use a security group to allow inbound traffic from the VPC to S3.

Answer

Use a network ACL to allow traffic from the VPC to S3.

Answer

Use an IAM policy with a condition key aws:SourceIp to restrict access to the VPC CIDR.

Question 15

Which TWO are valid ways to authenticate an IAM user?

Accepted Answer

Password. Option C (Password) is correct because an IAM user with console access authenticates to the AWS Management Console using a user name and password, which is the standard sign-in credential for interactive console sessions. Option E (Access keys, i.e., access key ID and secret access key) is correct because programmatic requests to AWS APIs, CLI, and SDKs are signed with an access key ID and secret access key pair tied to the IAM user. Option A (SSL/TLS certificate) is not a valid IAM user authentication method; X.509 certificates are used for signing SOAP requests in limited legacy scenarios, not as a general IAM user credential. Option B (MFA token) is not a standalone authentication method — it is a second factor used in addition to a password or access key, not a primary credential by itself. Option D (SSH key pair) is not an IAM authentication mechanism; SSH keys are used for logging into EC2 instances (e.g., via CodeCommit or instance access), not for authenticating to AWS as an IAM user.

Answer

SSL/TLS certificate

Answer

MFA token

Answer

SSH key pair