SCS-C02 Identity and Access Management Practice Test 17 — 15 Questions

Question 1

An IAM policy allows the iam:PassRole action for a specific role only when the role is passed to EC2. A developer tries to launch an EC2 instance with this role, but fails. What is the most likely missing permission?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The developer does not have ec2:RunInstances permission.. iam:PassRole only authorizes the principal to hand a role to a service; it does not authorize the service action itself. To launch an EC2 instance, the developer must also have ec2:RunInstances in their identity-based policy. The scenario states the PassRole condition is correctly scoped to EC2, so the failure is most likely the absence of the EC2 launch permission. Without ec2:RunInstances, the API call is denied before PassRole is even evaluated.

Answer

The developer needs to create the role first.

Answer

The developer does not have iam:PassRole permission for the role.

Answer

The condition in the policy is incorrect; it should use 'ec2.amazonaws.com' as the service.

Question 2

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that no IAM user can have an access key older than 90 days. What is the MOST efficient way to achieve this?

Accepted Answer

Use an SCP in the root organizational unit that denies IAM actions if the access key age exceeds 90 days.. A service control policy (SCP) applied at the root organizational unit centrally enforces the 90-day access key age limit across all accounts. SCPs can use a condition like 'aws:AccessKeyAge' to deny actions (e.g., 'iam:CreateAccessKey') when the age exceeds 90 days. This is the most efficient because it's a single policy that applies to all accounts without per-account configuration or manual auditing.

Option B (AWS Config) is reactive—it only sends alerts and does not prevent excessive key age.

Option C (IAM policy in each account) requires deploying a policy to every account individually, which is less efficient and prone to gaps.

Option D disables IAM user creation entirely, which is too restrictive and does not address existing old access keys.

Answer

Use AWS Config rules to detect old access keys and send alerts.

Answer

Use an IAM policy in each account that denies access if the key age exceeds 90 days.

Answer

Use an SCP to disable IAM user creation.

Question 3

A company wants to allow an external auditor to assume a read-only role in their AWS account. The auditor's AWS account ID is 123456789012. Which trust policy should be attached to the role?

Accepted Answer

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::123456789012:root" },
      "Action": "sts:AssumeRole",
      "Condition": { "Bool": { "aws:MultiFactorAuthPresent": "true" } }
    }
  ]
}. It grants the external auditor's AWS account (via its root principal ARN) permission to assume the read-only role, while enforcing multi-factor authentication (MFA) as a security best practice. The `sts:AssumeRole` action is the standard mechanism for cross-account role assumption, and the `aws:MultiFactorAuthPresent` condition ensures the auditor uses MFA, reducing the risk of compromised credentials.

Answer

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::123456789012:root" },
      "Action": "sts:AssumeRole"
    }
  ]
}

Answer

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::123456789012:user/Auditor" },
      "Action": "sts:AssumeRole"
    }
  ]
}

Answer

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": { "AWS": "123456789012" },
      "Action": "sts:AssumeRole"
    }
  ]
}

Question 4

An administrator needs to allow a Lambda function to write logs to CloudWatch Logs. What is the BEST way to grant these permissions?

Accepted Answer

Create an IAM role with the necessary CloudWatch Logs permissions and assign it as the Lambda function's execution role.. Lambda functions assume an IAM execution role at runtime, and all AWS API calls the function makes (including CloudWatch Logs PutLogEvents) are authorized against that role's identity-based policies. Creating a role with only the required CloudWatch Logs permissions and assigning it as the execution role follows least privilege and is the standard, supported mechanism. This avoids embedding long-lived credentials and grants exactly the access needed.

Answer

Store AWS credentials in the Lambda function code.

Answer

Attach a resource-based policy to the Lambda function.

Answer

Attach the AdministratorAccess managed policy to the Lambda function's execution role.

Question 5

A security engineer is designing a permissions boundary for an IAM role used by an EC2 instance. The role must be able to read from an S3 bucket (my-bucket) and write to CloudWatch Logs. Which THREE conditions must be met for the role to have effective permissions? (Choose THREE.)

Accepted Answer

The effective permissions are the intersection of the boundary and identity-based policies.. Option B is correct because AWS evaluates a permissions boundary as a filter: the role's effective permissions are the intersection of what the identity-based policy grants and what the boundary allows, so an action must be permitted by both. Option C is correct because the identity-based policy attached to the role is the primary grant of permissions; without it allowing s3:GetObject on my-bucket and logs:CreateLogStream/logs:PutLogEvents, the role has no permissions regardless of the boundary. Option D is correct because the permissions boundary must also allow those same required actions, since any action not permitted by the boundary is denied even if the identity-based policy allows it. Option A is not required for effective permissions because an instance profile is merely the container that delivers a role's temporary credentials to EC2, not a condition that grants or restricts the role's permissions. Option E is not required because a bucket policy is only needed when cross-account access or explicit resource-based grants are involved; for same-account access, the identity-based policy plus boundary is sufficient.

