SCS-C02 Identity and Access Management Practice Test 16 — 15 Questions

Question 1

A developer needs to allow an EC2 instance to read from a DynamoDB table named 'Orders' in the same account. The security team requires that the permissions be granted using an instance profile. Which steps should be taken?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an IAM role with a policy that allows dynamodb:GetItem on the 'Orders' table, create an instance profile, add the role to the profile, and launch the EC2 instance with the instance profile. The correct steps are to create an IAM role with the necessary policy, create an instance profile, add the role to the instance profile, and then launch the EC2 instance with that instance profile. This grants the EC2 instance temporary credentials to access DynamoDB. The instance profile is the container for the role and is required for EC2 to assume the role.

Answer

Create an instance profile and attach a policy to it, then launch the EC2 instance with the instance profile

Answer

Create an IAM role with the required policy, then attach the role directly to the EC2 instance during launch

Answer

Create an IAM user with programmatic access, store the access key in a secure S3 bucket, and have the EC2 instance retrieve the credentials at startup

Question 2

A developer wants to allow an IAM role to be assumed by an EC2 instance that is part of an Auto Scaling group. Which TWO AWS services or features are required? (Choose TWO.)

Accepted Answer

Instance profile. Option B (Instance profile) is correct because an instance profile is the container that passes an IAM role's temporary credentials to an EC2 instance; without attaching an instance profile to the instance, the EC2 instance cannot assume the role. Option C (IAM role) is correct because the role defines the permissions and trust policy that the EC2 instance assumes to obtain temporary credentials via the instance metadata service (IMDS). AWS Config (A) is a compliance and configuration tracking service and is not required to assume a role. AWS CloudFormation (D) is an infrastructure-as-code service that could optionally launch resources but is not required for role assumption. AWS Single Sign-On (E) is for human user federated access, not for EC2 instance role assumption.

Answer

AWS Config

Answer

AWS CloudFormation

Answer

AWS Single Sign-On (SSO)

Question 3

An IAM policy allows a user to pass a specific role and launch EC2 instances. The user tries to launch an EC2 instance with the role 'ec2-full-access' but receives an error: 'You are not authorized to perform iam:PassRole'. What is the MOST likely cause?

Accepted Answer

The user is attempting to pass a role with an ARN that does not exactly match the one in the policy. The error 'You are not authorized to perform iam:PassRole' indicates that the iam:PassRole permission is being denied. In IAM policies, the Resource element for iam:PassRole must specify the exact ARN of the role that can be passed. If the user attempts to pass a role whose ARN does not exactly match the ARN in the policy (e.g., due to a different path, account ID, or role name), the PassRole action is not allowed, resulting in this error. Therefore, the most likely cause is that the role ARN being passed does not match the ARN specified in the policy.

Answer

The role 'ec2-full-access' does not exist in the account

Answer

The policy is missing a condition key such as ec2:InstanceProfile

Answer

The user does not have permission to call ec2:RunInstances

Question 4

A company has a requirement to grant cross-account access to an S3 bucket named 'shared-data' in Account A (111111111111) to users in Account B (222222222222). The security team has set up a bucket policy in Account A that grants read-only access to the IAM role 'DataReader' in Account B. The bucket policy is as follows: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::222222222222:role/DataReader"},"Action":["s3:GetObject"],"Resource":"arn:aws:s3:::shared-data/*"}]}. A user in Account B assumes the 'DataReader' role, but when trying to read an object from the bucket, they receive an 'Access Denied' error. What is the MOST likely reason for this error?

Accepted Answer

The IAM role 'DataReader' does not have an IAM policy that allows s3:GetObject on the bucket.. The most likely reason for the Access Denied error is that the IAM role 'DataReader' in Account B does not have an IAM policy that allows s3:GetObject on the bucket. For cross-account access, both the bucket policy in Account A and the IAM policy in Account B must grant the necessary permissions. The bucket policy alone is not sufficient; the role must also have an identity-based policy allowing the action.

Answer

The bucket policy principal must be the IAM user ARN, not the role ARN.

Answer

The bucket policy is missing the 's3:ListBucket' action, which is required to read objects.

Answer

The bucket objects are encrypted with a KMS key, and the role does not have permission to decrypt.

