SCS-C02 Identity and Access Management Practice Test 16 — 15 Questions

Question 1

A large enterprise has multiple AWS accounts managed via AWS Organizations. The security team wants to enforce that all IAM roles in all accounts must have a maximum session duration of 1 hour. They create an SCP that denies creating or updating roles if the MaxSessionDuration is greater than 3600 seconds. The SCP is attached to the root OU. After applying the SCP, the development team reports that they cannot create any new IAM roles, even with a session duration of 1 hour. They are using CloudFormation to create roles. What is the MOST likely reason for the failure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The SCP is not effective; the issue is with the IAM permissions boundary.. The most likely reason. The SCP condition only denies role creation when the MaxSessionDuration parameter is explicitly provided and exceeds 3600 seconds. If not specified, the condition does not apply, so the SCP should allow role creation. Therefore, the failure is not caused by the SCP itself but rather by an IAM permissions boundary that restricts the development team's ability to create roles. Option A is incorrect because SCPs can be attached to OUs. Option C is incorrect because the condition does not trigger when MaxSessionDuration is absent. Option D is incorrect because CloudFormation supports creating IAM roles.

Answer

The SCP cannot be attached to the root OU; it must be attached to individual accounts.

Answer

The SCP denies role creation when MaxSessionDuration is not explicitly set, even if it defaults to 1 hour.

Answer

CloudFormation does not support creating IAM roles.

Question 2

A startup company has a single AWS account and a few IAM users. The CEO wants to ensure that no one can delete an S3 bucket that contains critical data. The security engineer creates an IAM policy that denies s3:DeleteBucket for all users. However, the CEO later finds that the bucket was deleted by a user who had full administrator access. Why did the policy fail to prevent the deletion?

Accepted Answer

The deny policy was not attached to the user.. An IAM policy alone does not prevent any actions unless it is attached to an IAM user, group, or role. In this scenario, the security engineer created a deny policy but did not attach it to the user. Therefore, the user still had full administrator access via the AdministratorAccess policy, which allowed the deletion. Option A is incorrect because root user actions are not relevant here. Option B is incorrect because SCPs are used in AWS Organizations, not in a single account setup. Option C is incorrect because an explicit deny does override an allow when both are attached to the same principal; however, the deny policy was never attached.

Answer

The root user deleted the bucket, which bypasses IAM policies.

Answer

A service control policy (SCP) is required to deny actions to all users.

Answer

An explicit deny cannot override an administrator policy.

Question 3

A company uses cross-account roles to allow developers in the 'dev' account to access resources in the 'prod' account. The trust policy in 'prod' allows the 'dev' account to assume the role. The developers have an IAM policy that allows sts:AssumeRole on the role ARN. However, when a developer tries to assume the role via the AWS CLI, they get an error that the role cannot be assumed. The developer can list the role using IAM. What is the MOST likely cause?

Accepted Answer

The developer is not providing the required external ID when calling sts:AssumeRole.. The most likely cause is that the trust policy in the prod account requires an external ID, and the developer did not provide it when calling sts:AssumeRole. Option B is correct because even though the developer's IAM policy allows sts:AssumeRole and the trust policy allows the dev account, an external ID requirement would cause the assumption to fail if not supplied. Option A is incorrect because the developer's policy does include sts:AssumeRole (they can list the role, which is a different permission). Option C is incorrect because there is no evidence MFA is required. Option D is incorrect because the role ARN is presumably correct since the developer can list the role via IAM.

Answer

The developer's IAM policy does not include sts:AssumeRole.

Answer

The developer must use MFA to assume the role.

Answer

The role ARN specified in the policy is incorrect.

Question 4

A company has an S3 bucket that stores sensitive data. The bucket policy allows access only from a specific VPC endpoint. A security engineer notices that an EC2 instance in the same VPC can access the bucket, but an instance in a peered VPC cannot. Both instances have the same IAM role attached. The VPC endpoint is in the first VPC and is shared via a transit gateway. What is the MOST likely reason the second instance cannot access the bucket?

