SCS-C02 Identity and Access Management Practice Test 15 — 15 Questions

Question 1

A developer is trying to upload a file to an S3 bucket using the AWS CLI, but receives an 'AccessDenied' error. The IAM policy attached to the user includes 's3:PutObject' on the bucket. The bucket policy has a Deny statement with the condition 'aws:Referer': ['example.com']. The CLI command does not include a referer header. What is the cause of the error?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The bucket policy denies requests that do not include the required referer header.. The Deny statement with a condition that does not match the request (no referer header) still denies the request if the condition is not met? Actually, the Deny statement with a condition only denies if the condition evaluates to true. Since the request has no referer, the condition 'StringNotEquals'? Wait, typical bucket policy is: Deny unless referer equals example.com. But if the request has no referer, the condition fails, so the Deny does not apply. However, the error persists. Possibly the bucket policy has an explicit Deny for all requests without the referer. In that case, the Deny applies. So Option B is correct: the Deny is blocking requests without the referer. Option A is wrong because CLI uses HTTPS. Option C is irrelevant. Option D is not the cause.

Answer

The user’s access keys are expired.

Answer

The IAM policy does not include s3:PutObjectAcl.

Answer

The CLI is not using HTTPS.

Question 2

A company needs to allow an external auditor to access a specific S3 bucket for 30 days. The auditor does not have an AWS account. What is the MOST secure way to grant temporary access?

Accepted Answer

Use AWS STS to issue temporary credentials via a custom identity broker.. The most secure method is to use AWS Security Token Service (STS) to issue temporary credentials via a custom identity broker. The broker authenticates the auditor independently (e.g., via their own corporate credentials) and then calls STS to obtain temporary, limited-privilege credentials valid for up to 36 hours. This avoids long-term credentials and does not require the auditor to have an AWS account. Option A is insecure because it exposes long-term credentials. Option C is not possible because bucket policies cannot use an email address as a condition for access without a specific IAM entity. Option D (SAML federation) requires the auditor's organization to have a SAML identity provider and a trust relationship, which may not be feasible and is less flexible than a custom broker.

Answer

Create an IAM user with long-term credentials and share them with the auditor.

Answer

Grant access via a bucket policy using the auditor's email address as a condition.

Answer

Create an IAM role and allow the auditor to assume it using SAML federation.

Question 3

A security engineer is designing a solution to allow a Lambda function to write logs to CloudWatch Logs. Which TWO actions are required in the IAM execution role? (Choose TWO.)

Accepted Answer

logs:PutLogEvents. The correct options are B and E. To allow a Lambda function to write logs to CloudWatch Logs, the IAM execution role must include permissions to create a log group (logs:CreateLogGroup) if it does not already exist and to put log events (logs:PutLogEvents). While logs:CreateLogStream is also typically required, the question asks for TWO actions, and of the given options, B and E are the necessary ones. Option A (logs:GetLogEvents) is for reading logs, C (logs:CreateLogStream) is also needed but not listed as a correct choice in this two-answer scenario, and D (logs:PutRetentionPolicy) configures retention, not writing.

Answer

logs:GetLogEvents

Answer

logs:CreateLogStream

Answer

logs:PutRetentionPolicy

Question 4

A company is using AWS Organizations with multiple accounts. The security team wants to enforce that all IAM users must have MFA enabled. Which TWO methods can be used to enforce this? (Choose TWO.)

Accepted Answer

Attach an IAM policy that denies all actions unless MFA is present.. The correct options are A and D. Option A uses an IAM policy with a condition key 'aws:MultiFactorAuthPresent' to deny actions unless MFA is present, which can be attached to users or groups. Option D uses a Service Control Policy (SCP) at the AWS Organizations level to deny actions when MFA is not present. Option B is incorrect because a password policy does not enforce MFA usage. Option C is incorrect because requiring MFA for roles does not enforce MFA for IAM users. Option E is unrelated to IAM user MFA enforcement.

Answer

Configure a password policy that requires MFA.

Answer

Require MFA for all IAM roles.

Answer

Enable MFA delete on S3 buckets.

Question 5

Which THREE are valid methods for authenticating to AWS APIs? (Choose THREE.)

