SCS-C02 Identity and Access Management Practice Test 15 — 15 Questions

Question 1

A security engineer is designing a cross-account IAM role to allow users in Account A to access resources in Account B. The engineer wants to restrict access to only users who have authenticated with multi-factor authentication (MFA) in Account A. What condition key should the engineer use in the trust policy of the IAM role in Account B?

Accepted Answer

aws:MultiFactorAuthPresent. Option D is correct because aws:MultiFactorAuthPresent is the condition key to check MFA status. Option A is wrong because aws:SourceIp checks source IP. Option B is wrong because aws:RequestedRegion checks region. Option C is wrong because aws:UserAgent checks user agent string.

Answer

aws:SourceIp

Answer

aws:RequestedRegion

Answer

aws:UserAgent

Question 2

A company's security policy requires that all IAM users must use strong passwords. Which IAM feature should be used to enforce this requirement?

Accepted Answer

IAM password policy. Option C is correct because IAM password policies allow enforcing complexity, length, and rotation. Option A is wrong because AWS KMS is for encryption keys. Option B is wrong because AWS Organizations is for managing multiple accounts. Option D is wrong because AWS CloudTrail is for logging.

Answer

AWS Organizations

Answer

AWS Key Management Service (AWS KMS)

Answer

AWS CloudTrail

Question 3

A developer is trying to push an image to Amazon ECR but receives an 'AccessDeniedException' error. The developer's IAM user has the 'AmazonEC2ContainerRegistryPowerUser' managed policy attached. What is the most likely reason for the failure?

Accepted Answer

The developer needs to call 'ecr:GetAuthorizationToken' and authenticate to the registry.. Option B is correct because ECR requires authentication via 'ecr:GetAuthorizationToken' which is not included in the PowerUser policy. Option A is wrong because the error is not about resource policy. Option C is wrong because the error is access denied, not unsupported media type. Option D is wrong because the error is not about image size.

Answer

The developer is pushing from an unsupported region.

Answer

The ECR repository has a resource policy that denies the push.

Answer

The image is too large for ECR.

Question 4

A security engineer is configuring a VPC endpoint for Amazon S3 and wants to ensure that only traffic from specific IAM roles can access the S3 bucket through the endpoint. Which policy element should the engineer use?

Accepted Answer

aws:PrincipalArn. Option A is correct because VPC endpoint policies can use 'aws:PrincipalArn' condition to restrict access to specific IAM roles. Option B is wrong because 'aws:SourceVpc' restricts to a specific VPC, not IAM role. Option C is wrong because 'aws:SourceVpce' restricts to a specific endpoint, not role. Option D is wrong because 'aws:username' is for IAM users, not roles.

Answer

aws:SourceVpc

Answer

aws:username

Answer

aws:SourceVpce

Question 5

An IAM policy includes the following statement: 'Effect': 'Deny', 'Action': 's3:*', 'Resource': '*', 'Condition': {'Bool': {'aws:SecureTransport': 'false'}}. What does this policy do?

Accepted Answer

Denies all S3 actions when the request is not using HTTPS.. Option D is correct because the policy denies all S3 actions when the request is not using HTTPS. Option A is wrong because it denies, not allows. Option B is wrong because it denies all S3 actions, not just certain ones. Option C is wrong because it denies all S3 actions, not just to a specific bucket.

Answer

Denies all S3 actions to a specific bucket.

Answer

Denies all S3 actions for all users.

Answer

Allows all S3 actions only when using HTTPS.

Question 6

A company wants to allow users from an external AWS account to assume an IAM role in its account. What must be configured in both accounts?

Accepted Answer

Both the trusting account's role trust policy and the external account's IAM policy to allow sts:AssumeRole.. Option C is correct because the trusting account (role owner) must have a trust policy allowing the external account, and the external account must have a policy granting users permission to assume the role. Option A is wrong because only the trusting account needs trust policy. Option B is wrong because only the external account needs to grant sts:AssumeRole. Option D is wrong because neither account needs password policy.

Answer

An IAM password policy in both accounts.

Answer

Only the trusting account's role trust policy.

Answer

Only the external account's IAM policy to allow sts:AssumeRole.

Question 7

A security auditor notices that an IAM role has a policy that grants 'iam:PassRole' to a specific EC2 instance profile. What is the security implication of this permission?

Accepted Answer

It could allow privilege escalation if the role passes a role with more permissions to an EC2 instance.. Option B is correct because iam:PassRole allows passing a role to an AWS service, which could lead to privilege escalation if the role has more permissions than intended. Option A is wrong because it's not about changing policies. Option C is wrong because it's not about creating users. Option D is wrong because it's not about deleting roles.

Answer

It allows the role to delete IAM roles.

Answer

It allows the role to create new IAM policies.

Answer

It allows the role to create new IAM users.

Question 8

A company has an S3 bucket with a bucket policy that grants access to an IAM role used by an application running on EC2. The application is unable to read objects from the bucket, even though the IAM role has the necessary permissions. What is the most likely cause?