Accepted Answer

The bucket policy condition on aws:sourceVpce does not match requests from the peered VPC.. The bucket policy condition 'aws:sourceVpce' checks for the VPC endpoint ID. Requests from the peered VPC do not traverse the VPC endpoint; they go through the transit gateway. Therefore, the condition fails, and the bucket denies access. Option A is incorrect because the IAM role is the same for both instances. Option C is incorrect because the VPC endpoint is accessible from the peered VPC via the transit gateway, but the condition is not met. Option D is incorrect because the transit gateway does support S3 traffic.

Answer

The IAM role does not have permissions for the second instance.

Answer

The VPC endpoint is not accessible from the peered VPC.

Answer

The transit gateway does not support S3 traffic.

Question 5

A company uses IAM roles for EC2 instances to access DynamoDB. The security team wants to ensure that the instances can only access specific DynamoDB tables. They create an IAM policy that allows dynamodb:GetItem and dynamodb:PutItem on the specific table ARN. The policy is attached to the instance role. However, when an application on the instance tries to read from the table, it receives an 'AccessDeniedException'. The application is using the correct table name. What is the MOST likely cause?

Accepted Answer

The policy does not include dynamodb:DescribeTable action.. Many AWS SDKs require the dynamodb:DescribeTable action to retrieve table metadata such as key schema and throughput settings. Without this permission, the SDK cannot execute operations like GetItem or PutItem, resulting in an AccessDeniedException. Option A is incorrect because the policy attachment is described as correct. Option B is incorrect because encryption permissions are not the issue here; the error is about table actions. Option D is incorrect because the instance profile is associated correctly.

Answer

The IAM policy is not attached to the instance profile.

Answer

The DynamoDB table is encrypted with a customer managed key that the role does not have access to.

Answer

The instance does not have the required instance profile associated.

Question 6

A security engineer is designing a CI/CD pipeline that deploys AWS infrastructure using AWS CloudFormation. The pipeline must assume an IAM role in each target account to create and update stacks. Which TWO steps are required to allow cross-account access for CloudFormation? (Choose TWO.)

Accepted Answer

Use AWS STS AssumeRole in the pipeline to obtain temporary credentials for the target account role.. The correct answers are D and E. To enable cross-account CloudFormation stacks, you must create an IAM role in the target account with a trust policy that allows the pipeline account to assume it (E). Then, the pipeline calls AWS STS AssumeRole to obtain temporary credentials for that role (D). Option A is incorrect because the service role is used for CloudFormation's own permissions, not for cross-account assumption. Option B is incorrect because root credentials should never be used; instead, temporary credentials via AssumeRole are the secure approach. Option C is incorrect because the pipeline's IAM role does not need a trust policy for the target account; instead, the target account's role trusts the pipeline account.

Answer

Create a service role for CloudFormation in the pipeline account with a trust policy for the target account.

Answer

Store the target account root credentials in AWS Secrets Manager and retrieve them in the pipeline.

Answer

Configure the pipeline's IAM role with a trust policy that allows the target account to access it.

Question 7

A developer is creating an AWS Lambda function that needs to read items from a DynamoDB table named 'Orders' in the same AWS account. The developer attaches an IAM policy to the Lambda execution role that includes the following statement: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "dynamodb:GetItem", "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/Orders" } ] } When testing the Lambda function, it fails with an access denied error when trying to read from the table. The developer checks the Lambda function's code and confirms it is calling DynamoDB correctly. What is the MOST likely reason for the access denied error?

Accepted Answer

The DynamoDB table has a resource-based policy that denies access to the Lambda execution role.. DynamoDB supports resource-based policies, and if the table has such a policy that explicitly denies access to the Lambda execution role, the request would be denied even if the role has an allow in its identity-based policy. Option A is incorrect because the error is 'access denied', not a network connectivity issue; a missing VPC endpoint would cause a timeout, not an IAM denial. Option B is incorrect because the GetItem action does not require Scan; GetItem retrieves a single item by key. Option C is incorrect because DynamoDB tables use resource-based policies, not identity-based policies; identity-based policies are attached to IAM principals like roles.