Question 5

A company runs a critical application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application processes financial transactions and must store transaction logs in an Amazon S3 bucket. The security team requires that all API calls to AWS services are logged and that the logs are stored in a secure, tamper-proof manner. The team enables AWS CloudTrail to log management events and Amazon S3 server access logs for the S3 bucket. They also enable AWS Config to track resource changes. The compliance team wants to ensure that no one can disable CloudTrail logging or delete the CloudTrail log files. The security engineer proposes a solution using an SCP in AWS Organizations to deny actions that would disable CloudTrail or delete log files. However, the engineer is concerned that the SCP might be applied too broadly and affect legitimate administrative actions. The engineer wants to ensure that only the security team’s IAM role (SecurityAdminRole) can perform these restricted actions, while all other principals (including IAM users, roles, and the root user) are denied. The engineer creates an SCP that denies cloudtrail:StopLogging, cloudtrail:DeleteTrail, and s3:DeleteObject on the CloudTrail S3 bucket. The SCP includes a condition that allows the action if the principal is SecurityAdminRole. However, after applying the SCP, the security team finds that even SecurityAdminRole is unable to stop CloudTrail logging. What is the most likely cause of this issue?

Accepted Answer

The condition in the SCP is incorrectly scoped, causing the deny to apply to all principals including SecurityAdminRole.. The SCP's condition is likely misconfigured — for example, using a StringNotEquals on aws:PrincipalArn without accounting for the role's assumed-role ARN format, or placing the condition on the wrong element — causing the Deny to apply to all principals including SecurityAdminRole. SCPs are evaluated as a union of allows and an intersection of denies, so a mis-scoped Deny overrides any Allow.

Answer

The SCP is applied to the root organizational unit (OU), which includes the management account where the root user is not affected by SCPs.

Answer

The SecurityAdminRole does not have the necessary IAM permissions to stop CloudTrail logging.

Answer

The S3 bucket policy on the CloudTrail bucket denies access to the SecurityAdminRole.

Question 6

A company wants to allow its development team to have full access to Amazon S3 buckets that are tagged with 'Environment: Dev'. Which IAM policy element should be used to restrict access based on tags?

Accepted Answer

Use 'aws:ResourceTag' in the Condition element. To restrict access based on tags attached to the S3 bucket (the resource), the IAM policy must use the aws:ResourceTag condition key. This key evaluates the tags on the target resource, allowing or denying actions only when the resource carries the specified tag, such as Environment: Dev.

Answer

Use 'aws:PrincipalTag' in the Condition element

Answer

Use 'aws:SourceTag' in the Condition element

Answer

Use 'aws:RequestTag' in the Condition element

Question 7

Refer to the exhibit. A security engineer runs the 'simulate-custom-policy' command to test a policy. The output shows 'explicitDeny' for ec2:RunInstances. What is the most likely reason?

Accepted Answer

The policy includes an explicit Deny statement for ec2:RunInstances. In AWS IAM policy evaluation, an explicit Deny statement always overrides any Allow. The simulate-custom-policy command returns 'explicitDeny' when the action is explicitly denied by a Deny statement in the policy. Therefore, the most likely reason is that the policy includes an explicit Deny for ec2:RunInstances.

Answer

The policy does not include ec2:RunInstances in the Action list

Answer

The policy allows ec2:Describe* but the action ec2:RunInstances is not a Describe action

Answer

The policy uses a Resource of '*' which does not include the required resources

Question 8

Refer to the exhibit. This IAM policy is attached to a user. The user attempts to assume the AdminRole without using MFA. What is the result?

Accepted Answer

The user cannot assume the role because the Deny statement blocks all actions when MFA is not present. The Deny statement explicitly denies all actions when MFA is not present, overriding the Allow statement. Since the user is not using MFA, sts:AssumeRole is denied. Option A is incorrect because the Deny overrides the Allow. Option C is incorrect because the Deny applies to all actions, including sts:AssumeRole. Option D is incorrect because the Deny, not the Allow, imposes the MFA requirement.

Answer

The user can assume the role because the Allow statement grants it

Answer

The user can assume the role because the Deny statement does not apply to sts:AssumeRole

Answer

The user cannot assume the role because the Allow statement requires MFA

Question 9

A security engineer discovers that an IAM policy allows 'iam:CreateUser' and 'iam:CreateAccessKey' for all users in the account. Which risk does this pose?

Accepted Answer

Users can create new IAM users and programmatic access keys. The IAM policy allows 'iam:CreateUser' and 'iam:CreateAccessKey', which enables users to create new IAM users and programmatic access keys, leading to unauthorized access and privilege escalation. Option B is incorrect because the policy does not grant permissions to disable CloudTrail logging. Option C is incorrect because creating users/keys does not allow decrypting data in S3. Option D is incorrect because it does not allow modifying VPC security groups.

Answer

Users can disable CloudTrail logging

Answer

Users can decrypt data in S3

Answer

Users can modify VPC security groups

Question 10

A company wants to allow an IAM user to list only the objects in a specific S3 bucket named 'my-bucket'. Which IAM policy statement should be used?

Accepted Answer

{"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::my-bucket"}. The s3:ListBucket action operates on the bucket itself, so the Resource must be the bucket ARN without the /* wildcard: arn:aws:s3:::my-bucket. This grants permission to list objects in that specific bucket only. The /* suffix is used for object-level actions like s3:GetObject, not for ListBucket.