Accepted Answer

Access key ID and secret access key. The correct options are A, C, and E. Access keys, IAM roles (via STS), and SAML federation are valid authentication methods. Option B, SSH keys, are for EC2 instance access, not AWS APIs. Option D, client certificates, are not used for AWS API authentication.

Answer

SSH key pair

Answer

Client certificate

Question 6

Refer to the exhibit. A user has this IAM policy attached. They attempt to download an object from example-bucket using the AWS CLI without specifying server-side encryption. Will the request succeed?

Accepted Answer

No, because the condition is not satisfied.. The condition requires that the request includes the header x-amz-server-side-encryption with value AES256. Without that header, the condition is not met, so the Allow does not apply. There is no explicit Deny, but since the Allow does not apply, the default implicit Deny takes effect, and the request fails.

Answer

Yes, because the bucket policy may override the condition.

Answer

No, because S3 requires encryption for all requests.

Answer

Yes, because the Allow statement grants s3:GetObject.

Question 7

Refer to the exhibit. An EC2 instance with an IAM role attached attempts to access an S3 bucket, but receives an 'AccessDenied' error. The role has an attached policy allowing s3:GetObject on the bucket. What is the most likely cause?

Accepted Answer

The S3 bucket policy denies access to the role.. Even though the IAM role has an attached policy allowing s3:GetObject on the bucket, the S3 bucket policy can explicitly deny access to the role, which overrides the IAM policy. Options B, C, and D are incorrect because the role policy is attached, the trust policy allows EC2 to assume the role, and the instance profile is associated (otherwise the role would not be used).

Answer

The IAM policy is not attached to the role.

Answer

The trust policy does not allow the EC2 service to assume the role.

Answer

The EC2 instance does not have an instance profile associated with the role.

Question 8

Refer to the exhibit. An IAM user has this policy attached. Can the user create a new IAM user in the us-east-1 region?

Accepted Answer

No, because the Deny statement blocks all IAM actions in us-east-1.. The Deny statement blocks all IAM actions in us-east-1, which overrides the Allow for CreateUser. Since the Deny is explicit, it blocks the action even though there is an Allow. The request fails.

Answer

Yes, because the Allow statement explicitly permits CreateUser.

Answer

No, because IAM is a global service and region conditions do not apply.

Answer

Yes, because the Deny only applies to us-east-1.

Question 9

A company hosts a web application on EC2 instances behind an Application Load Balancer. The application accesses an S3 bucket to store user uploads. The security team needs to ensure that the EC2 instances can access the S3 bucket without storing AWS credentials on the instances. What should the security team do?

Accepted Answer

Create an IAM role with an S3 access policy and attach it to the EC2 instance profile.. An IAM instance profile with an IAM role grants temporary credentials to EC2 instances. Option A is wrong because storing credentials on instances is insecure. Option B is wrong because it's not a best practice. Option D is wrong because security groups do not grant access to S3.

Answer

Create an IAM user with programmatic access and use those credentials in the application.

Answer

Configure a security group that allows outbound traffic to the S3 bucket.

Answer

Store AWS access keys in a configuration file on the EC2 instances.

Question 10

A security engineer is designing a cross-account IAM role to allow users in Account A to access resources in Account B. The engineer wants to restrict access to only users who have authenticated with multi-factor authentication (MFA) in Account A. What condition key should the engineer use in the trust policy of the IAM role in Account B?

Accepted Answer

aws:MultiFactorAuthPresent. Aws:MultiFactorAuthPresent is the condition key used to verify whether the requesting user authenticated using multi-factor authentication (MFA). In a trust policy, this condition ensures that only MFA-authenticated users from Account A can assume the role in Account B. Option A (aws:SourceIp) is incorrect because it checks the source IP address, not MFA status. Option C (aws:RequestedRegion) is incorrect because it restricts based on the AWS region, not MFA. Option D (aws:UserAgent) is incorrect because it checks the user agent string of the request, not MFA.

Answer

aws:SourceIp

Answer

aws:RequestedRegion

Answer

aws:UserAgent

Question 11

A company's security policy requires that all IAM users must use strong passwords. Which IAM feature should be used to enforce this requirement?