Answer

The Lambda function is in a VPC without a VPC endpoint for DynamoDB, so network connectivity fails.

Answer

The IAM policy does not include the dynamodb:Scan action, which is required for reading items.

Answer

The DynamoDB table has an identity-based policy that restricts access to specific IAM users.

Question 8

A company uses AWS Organizations with all features enabled. The security team wants to enforce that all IAM users in member accounts must use multi-factor authentication (MFA) to access the AWS Management Console. They create an SCP that denies all actions if the user does not have MFA. The SCP is attached to the root organizational unit. After a few days, users in a member account report that they can still access the console without MFA. The security team reviews the SCP and finds it is correctly configured. What is the MOST likely reason the SCP is not being enforced?

Accepted Answer

The member account is the management account of the organization, which is not affected by SCPs.. SCPs do not affect the management account of the organization. If the member account is actually the management account, the SCP does not apply. Option A is incorrect because SCPs at the root OU take precedence over any SCPs attached to member accounts unless overridden by a deny; however, the root SCP denies actions, so it would block. Option C is incorrect because SCPs do not require explicit allow; they work by default deny. Option D is incorrect because SCPs apply to all users and roles, including root user, unless explicitly exempted.

Answer

The member account has a separate SCP attached that allows the actions, overriding the root SCP.

Answer

The SCP is missing an explicit allow for the actions, so the default deny is not taking effect.

Answer

The SCP does not apply to the root user of the member account, so root can bypass MFA.

Question 9

A security engineer notices that an IAM role has a trust policy allowing any AWS account to assume it. Which attack is this misconfiguration most likely to enable?

Accepted Answer

Unauthorized access by an external attacker. An IAM role trust policy that allows any AWS account (i.e., `"Principal": {"AWS": "*"}`) to assume the role means that any user or service in any AWS account can call the STS `AssumeRole` API to obtain temporary credentials for the role. This directly enables unauthorized access by an external attacker who can discover the role ARN and assume it, gaining all permissions attached to the role.

Answer

Logging bypass via CloudTrail

Answer

Cross-service confused deputy attack

Answer

Privilege escalation by attaching additional policies

Question 10

An IAM user receives an 'AccessDenied' error when trying to list objects in an S3 bucket. The user has the following policy attached: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::example-bucket"}]}. What is the most likely reason?

Accepted Answer

The bucket policy explicitly denies the action. The IAM policy grants the s3:ListBucket action on the bucket, which should allow listing objects. However, an explicit deny in a bucket policy overrides any allow, including those from IAM policies. Since the user receives an 'AccessDenied' error, the most likely cause is that the bucket policy explicitly denies the s3:ListBucket action for this user, as explicit denies take precedence over all allows.

Answer

The policy is missing a condition

Answer

The policy does not include s3:GetObject

Answer

The policy has a syntax error

Question 11

Refer to the exhibit. An IAM policy is attached to a group. An IAM user in that group attempts to stop an EC2 instance from IP address 198.51.100.10. What will happen?

Accepted Answer

The action is denied because the source IP does not match the allowed range. The IAM policy includes a `Deny` statement with a `NotIpAddress` condition that restricts all actions (including `StopInstances`) to the IP range `10.0.0.0/8`. Since the user's source IP is `198.51.100.10`, which falls outside this range, the deny statement explicitly blocks the action. In IAM, an explicit deny always overrides any allow, so the request is denied regardless of the allow statement in the first policy block.

Answer

The action is allowed because the first statement allows StopInstances

Answer

The action is allowed because the resource is '*'

Answer

The action is denied only if the user is not using MFA

Question 12

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all IAM users in the production account must use multi-factor authentication (MFA) to access the AWS Management Console. Which combination of actions should the security team take to enforce this requirement?

