SCS-C02 Identity and Access Management Practice Test 14 — 15 Questions

Question 1

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all IAM users in member accounts must have a password policy that requires a minimum length of 14 characters. How can this be achieved centrally?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use an SCP that denies the UpdateAccountPasswordPolicy action unless the policy has MinimumPasswordLength >= 14.. A service control policy (SCP) can deny the UpdateAccountPasswordPolicy action if the password policy does not have MinimumPasswordLength >= 14. Option A is incorrect because SCPs cannot set password policies; they only allow or deny actions. Option B is incorrect because IAM permission boundaries do not apply to password policy changes, and IAM is a global service. Option C is incorrect because AWS Config rules can detect non-compliance but cannot enforce the policy; remediation requires additional steps and is not a centralized enforcement method.

Answer

Use a service control policy (SCP) to enforce the password policy across all accounts.

Answer

Use IAM permission boundaries to restrict password policy changes to specific Regions.

Answer

Use AWS Config rules to automatically remediate non-compliant password policies.

Question 2

A developer needs to grant an EC2 instance read-only access to an S3 bucket. Which of the following is the most secure way to provide these permissions?

Accepted Answer

Create an IAM role with read-only access and attach it to the EC2 instance profile.. Using an IAM role attached to an instance profile grants temporary credentials and eliminates long-term access keys. Option A is incorrect because storing credentials in Parameter Store (or any static storage) is less secure than using an instance profile, and IAM roles do not have static credentials to store. Option C is incorrect because a bucket policy cannot grant access based on an instance's public IP in a secure or reliable way, and it would grant access to anyone with that IP, not just the instance. Option D is incorrect because storing IAM user access keys in user data exposes long-term credentials, which is less secure than using an instance profile.

Answer

Use an IAM role and store the credentials in AWS Systems Manager Parameter Store, then retrieve them at instance launch.

Answer

Create a bucket policy that grants read-only access to the instance's public IP address.

Answer

Create an IAM user with read-only access and store the access keys in the instance's user data.

Question 3

An IAM policy grants access to a DynamoDB table with a condition that the request must originate from a specific VPC endpoint. However, requests from an EC2 instance in that VPC are being denied. What is the most likely cause?

Accepted Answer

The EC2 instance is not using the VPC endpoint to access DynamoDB; it is using an internet gateway.. The IAM policy condition requires the request to originate from a specific VPC endpoint. If the EC2 instance accesses DynamoDB via an internet gateway instead of the VPC endpoint, the source IP will not match the VPC endpoint, causing denial even though the instance is in the same VPC. Option A is incorrect because a public IP is not required to use a VPC endpoint. Option B is incorrect because the security group's outbound rules affect network reachability, not the IAM condition on the VPC endpoint. Option D is incorrect because the VPC endpoint policy must allow the action, but the IAM condition is separate; the issue here is about the source not matching the VPC endpoint.

Answer

The EC2 instance does not have a public IP address.

Answer

The security group on the EC2 instance does not allow outbound traffic to the DynamoDB endpoint.

Answer

The VPC endpoint policy does not allow the specific DynamoDB action.

Question 4

A company uses cross-account IAM roles to allow a third-party auditor to access a specific S3 bucket. The auditor reports that they are getting 'Access Denied' errors when trying to list objects. The bucket policy allows access to the auditor's account. What additional configuration is needed?

Accepted Answer

Attach an IAM policy to the auditor's IAM user that allows s3:ListBucket on the specific bucket.. For cross-account access to an S3 bucket using a bucket policy, the bucket policy grants access to the entire AWS account (e.g., "AWS": "arn:aws:iam::auditor-account-id:root"). However, the IAM user or role in the auditor account must also have an IAM policy that allows the S3 action (e.g., s3:ListBucket). The auditor's IAM user lacks this identity-based policy, causing an 'Access Denied' error. Option C correctly identifies that an IAM policy must be attached to the auditor's IAM user to allow s3:ListBucket on the specific bucket. Option A is incorrect because modifying the trust policy is relevant for IAM role assumption, not for bucket policy-based access. Option B is incorrect because SCPs apply at the organizational level and are not the typical additional configuration needed for this specific issue; they could cause denial but the question asks for what additional configuration is needed given the bucket policy allows the account. Option D is incorrect because adding a bucket policy granting access to the auditor's IAM user ARN would work, but it is not necessary if the bucket policy already allows the entire account; the missing piece is the user's IAM policy.