Accepted Answer

IAM password policy. IAM password policies allow enforcing complexity, length, and rotation requirements for IAM users. Option A is wrong because AWS Organizations is a service for managing multiple AWS accounts, not for password policies. Option B is wrong because AWS Key Management Service (AWS KMS) is for creating and managing encryption keys, not for passwords. Option C is wrong because AWS CloudTrail is a logging service that records API activity, not for password enforcement.

Answer

AWS Organizations

Answer

AWS Key Management Service (AWS KMS)

Answer

AWS CloudTrail

Question 12

A developer is trying to push an image to Amazon ECR but receives an 'AccessDeniedException' error. The developer's IAM user has the 'AmazonEC2ContainerRegistryPowerUser' managed policy attached. What is the most likely reason for the failure?

Accepted Answer

The developer needs to call 'ecr:GetAuthorizationToken' and authenticate to the registry.. The 'AmazonEC2ContainerRegistryPowerUser' managed policy includes permissions for pushing and pulling images but does not include 'ecr:GetAuthorizationToken', which is required to authenticate Docker to the registry. Without a valid token, the push request is denied with 'AccessDeniedException'. Option B is incorrect because the error is about authentication, not region support; ECR is available in all commercial regions. Option C is incorrect because a resource policy would cause 'AccessDeniedException' if it explicitly denies, but the PowerUser policy already lacks the necessary auth permission, which is the more direct cause. Option D is incorrect because ECR has a size limit (5 GB for default layers), but that would yield a different error message, not 'AccessDeniedException'.

Answer

The developer is pushing from an unsupported region.

Answer

The ECR repository has a resource policy that denies the push.

Answer

The image is too large for ECR.

Question 13

A security engineer is configuring a VPC endpoint for Amazon S3 and wants to ensure that only traffic from specific IAM roles can access the S3 bucket through the endpoint. Which policy element should the engineer use?

Accepted Answer

aws:PrincipalArn. Aws:PrincipalArn. This condition key allows you to specify the ARN of an IAM role (or user) to control access to the S3 bucket through the VPC endpoint. Option A (aws:SourceVpc) restricts traffic to a specific VPC, not an IAM role. Option C (aws:username) is used for IAM users, not roles. Option D (aws:SourceVpce) restricts traffic to a specific VPC endpoint, not a role.

Answer

aws:SourceVpc

Answer

aws:username

Answer

aws:SourceVpce

Question 14

An IAM policy includes the following statement: 'Effect': 'Deny', 'Action': 's3:*', 'Resource': '*', 'Condition': {'Bool': {'aws:SecureTransport': 'false'}}. What does this policy do?

Accepted Answer

Denies all S3 actions when the request is not using HTTPS.. The statement uses 'Effect': 'Deny' with a condition that the request is not using HTTPS ('aws:SecureTransport': 'false'). Therefore, it denies all S3 actions when HTTPS is not used. Option A correctly describes this. Option B is wrong because the resource is '*', not a specific bucket. Option C is wrong because the denial is conditional on transport, not for all users unconditionally. Option D is wrong because it describes an allow effect, but the statement is a deny.

Answer

Denies all S3 actions to a specific bucket.

Answer

Denies all S3 actions for all users.

Answer

Allows all S3 actions only when using HTTPS.

Question 15

A company wants to allow users from an external AWS account to assume an IAM role in its account. What must be configured in both accounts?

Accepted Answer

Both the trusting account's role trust policy and the external account's IAM policy to allow sts:AssumeRole.. Cross-account role access requires configuration on both sides: the trusting account (where the role resides) must have a trust policy that allows the external account to assume the role, and the external account must have an IAM policy that grants its users permission to call sts:AssumeRole targeting that role. Option A is incorrect because an IAM password policy is unrelated to cross-account role access. Option B is incorrect because while the trusting account's trust policy is necessary, the external account also needs to grant sts:AssumeRole permission to its users. Option C is incorrect because the external account's policy alone is insufficient without the trusting account's trust policy.

Answer

An IAM password policy in both accounts.

Answer

Only the trusting account's role trust policy.

Answer

Only the external account's IAM policy to allow sts:AssumeRole.