SCS-C02 Identity and Access Management Practice Test 16 — 15 Questions

Question 1

A developer needs to allow an IAM user to manage their own password in the AWS Management Console. Which IAM policy should be attached to the user?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"iam:ChangePassword","Resource":"arn:aws:iam::*:user/${aws:username}"}]}. Option C is correct because it allows the user to change their own password. Option A is wrong because it allows any user to change any password. Option B is wrong because it allows listing users. Option D is wrong because it denies password change.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"iam:ChangePassword","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"iam:ListUsers","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"iam:ChangePassword","Resource":"*"}]}

Question 2

A company has multiple AWS accounts and wants to allow a user in the production account to assume a role in the development account. The role in the development account has a trust policy that allows the production account to assume it. What additional configuration is required?

Accepted Answer

Attach a policy to the user in the production account allowing sts:AssumeRole for the development role ARN.. Option A is correct: the user in the production account must have an IAM policy that allows sts:AssumeRole targeting the development account role ARN. Option B is wrong because the trust policy is already set. Option C is wrong because the role must be created in the development account. Option D is wrong because the trust policy should reference the production account.

Answer

Modify the trust policy of the role in the development account to allow the user ARN instead of the account ARN.

Answer

Set up a VPC peering connection between the accounts.

Answer

Create a new IAM user in the development account with the same name.

Question 3

An organization wants to enforce multi-factor authentication (MFA) for all IAM users who perform sensitive actions. Which condition key should be used in an IAM policy to require MFA?

Accepted Answer

aws:MultiFactorAuthPresent. Option B is correct: aws:MultiFactorAuthPresent is the condition key. Option A is wrong because it checks the time. Option C is wrong because it checks the user agent. Option D is wrong because it checks the source IP.

Answer

aws:SourceIp

Answer

aws:UserAgent

Answer

aws:CurrentTime

Question 4

A security engineer notices that an IAM role allows an EC2 instance to access a DynamoDB table. The instance is compromised. What is the best way to immediately revoke the instance's access without affecting other resources that use the same role?

Accepted Answer

Attach a permissions boundary to the role that denies all DynamoDB actions.. Option C is correct: using a permissions boundary can limit the role's permissions. Option A is wrong because deleting the role would affect all resources using it. Option B is wrong because stopping the instance may not be immediate and could be delayed. Option D is wrong because modifying the trust policy would break all instances using that role.

Answer

Stop the EC2 instance.

Answer

Modify the trust policy of the role to deny the instance's ARN.

Answer

Delete the IAM role.

Question 5

A company wants to allow a Lambda function to read objects from an S3 bucket in the same account. What should be done?

Accepted Answer

Create an IAM role with an S3 read policy and attach it to the Lambda function.. Option B is correct because Lambda functions require an IAM role (execution role) to obtain temporary AWS credentials via the AWS Security Token Service (STS). Attaching a policy with s3:GetObject permissions to this role grants the Lambda function the necessary access to read objects from the S3 bucket without hardcoding long-term credentials.

Answer

Store IAM user access keys in the Lambda function's environment variables.

Answer

Add a bucket policy allowing s3:GetObject for the Lambda service principal.

Answer

Configure the S3 bucket to be public.

Question 6

An administrator wants to audit all IAM actions in the account. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. Option D is correct: AWS CloudTrail records API activity. Option A is wrong because CloudWatch is for monitoring metrics. Option B is wrong because Config tracks resource configuration changes. Option C is wrong because GuardDuty is for threat detection.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

Amazon CloudWatch

Question 7

A company has an S3 bucket with a bucket policy that grants access to an IAM role. The security team wants to restrict access to only requests that originate from the company's VPC. How can this be achieved?

Accepted Answer

Add a condition in the bucket policy using aws:SourceVpce with the VPC endpoint ID.. Option A is correct: use a VPC endpoint and the aws:SourceVpce condition. Option B is wrong because aws:SourceIp is not effective for VPC traffic from S3. Option C is wrong because the condition is on the bucket policy, not the role policy. Option D is wrong because allowing only specific instances is not granular.

Answer

Create a new IAM role that can only be assumed by instances in the VPC.

Answer

Add a condition in the IAM role policy using aws:SourceVpce.

Answer

Add a condition in the bucket policy using aws:SourceIp with the VPC CIDR range.

Question 8

Which IAM entity can be used to grant temporary access to AWS resources for users from a different AWS account?

Accepted Answer

IAM role. An IAM role is the correct entity because it is specifically designed to grant temporary, cross-account access to AWS resources. When a user from a different AWS account assumes a role, AWS STS (Security Token Service) issues temporary security credentials (access key, secret key, and session token) that are valid for a configurable duration (default 1 hour, max 12 hours). This avoids the need to create permanent IAM users or share long-term credentials across accounts.

Answer

IAM group

Answer

IAM policy

Answer

IAM user

Question 9

Which TWO actions are valid ways to grant an IAM user access to an S3 bucket owned by another AWS account? (Choose TWO.)