Accepted Answer

Create an IAM policy that denies all console actions unless MFA is present. Attach the policy to the IAM group that contains all production users.. An IAM policy with a condition that denies all console actions unless MFA is present can be attached to an IAM group containing all production users. This enforces MFA at the user level within the account, directly meeting the requirement to ensure all IAM users in the production account must use MFA to access the AWS Management Console.

Answer

Use an SCP to deny access to the AWS Management Console unless MFA is present. Attach the SCP to the production OU.

Answer

Disable password-based access for all IAM users and require federation with an identity provider that enforces MFA.

Answer

Enable MFA on the root user and apply a password policy that requires MFA.

Question 13

An IAM policy is attached to a user. The user is trying to change their own password in the IAM console but receives an 'Access Denied' error. The user has an MFA device configured and is logged in with MFA. Why is the password change failing?

Accepted Answer

The Deny statement uses 'BoolIfExists' which evaluates to true if the condition key is not present. In the IAM console, the 'aws:MultiFactorAuthPresent' key may not be set, causing the Deny to apply even when the user has MFA.. The Deny statement uses the `BoolIfExists` condition operator with the `aws:MultiFactorAuthPresent` key. In the IAM console, the `aws:MultiFactorAuthPresent` key may not be present in the request context (e.g., during the initial password change flow before MFA is re-validated), causing `BoolIfExists` to evaluate to true when the key is absent. This triggers the Deny even though the user has an MFA device and is logged in with MFA, blocking the `iam:ChangePassword` action.

Answer

The Allow statement for iam:ChangePassword is not sufficient because the Deny statement explicitly denies all actions.

Answer

The Deny statement denies all actions unconditionally, so the Allow statement cannot override it.

Answer

The user does not have permission to change their own password because the Allow statement is not specific enough.

Question 14

A company has a single AWS account with multiple IAM users. The administrator created an IAM policy that allows all users to launch EC2 instances, but only if they use a specific AMI ID (ami-12345678) and a specific instance type (t3.micro). The policy uses a condition that checks the EC2 instance type and AMI ID. However, a user is able to launch an EC2 instance with a different AMI ID and a larger instance type. The administrator reviews the policy and confirms that the condition is correctly written. What is the most likely reason that the policy is not working as expected?

Accepted Answer

The policy does not include an explicit deny statement for non-compliant launches.. The most likely reason is that the user has another IAM policy attached (e.g., a managed policy or group policy) that allows ec2:RunInstances without the condition. IAM evaluates all policies; if any allow statement grants the action, the action is permitted unless explicitly denied. The conditional allow only restricts when that specific statement is used, but a separate unconditional allow overrides the condition. Adding an explicit deny for non-compliant launches would block them regardless of other policies.

Answer

The condition keys used (ec2:InstanceType and ec2:ImageId) are not supported for the RunInstances action in IAM policies.

Answer

The policy is attached to the user but must also be attached to the IAM group.

Answer

The condition is written incorrectly; it should use StringLike instead of StringEquals.

Question 15

A company has an S3 bucket policy that allows cross-account access for a specific IAM role in another account. The bucket policy includes a Principal element with the ARN of the role. However, users in the other account that assume the role are unable to access the bucket. Which of the following is the MOST likely cause?

Accepted Answer

The IAM role does not have a permissions policy granting s3:GetObject on the bucket.. For cross-account access using an S3 bucket policy, the IAM role in the trusted account must have a permissions policy that grants the necessary S3 actions (e.g., s3:GetObject). Without this policy, even if the bucket policy allows the role, the role itself does not have permission to perform the action. Options B, C, and D are less likely: B is possible but not the most common; C is incorrect because the trust policy allows users to assume the role, not the S3 service; D is incorrect because role ARNs are valid principals in S3 bucket policies.

Answer

The bucket policy has an explicit Deny statement that overrides the Allow.

Answer

The role's trust policy does not allow the S3 service to assume the role.

Answer

The bucket policy uses the role ARN in the Principal element instead of the AWS account ID.