SCS-C02 Identity and Access Management Practice Test 14 — 15 Questions

Question 1

A company requires that all access to its S3 buckets be logged for compliance. Which AWS service should be used to record API calls to S3?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls for auditing purposes, making it the correct service for logging access to S3 buckets. Option A is incorrect because Amazon GuardDuty is a threat detection service, not a logging service. Option B is incorrect because Amazon Inspector assesses vulnerabilities. Option C is incorrect because AWS Config tracks resource configuration changes, not API calls.

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Answer

AWS Config

Question 2

A company wants to allow users from an external AWS account to assume a role in the company's account. What must be configured in the company's account?

Accepted Answer

A trust policy that allows the external account to assume the role.. Cross-account IAM role access requires the role in the company's account to have a trust policy that explicitly grants the external AWS account's root user or specific IAM entities permission to assume the role. The trust policy uses the `sts:AssumeRole` action and specifies the external account ID as the `Principal`, which establishes the trust relationship necessary for the external account to request temporary security credentials via AWS STS.

Answer

An IAM user in the company's account with cross-account access.

Answer

A permissions policy that allows the external account to list roles.

Answer

An IAM identity provider for the external account.

Question 3

A security engineer notices that an IAM role allows 'iam:PassRole' to an EC2 instance. What security risk does this present?

Accepted Answer

The instance can launch new resources with a more privileged role.. The 'iam:PassRole' permission allows an entity to pass an IAM role to an AWS service, such as EC2. If an EC2 instance has this permission, it can launch new resources (like another EC2 instance or a Lambda function) and associate a more privileged role with that resource. This is a privilege escalation risk because the instance could effectively gain the permissions of the passed role.

Answer

The instance can modify IAM policies.

Answer

The instance can stop CloudTrail logging.

Answer

The instance can decrypt data encrypted with KMS keys.

Question 4

An IAM policy has the following statement: {"Effect":"Allow","Action":"s3:*","Resource":"arn:aws:s3:::my-bucket/*"}. A user with this policy tries to perform s3:ListBucket on 'my-bucket'. Will the request succeed?

Accepted Answer

No, because the resource ARN does not include the bucket itself.. The statement grants s3:* on arn:aws:s3:::my-bucket/*, which matches only objects inside the bucket, not the bucket itself. s3:ListBucket is a bucket-level operation that requires the resource arn:aws:s3:::my-bucket (without the /*). Since the policy does not grant access to that resource, the request is denied by default. This is a classic IAM resource-ARN mismatch.

Answer

No, because there is an explicit deny elsewhere.

Answer

Yes, because s3:* allows all actions.

Answer

Yes, because the user has permission to access objects.

Question 5

Which TWO are best practices for managing IAM roles for EC2 instances?

Accepted Answer

Apply the principle of least privilege when defining role permissions.. The principle of least privilege ensures that an IAM role attached to an EC2 instance grants only the minimum permissions required for the application to function. This reduces the attack surface and limits potential damage from compromised instances. AWS Identity and Access Management (IAM) roles for EC2 use temporary security credentials obtained via the instance metadata service (IMDS), eliminating the need for long-term access keys.

Answer

Regularly rotate IAM user access keys.

Answer

Attach the same role to all instances for simplicity.

Answer

Store AWS access keys directly on the instance.

Question 6

Which THREE AWS services can be used to authenticate users for accessing AWS resources?

Accepted Answer

AWS Single Sign-On. AWS Single Sign-On (SSO) is a service that centrally manages access to multiple AWS accounts and business applications, authenticating users via an external identity provider (IdP) such as Microsoft Active Directory or Okta. It allows users to sign in once and gain federated access to assigned AWS resources, making it a valid authentication service for AWS resource access.

Answer

AWS Secrets Manager

Answer

AWS CloudTrail

Question 7

An IAM policy attached to a user contains the above statements. The user attempts to download an object from 'example-bucket/confidential/report.pdf'. What is the result?

Accepted Answer

The download fails because the deny statement applies to the object.. The explicit Deny statement in the IAM policy takes precedence over any Allow statement, so even though the first statement allows s3:GetObject, the deny on the confidential prefix blocks the download. AWS evaluates all applicable policies and any explicit Deny wins. Therefore the download fails because the deny statement applies to the object.

Answer

The download fails because the user is not an administrator.

Answer

The download succeeds because the user can access other objects.

Answer

The download succeeds because the first statement allows GetObject.

Question 8

A security engineer runs the IAM policy simulator with a custom policy. The output shows the above. Which statement is true about the policy?

Accepted Answer

The policy contains a statement that explicitly denies iam:DeleteUser.. The policy simulator shows an explicit deny for iam:DeleteUser, confirming that a deny statement exists in the policy. Option C is correct because the explicit deny means the policy explicitly denies iam:DeleteUser. Option A is incorrect because the simulator does not indicate that iam:CreateUser is denied. Option B is incorrect because the explicit deny overrides any default allow. Option D is incorrect because the simulator returned an explicit deny, not errors.

Answer

The policy allows iam:DeleteUser but denies iam:CreateUser.

Answer

The policy allows all actions by default.

Answer

The policy has no effect because the simulator returned errors.