Answer

Modify the trust policy of the IAM role to include the auditor's account.

Answer

Ensure the auditor's account does not have a service control policy (SCP) denying S3 actions.

Answer

Add a bucket policy that grants access to the auditor's IAM user ARN.

Question 5

A security administrator needs to ensure that all IAM users in the account use multi-factor authentication (MFA) to access the AWS Management Console. What is the most effective way to enforce this?

Accepted Answer

Create an IAM policy that denies all actions unless MFA is present, and attach it to all users.. Attaching an IAM policy that denies all actions unless MFA is present (using the condition 'aws:MultiFactorAuthPresent':'true') to all users ensures MFA is required for console access. Option A is wrong because the password policy cannot enforce MFA for console access. Option B is wrong because while SCPs can deny access, the condition must be properly set in a policy attached to users or groups for the most effective enforcement. Option C is wrong because requiring users to use root credentials is not a secure or practical approach.

Answer

Set the IAM password policy to require MFA.

Answer

Use an SCP to deny access if MFA is not present, with a condition "aws:MultiFactorAuthPresent":"true".

Answer

Enable MFA for the root user and require all IAM users to use the root user credentials.

Question 6

An organization uses AWS KMS to encrypt S3 objects. They want to allow a developer to decrypt objects only if the request comes from a specific IP address range. Which IAM policy condition should be used?

Accepted Answer

Condition with kms:ViaService and aws:SourceIp.. Kms:ViaService ensures the KMS request is made through an integrated AWS service (in this case, S3), and aws:SourceIp restricts the request to a specific IP address range. Option A is incorrect because kms:GrantOperations is used for managing grants, not for restricting based on IP or service. Option B is incorrect because kms:CallerAccount checks the account number of the caller, not the IP. Option C is incorrect because kms:EncryptionContext is used to specify encryption context, not for IP restrictions.

Answer

Condition with kms:GrantOperations and aws:SourceIp.

Answer

Condition with kms:CallerAccount and aws:SourceIp.

Answer

Condition with kms:EncryptionContext and aws:SourceIp.

Question 7

A company wants to grant an IAM user the ability to manage (create and update) their own access keys. Which TWO IAM actions must be allowed in the policy?

Accepted Answer

iam:UpdateAccessKey. To allow a user to manage (create and update) their own access keys, the policy must include iam:CreateAccessKey and iam:UpdateAccessKey. These actions enable the user to generate new keys and activate/deactivate them. iam:DeleteAccessKey is not required for this specific scope.

Answer

iam:GetAccessKeyLastUsed

Answer

iam:DeleteAccessKey

Answer

iam:ListAccessKeys

Question 8

A security engineer needs to design a system where an EC2 instance can write logs to a CloudWatch log group. Which TWO steps are required?

Accepted Answer

Attach the IAM role to the EC2 instance profile.. The correct steps are to create an IAM role with the necessary CloudWatch Logs permissions (logs:CreateLogStream and logs:PutLogEvents) and attach that role to the EC2 instance profile. This grants the EC2 instance the ability to write logs to CloudWatch Logs without needing a resource policy or encryption configuration. The CloudWatch agent is not required for writing logs via the AWS SDK or CLI, but the IAM role is essential. Options A and C are not required; server-side encryption is optional, and CloudWatch log groups do not support resource policies for EC2 instances. Option D is incorrect because the CloudWatch agent is not strictly required for writing logs, though it is commonly used.

Answer

Enable server-side encryption for the log group.

Answer

Create a CloudWatch log group resource policy that allows the EC2 instance to write logs.