Accepted Answer

The bucket policy denies access to the IAM role.. Option C is correct because S3 bucket policies and IAM policies must both allow access; if either denies, access is denied. Option A is wrong because explicit deny overrides allow, but the bucket policy might not have an explicit deny. Option B is wrong because the bucket policy might not allow the role. Option D is wrong because service control policies apply at organization level, not directly.

Answer

The bucket is in a different AWS account.

Answer

The bucket policy does not explicitly allow the IAM role.

Answer

The IAM role has an explicit deny statement.

Question 9

A security engineer needs to restrict access to an S3 bucket so that only requests from a specific VPC endpoint are allowed. Which TWO conditions must be configured?

Accepted Answer

aws:SourceVpce. Option A and C are correct because aws:SourceVpce restricts to a specific VPC endpoint, and aws:SourceVpc restricts to a specific VPC. Option B is wrong because aws:SourceIp is not applicable for VPC endpoint. Option D is wrong because aws:UserAgent is not relevant. Option E is wrong because aws:Referer is not relevant.

Answer

aws:SourceIp

Answer

aws:UserAgent

Answer

aws:Referer

Question 10

An IAM policy includes the following statement: 'Effect': 'Allow', 'Action': 's3:GetObject', 'Resource': 'arn:aws:s3:::example-bucket/*', 'Condition': {'IpAddress': {'aws:SourceIp': '192.0.2.0/24'}}. Which TWO statements about this policy are correct?

Accepted Answer

Requests from outside 192.0.2.0/24 will be implicitly denied.. Option A and D are correct because the policy allows GetObject from the specified IP range, and any request from outside that range will be implicitly denied. Option B is wrong because the condition is on source IP, not bucket owner. Option C is wrong because the policy allows GetObject, not PutObject. Option E is wrong because the policy does not allow anonymous access; it requires the request to come from the specified IP.

Answer

The policy allows s3:PutObject from the IP range 192.0.2.0/24.

Answer

The policy allows s3:GetObject only if the bucket owner matches.

Answer

The policy allows anonymous access.

Question 11

A company wants to enforce that all IAM users must use multi-factor authentication (MFA) to access the AWS Management Console. Which THREE steps should the company take?

Accepted Answer

Create an IAM policy that denies all actions if aws:MultiFactorAuthPresent is false.. Option A, B, and D are correct because MFA devices must be assigned, an IAM policy can deny access if MFA is not present, and the policy must be attached to users or groups. Option C is wrong because CloudTrail does not enforce MFA. Option E is wrong because there is no built-in MFA enforcement for the root user via password policy.

Answer

Enable CloudTrail to monitor MFA usage.

Answer

Set the password policy to require MFA.

Question 12

Refer to the exhibit. An IAM policy allows running EC2 instances. A developer tries to launch a t2.micro instance but receives an 'AccessDenied' error. What is the most likely reason?

Accepted Answer

The policy does not grant permissions for other required resources such as images or security groups.. Option C is correct because the policy only allows the instance resource, but RunInstances also requires permissions for other resources like images, security groups, etc. Option A is wrong because the condition is on instance type, not on region. Option B is wrong because the condition matches, so that is not the issue. Option D is wrong because the action is allowed, but missing resource permissions cause denial.

Answer

The developer is trying to launch a different instance type.

Answer

The region in the policy does not match the developer's region.

Answer

The policy has an explicit deny elsewhere.

Question 13

Refer to the exhibit. A developer is trying to list objects in a Google Cloud Storage bucket from an AWS environment. What is the most likely cause of the error?

Accepted Answer

The developer is using the wrong command (gsutil instead of aws s3).. Option A is correct because the error indicates a Google Cloud Storage bucket, not an AWS S3 bucket, so the developer is using wrong command. Option B is wrong because it's a Google Cloud bucket, not S3. Option C is wrong because there is no such bucket or wrong syntax. Option D is wrong because IAM roles do not apply to Google Cloud.

Answer

The bucket name is incorrect.

Answer

The IAM role does not have S3 permissions.

Answer

The S3 bucket policy does not allow the user.

Question 14

Refer to the exhibit. This trust policy is attached to an IAM role. What does it allow?

Accepted Answer

The root user of account 123456789012 to assume the role only if MFA is present.. Option D is correct because the trust policy allows the root user of account 123456789012 to assume the role only if MFA is present. Option A is wrong because it requires MFA. Option B is wrong because it allows the root user, not all users. Option C is wrong because it allows the root user, not specific users.

Answer

All IAM users in account 123456789012 to assume the role with MFA.

Answer

The root user of account 123456789012 to assume the role without MFA.

Answer

Any user in account 123456789012 to assume the role without MFA.

Question 15

A company is using IAM roles to grant EC2 instances access to an S3 bucket. The security team wants to ensure that the instances can only access their own bucket. Which policy should be attached to the IAM role to enforce this?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::my-bucket/*"}]}. Option C is correct because the condition aws:SourceIp is not relevant for EC2 instances; the correct approach is to use a resource-based policy on the S3 bucket that allows access only from the IAM role. Option A is wrong because it allows all S3 actions. Option B is wrong because it allows all resources. Option D is wrong because it uses an IP condition that is not applicable.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:*","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"*","Condition":{"IpAddress":{"aws:SourceIp":"10.0.0.0/16"}}}]}