Accepted Answer

Have the user assume an IAM role in the bucket-owning account with appropriate permissions.. Correct answers are B and C. Bucket policies allow cross-account access when the bucket policy grants access to the user's account, and the user must have explicit permission. ACLs are legacy but can grant cross-account access. Role assumption is also valid.

Answer

Attach an IAM policy to the user in their own account allowing access to the bucket.

Answer

Add the user's ARN to the bucket's ACL.

Answer

Use an S3 access point with a policy that allows the user.

Question 10

Which THREE are best practices for securing IAM in an AWS environment? (Choose THREE.)

Accepted Answer

Use IAM roles for applications running on EC2.. Option A is correct because using IAM roles for EC2 instances eliminates the need to store long-term AWS credentials (access keys) on the instance. Instead, the instance assumes the role via the EC2 metadata service, which automatically rotates temporary security credentials (via AWS STS). This follows the principle of least privilege and reduces the risk of credential leakage.

Answer

Use the AWS account root user for daily administrative tasks.

Answer

Grant broad permissions to simplify management.

Question 11

Which TWO services can be used to manage identity and access across multiple AWS accounts? (Choose TWO.)

Accepted Answer

AWS Organizations. Correct answers are B and D. AWS Organizations allows you to centrally manage accounts and apply SCPs. IAM is used per account. AWS SSO (now IAM Identity Center) provides single sign-on across accounts. CloudTrail is auditing, not access management. Config is configuration management.

Answer

Amazon Cognito

Answer

AWS Config

Answer

AWS CloudTrail

Question 12

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that any new account created in the organization automatically has an S3 bucket policy that blocks public access. What is the most efficient way to enforce this requirement?

Accepted Answer

Attach a service control policy (SCP) at the root level that denies the s3:PutBucketPublicAccessBlock action with a condition that the bucket must have public access blocked.. Option D is correct because a service control policy (SCP) can be applied at the root organizational unit to deny the creation of S3 buckets without the public access block. Option A is wrong because it would require manual creation for each account. Option B is wrong because CloudFormation StackSets require accounts to be part of the stack set, which is not automatic for new accounts. Option C is wrong because Config rules can detect but not enforce automatically.

Answer

Create an AWS CloudFormation template that includes the S3 bucket policy and deploy it to each new account manually.

Answer

Use AWS Config rules to detect S3 buckets without public access block and automatically remediate.

Answer

Use AWS CloudFormation StackSets to deploy the bucket policy to all existing and future accounts.

Question 13

A developer needs to access an S3 bucket from an EC2 instance. The developer creates an IAM role with the necessary S3 permissions and attaches it to the instance profile. However, applications running on the instance can still not access the bucket. What is the most likely cause?

Accepted Answer

The IAM role is not attached to the EC2 instance's instance profile.. Option C is correct because the instance profile must be associated with the EC2 instance at launch or by attaching the profile. Option A is wrong because instance metadata is used by the AWS CLI to obtain credentials. Option B is wrong because a bucket policy with a condition for a specific principal is not required. Option D is wrong because the IAM role can be attached to an existing instance via the instance profile.

Answer

The IAM role cannot be attached after the EC2 instance is launched.

Answer

The instance metadata service is disabled on the EC2 instance.

Answer

The S3 bucket policy does not explicitly grant access to the IAM role.

Question 14

A company wants to allow its users to assume an IAM role in a different AWS account. What must the company configure to enable cross-account access?

Accepted Answer

In the target account, create an IAM role with a trust policy that allows the source account, and attach a permissions policy to that role. In the source account, allow users to call sts:AssumeRole.. Option A is correct because cross-account access requires a trust policy in the target account's role that allows the source account to assume it, and a permissions policy that grants the necessary actions. Option B is wrong because resource-based policies are not used for role assumption. Option C is wrong because IAM users from the source account need a policy to call AssumeRole, but the trust policy is the key. Option D is wrong because the trust policy goes on the role, not the IAM group.

Answer

In the source account, create an S3 bucket policy that allows access from the target account.

Answer

In the target account, create an IAM user and share the access keys securely with the source account users.

Answer

In the target account, attach a trust policy to an IAM group that allows the source account.

Question 15

A security engineer notices that a developer's IAM user has full administrator access. The engineer wants to implement the principle of least privilege for the developer. What is the best way to proceed?

Accepted Answer

Use IAM Access Advisor to review the developer's historical usage and create a custom policy that only includes the services and actions used.. Option B is correct because starting with a minimal set of permissions and gradually adding based on actual usage is the principle of least privilege. Option A is wrong because using the managed policy for job function may grant more permissions than needed. Option C is wrong because removing administrative access without providing alternative permissions would break the developer's work. Option D is wrong because IAM Access Analyzer helps analyze existing policies but does not provide automated least privilege.

Answer

Create a new IAM group with the AdministratorAccess policy and add the developer to the group.

Answer

Replace the AdministratorAccess policy with a managed job function policy such as PowerUserAccess.

Answer

Remove the administrative access and ask the developer to request permissions as needed.