Answer

Install and configure the CloudWatch agent on the EC2 instance.

Question 9

A company wants to enforce that all IAM users in an AWS Organization must have a password policy that includes a minimum length of 12 characters. Which THREE steps are part of implementing this using SCPs?

Accepted Answer

Include a condition in the SCP that checks if the requested minimum password length is less than 12.. Options A, D, and E are correct. Option A is correct because you can use a condition in the SCP to deny changes to the password policy if the minimum length is less than 12; for example, using a condition like `aws:RequestedRegion` is not relevant here. Option D is correct because SCPs can deny the `iam:UpdateAccountPasswordPolicy` action, effectively preventing users from modifying the policy. Option E is correct because attaching the SCP to the root OU ensures it applies to all accounts in the organization. Option B is incorrect because IAM is a global service and cannot be restricted to a specific Region via SCPs. Option C is incorrect because SCPs cannot directly set a password policy; they only allow or deny actions.

Answer

Use an SCP condition to restrict password policy changes to a specific Region.

Answer

Write an SCP that sets the password policy to require minimum length 12.

Question 10

An IAM administrator ran the simulate-custom-policy command shown in the exhibit. The result shows an 'explicitDeny' for s3:ListBucket. What is the most likely reason?

Accepted Answer

The policy does not include an action that allows s3:ListBucket, so it is implicitly denied.. The policy does not allow s3:ListBucket, so it is implicitly denied; but the simulator shows 'explicitDeny' because there might be an attached policy that denies it. However, in this simulation, the policy only allows s3:GetObject, so ListBucket is not allowed. The 'explicitDeny' could be due to an SCP or a different policy attached to the user. Option A is wrong because the resource ARN is correct. Option B is wrong because the policy does not include ListBucket. Option D is wrong because the action is spelled correctly.

Answer

The simulation incorrectly evaluates the policy due to a syntax error.

Answer

The resource ARN for ListBucket is incorrect; it should include a wildcard.

Answer

The s3:ListBucket action is not valid for S3.

Question 11

An IAM policy allows the iam:PassRole action for a specific role only when the role is passed to EC2. A developer tries to launch an EC2 instance with this role, but fails. What is the most likely missing permission?

Accepted Answer

The developer does not have ec2:RunInstances permission.. The developer must have the ec2:RunInstances permission to launch an EC2 instance. The iam:PassRole permission is only part of the process; without RunInstances, the launch fails. Option B is incorrect because the role already exists. Option C is incorrect because the policy explicitly grants iam:PassRole for that role to EC2, so the permission is present. Option D is incorrect because the condition using 'ec2.amazonaws.com' is correct for allowing PassRole to EC2; the issue is not with the condition but with the missing RunInstances permission.

Answer

The developer needs to create the role first.

Answer

The developer does not have iam:PassRole permission for the role.

Answer

The condition in the policy is incorrect; it should use 'ec2.amazonaws.com' as the service.

Question 12

A security engineer is designing an IAM policy to allow an application running on an EC2 instance to read objects from a specific S3 bucket (my-bucket) and write objects to a different S3 bucket (my-other-bucket). The application uses an IAM role with the following trust policy. Which additional policy should be attached to the role to meet the requirements with least privilege?

Accepted Answer

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject"],
      "Resource": "arn:aws:s3:::my-bucket/*"
    },
    {
      "Effect": "Allow",
      "Action": ["s3:PutObject"],
      "Resource": "arn:aws:s3:::my-other-bucket/*"
    }
  ]
}. The correct answer because it grants only the necessary actions (s3:GetObject and s3:PutObject) on the specific buckets (my-bucket for read, my-other-bucket for write), adhering to the principle of least privilege. Option A is incorrect because it allows both GetObject and PutObject on all buckets (*/*), which is too permissive. Option B grants full S3 access (*) to all resources, violating least privilege. Option D only allows PutObject on my-bucket instead of my-other-bucket, failing to meet the write requirement.