Answer

{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::my-bucket/*"}

Answer

{"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::my-bucket/*","Condition":{"StringEquals":{"s3:prefix":""}}}

Answer

{"Effect":"Allow","Action":"s3:*","Resource":"arn:aws:s3:::my-bucket/*"}

Question 11

A security engineer is investigating an IAM role that was used to access AWS resources from an external account. The role has a trust policy that allows the external account to assume it. Which of the following is a required step for the external account to use the role?

Accepted Answer

Attach an IAM policy to an IAM user in the external account that allows sts:AssumeRole for the role ARN.. For an external account to assume an IAM role in another account, an IAM user or role in the external account must have an IAM policy that allows the sts:AssumeRole action for the role's ARN. This is a required step because the external account's identity needs permission to call AssumeRole. The trust policy on the role allows the external account to assume it, but the external account must also grant its own identity the permission to assume that role.

Answer

Configure the role to require MFA for the external account.

Answer

Create a new IAM role in the external account with a trust policy allowing the role's ARN.

Answer

Add the external account's root user ARN to the role's trust policy.

Question 12

A developer needs to grant an EC2 instance read-only access to an S3 bucket. Which of the following is the most secure way to provide these permissions?

Accepted Answer

Create an IAM role with read-only access and attach it to the EC2 instance profile.. Using an IAM role attached to an instance profile grants temporary credentials and eliminates long-term access keys. Option A is incorrect because storing credentials in Parameter Store (or any static storage) is less secure than using an instance profile, and IAM roles do not have static credentials to store. Option C is incorrect because a bucket policy cannot grant access based on an instance's public IP in a secure or reliable way, and it would grant access to anyone with that IP, not just the instance. Option D is incorrect because storing IAM user access keys in user data exposes long-term credentials, which is less secure than using an instance profile.

Answer

Use an IAM role and store the credentials in AWS Systems Manager Parameter Store, then retrieve them at instance launch.

Answer

Create a bucket policy that grants read-only access to the instance's public IP address.

Answer

Create an IAM user with read-only access and store the access keys in the instance's user data.

Question 13

An IAM policy grants access to a DynamoDB table with a condition that the request must originate from a specific VPC endpoint. However, requests from an EC2 instance in that VPC are being denied. What is the most likely cause?

Accepted Answer

The EC2 instance is not using the VPC endpoint to access DynamoDB; it is using an internet gateway.. The IAM policy condition uses aws:SourceVpce to restrict access to requests routed through a specific VPC endpoint. If the EC2 instance reaches DynamoDB via an internet gateway (using the public DynamoDB endpoint), the request's source is not the VPC endpoint, so the condition evaluates to false and access is denied. The instance must be configured to resolve the DynamoDB service name to the VPC endpoint's private DNS name (via the endpoint's private DNS or a Route 53 private hosted zone) so traffic actually flows through the endpoint.

Answer

The EC2 instance does not have a public IP address.

Answer

The security group on the EC2 instance does not allow outbound traffic to the DynamoDB endpoint.

Answer

The VPC endpoint policy does not allow the specific DynamoDB action.

Question 14

A company wants to grant an IAM user the ability to manage (create and update) their own access keys. Which TWO IAM actions must be allowed in the policy?

Accepted Answer

iam:UpdateAccessKey. The scenario requires the IAM user to manage their own access keys, specifically to create and update them. Option B, iam:CreateAccessKey, is correct because it is the exact IAM action that permits a user to create a new access key for themselves. Option A, iam:UpdateAccessKey, is correct because it allows the user to change the status of an existing access key, such as activating or deactivating it, which falls under managing access keys. Option C, iam:GetAccessKeyLastUsed, is not required because it only retrieves metadata about when an access key was last used, not manage it. Option D, iam:DeleteAccessKey, is not required because the scenario specifies create and update, not delete. Option E, iam:ListAccessKeys, is not required because it only lists access keys and does not grant management capabilities.

Answer

iam:GetAccessKeyLastUsed

Answer

iam:DeleteAccessKey

Answer

iam:ListAccessKeys

Question 15

An IAM user has the policy shown in the exhibit. The user tries to launch an m5.large instance in us-east-1, but gets an 'AccessDenied' error. Why does this happen?

Accepted Answer

The policy restricts RunInstances to instance type t2.micro, but the user requested m5.large.. The IAM policy's RunInstances statement includes a condition that restricts the allowed instance type (likely ec2:InstanceType StringEquals t2.micro). Because the user requested m5.large, the condition evaluates false and the Allow does not apply, resulting in an implicit deny and AccessDenied.

Answer

The condition uses StringEquals, which is case-sensitive and the instance type is in the wrong case.

Answer

The policy does not allow the RunInstances action at all.

Answer

The resource ARN in the policy is incorrect for launching instances.