Question 9

A company wants to allow an IAM user to manage only their own password in the AWS Management Console. Which IAM policy action should be used?

Accepted Answer

iam:ChangePassword. The correct IAM policy action to allow a user to manage only their own password is iam:ChangePassword. This action enables the user to change their password in the AWS Management Console. Option A is correct. Option B (iam:ListUsers) is used to list IAM users, not relevant to password management. Option C (iam:CreateAccessKey) creates access keys, which is unrelated. Option D (iam:DeactivateMFADevice) deactivates MFA devices, also not relevant. Therefore, only iam:ChangePassword is appropriate.

Answer

iam:ListUsers

Answer

iam:CreateAccessKey

Answer

iam:DeactivateMFADevice

Question 10

A company has a policy that requires all IAM users to use multi-factor authentication (MFA) to access the AWS Management Console. A user reports that they are unable to sign in even after configuring MFA. What is the most likely cause?

Accepted Answer

The MFA device is not properly synchronized with AWS.. The most likely cause is that the MFA device is not properly synchronized with AWS. When an IAM user configures MFA, the device must be synchronized with AWS to generate valid tokens. If synchronization fails, the token entered during sign-in will be rejected, preventing console access. Option A is unlikely because if the policy explicitly denied console access, the user would not be able to sign in at all regardless of MFA, but the user specifically reported having configured MFA and still fails. Option B is incorrect because the root account does not require MFA for console access by default, and the user stated they are an IAM user. Option C is incorrect because MFA tokens do not expire; they are time-based and change every 30 seconds, but the token itself does not become permanently invalid after a period. The issue is synchronization.

Answer

The IAM policy explicitly denies console access.

Answer

The user is using the root account instead of an IAM user.

Answer

The MFA token has expired.

Question 11

An organization wants to use AWS Organizations to centrally manage permissions for multiple accounts. Which IAM feature is used to grant cross-account access within the organization?

Accepted Answer

IAM roles. IAM roles are the standard mechanism for granting cross-account access within AWS Organizations. A role in the target (trusting) account defines a trust policy that names principals in other accounts as trusted entities, and those principals call sts:AssumeRole to obtain temporary credentials scoped to the role's permissions policy. This avoids creating duplicate IAM users in every account and is the recommended pattern for centralized, auditable cross-account access.

Answer

Service control policies (SCPs)

Answer

Resource-based policies

Answer

IAM groups

Question 12

A developer needs to grant an EC2 instance access to an S3 bucket. Which is the most secure way to provide credentials to the EC2 instance?

Accepted Answer

Create an IAM role and attach it to the EC2 instance profile. It uses an IAM role attached to an EC2 instance profile, which allows the instance to obtain temporary, automatically rotated credentials from the AWS STS service via the instance metadata service (IMDS). This eliminates the need to hardcode, store, or manage long-term access keys, significantly reducing the risk of credential exposure.

Answer

Store AWS access keys in the application code

Answer

Store the keys in an S3 bucket and download them at startup

Answer

Use environment variables to store the keys

Question 13

A security team notices that an IAM user has permissions to launch EC2 instances but should not have access to certain instance types. Which IAM policy condition key should be used to restrict this?

Accepted Answer

ec2:InstanceType. The ec2:InstanceType condition key allows you to restrict IAM users to launching only specific EC2 instance types (e.g., t2.micro, m5.large) by evaluating the instance type value in the RunInstances API call. This is the correct key to enforce a policy that denies access to certain instance types while permitting others.

Answer

ec2:ResourceTag

Answer

ec2:Tenancy

Answer

ec2:InstanceProfile

Question 14

A developer needs to allow an EC2 instance to access an S3 bucket. Which is the best practice for granting permissions?

Accepted Answer

Create an IAM role with S3 access and attach it to the EC2 instance profile.. The best practice for granting an EC2 instance access to S3 is to create an IAM role with the necessary S3 permissions and attach it to the EC2 instance via an instance profile. This provides temporary credentials that are automatically rotated, eliminating the need to store long-term access keys on the instance. It follows the principle of least privilege and is the most secure method.

Answer

Store IAM user access keys in a configuration file on the EC2 instance.

Answer

Use a security group to allow the EC2 instance to access S3.

Answer

Attach an S3 bucket policy that grants access to the EC2 instance ID.

Question 15

A security engineer notices that an IAM user has permissions to create new IAM users and attach policies. What is the most effective way to detect if this user created a backdoor user?

Accepted Answer

Enable AWS CloudTrail and monitor IAM events using Amazon CloudWatch Logs and create a metric filter for CreateUser and AttachUserPolicy events.. The most effective way to detect if a user created a backdoor IAM user is to enable AWS CloudTrail and monitor IAM events such as CreateUser and AttachUserPolicy using CloudWatch Logs metric filters and alarms. CloudTrail records all API activity, including IAM changes, and CloudWatch can alert on specific event names in near real-time. This provides direct detection of the exact actions that would indicate backdoor user creation.

Answer

Review S3 access logs for any PutObject calls from the IAM user.

Answer

Use IAM Access Analyzer to review all IAM policies for potential backdoor access.

Answer

Configure an AWS Config rule to check for IAM users with administrative policies.