Answer

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:PutObject"],
      "Resource": "arn:aws:s3:::*/*"
    }
  ]
}

Answer

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:*",
      "Resource": "*"
    }
  ]
}

Answer

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:PutObject"],
      "Resource": "arn:aws:s3:::my-bucket/*"
    }
  ]
}

Question 13

A developer needs to grant an IAM user the ability to manage their own password and access keys, but not any other IAM users. Which IAM policy should be used?

Accepted Answer

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["iam:CreateAccessKey", "iam:UpdateAccessKey", "iam:DeleteAccessKey", "iam:UpdateLoginProfile"],
      "Resource": "arn:aws:iam::*:user/${aws:username}"
    }
  ]
}. It uses the policy variable ${aws:username} in the resource ARN to restrict actions to the user's own IAM user resource. It includes all needed actions: CreateAccessKey, UpdateAccessKey, DeleteAccessKey, and UpdateLoginProfile (for password management). Option A uses a wildcard in the resource, granting access to all users. Option C grants full IAM access to all resources. Option D omits UpdateLoginProfile, so it does not allow password management.

Answer

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["iam:CreateAccessKey", "iam:UpdateAccessKey", "iam:DeleteAccessKey", "iam:UpdateLoginProfile"],
      "Resource": "arn:aws:iam::*:user/*"
    }
  ]
}

Answer

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "iam:*",
      "Resource": "*"
    }
  ]
}

Answer

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["iam:CreateAccessKey", "iam:UpdateAccessKey", "iam:DeleteAccessKey"],
      "Resource": "arn:aws:iam::*:user/${aws:username}"
    }
  ]
}

Question 14

A security engineer needs to design an IAM policy that allows an IAM user to launch EC2 instances only if they specify a specific security group ID (sg-12345) and a specific instance type (t2.micro). Which policy achieves this?

Accepted Answer

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:RunInstances",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "ec2:InstanceType": "t2.micro",
          "ec2:SecurityGroup": "sg-12345"
        }
      }
    }
  ]
}. It uses the condition keys 'ec2:InstanceType' and 'ec2:SecurityGroup' to restrict the RunInstances action to only allow launching t2.micro instances into the security group sg-12345. Option A incorrectly specifies the security group as a resource ARN, but security groups cannot be specified as resources in RunInstances; they are specified via condition keys. Option B uses 'aws:RequestTag/security-group' which is not a valid condition key for security groups; security groups are identified by 'ec2:SecurityGroup'. Option C only restricts instance type but does not restrict the security group. Therefore, only D correctly enforces both constraints.

Answer

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:RunInstances",
      "Resource": "arn:aws:ec2:*:*:security-group/sg-12345",
      "Condition": {
        "StringEquals": { "ec2:InstanceType": "t2.micro" }
      }
    }
  ]
}

Answer

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:RunInstances",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "ec2:InstanceType": "t2.micro",
          "aws:RequestTag/security-group": "sg-12345"
        }
      }
    }
  ]
}

Answer

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:RunInstances",
      "Resource": "*",
      "Condition": {
        "StringEquals": { "ec2:InstanceType": "t2.micro" }
      }
    }
  ]
}

Question 15

A company has an S3 bucket with a bucket policy that grants access to a specific IAM role. However, users who assume that role are unable to list objects in the bucket. The bucket policy includes a Principal element set to the role ARN. What is the MOST likely cause?

Accepted Answer

The IAM role does not have a permissions policy that allows s3:ListBucket.. Bucket policies do not grant permissions to IAM role principals unless the role has an IAM policy that allows the S3 action. Option B is false; ACLs are not the issue here; the role lacks an IAM policy. Option C is false; the scenario does not involve MFA, and even if MFA were required, the role’s inability to list objects is due to missing IAM permissions. Option D is false; the role’s trust policy allows AssumeRole, otherwise the users could not assume the role.

Answer

The bucket has an ACL that denies access to the role.

Answer

The bucket policy requires MFA, but the role does not enforce MFA.

Answer

The role's trust policy does not allow sts:AssumeRole.