Answer

The EC2 instance must have an instance profile attached.

Answer

The S3 bucket policy must explicitly allow the role.

Question 6

Which TWO of the following are best practices for managing IAM user credentials? (Choose TWO.)

Accepted Answer

Enable MFA for all IAM users.. Option C is correct because enabling multi-factor authentication (MFA) for all IAM users adds a second authentication factor beyond the password, significantly reducing the risk of credential compromise if a password is leaked or guessed. Option D is correct because regularly rotating access keys limits the window of exposure if a key is compromised and aligns with AWS security best practices for credential lifecycle management. Option A is incorrect because sharing a single IAM user across multiple developers eliminates individual accountability and makes it impossible to audit or revoke access per person; each developer should have a unique IAM user or federated identity. Option B is incorrect because storing access keys in source code repositories exposes them to anyone with repository access and is a common cause of credential leakage; secrets should be stored in AWS Secrets Manager or similar. Option E is incorrect because relying on long-term access keys for all users increases risk; temporary credentials via IAM roles or AWS STS are preferred where possible.

Answer

Create a single IAM user for multiple developers.

Answer

Store access keys in source code repositories for convenience.

Answer

Use long-term access keys for all users.

Question 7

A developer is creating an AWS Lambda function that needs to read items from a DynamoDB table. The function is deployed in a VPC with no internet access. What is the MOST secure way to grant the Lambda function access to DynamoDB?

Accepted Answer

Create a VPC endpoint for DynamoDB and attach an IAM execution role to the Lambda function with the necessary permissions.. A VPC endpoint for DynamoDB allows private connectivity from within a VPC to DynamoDB without requiring an internet gateway, NAT device, or VPN. Attaching an IAM execution role to the Lambda function with the necessary DynamoDB permissions grants the function the required access. This combination is the most secure because it keeps traffic within the AWS network and uses least privilege.

Answer

Attach a public IP to the Lambda function and use an IAM role with DynamoDB permissions.

Answer

Create an API Gateway REST API with a VPC link and DynamoDB integration.

Answer

Use a resource-based policy on the DynamoDB table allowing access from the Lambda function's ARN.

Question 8

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that no IAM user in any account can create access keys. Which policy type should be used to enforce this restriction across all accounts?

Accepted Answer

Service Control Policy (SCP). Service Control Policies (SCPs) in AWS Organizations define the maximum permissions for all IAM principals in member accounts. An SCP that denies the iam:CreateAccessKey action applied at the organization or OU level prevents any IAM user in any account from creating access keys, regardless of their identity-based policies. This is the correct mechanism for enforcing restrictions across all accounts.

Answer

IAM identity-based policy

Answer

Resource-based policy

Answer

Permissions boundary

Question 9

A company needs to grant cross-account access to an S3 bucket in Account A to users in Account B. What is the recommended approach?

Accepted Answer

Add a bucket policy in Account A that grants access to the IAM user ARNs from Account B.. A bucket policy in Account A can explicitly grant cross-account access to IAM user ARNs from Account B. This is the recommended approach for granting access to an S3 bucket across AWS accounts, as it avoids managing additional IAM users or roles and leverages the resource-based policy directly on the bucket. The bucket policy must specify the `Principal` element with the AWS account ID of Account B and the `Action` and `Resource` for the S3 operations, allowing Account B's IAM users to access the bucket after they have appropriate permissions in their own account.

Answer

Attach an IAM role to Account B's users.

Answer

Make the bucket public.

Answer

Create an IAM user in Account A and share the credentials with Account B users.

Question 10

Which THREE are valid methods for authenticating to AWS APIs? (Choose THREE.)

Accepted Answer

Access key ID and secret access key. Option A (access key ID and secret access key) is correct because long-term IAM user credentials are signed into requests via SigV4 to authenticate to AWS APIs such as the CLI, SDKs, and REST endpoints. Option C (SAML federation) is correct because AWS supports SAML 2.0-based identity federation through IAM roles and STS (AssumeRoleWithSAML), letting corporate directory users obtain temporary AWS credentials for API access. Option E (IAM role temporary credentials) is correct because STS issues short-lived credentials (access key, secret key, and session token) via AssumeRole or instance profiles, which are a standard way to authenticate API calls. Option B (SSH key pair) is not valid for AWS API authentication, as SSH keys are used for EC2 instance login, not for signing AWS API requests. Option D (client certificate) is not a general AWS API authentication method; mutual TLS client certificates are used for specific services like IoT or API Gateway custom authorizers, not as a standard AWS API credential type.

Answer

SSH key pair

Answer

Client certificate

Question 11

Refer to the exhibit. An EC2 instance with an IAM role attached attempts to access an S3 bucket, but receives an 'AccessDenied' error. The role has an attached policy allowing s3:GetObject on the bucket. What is the most likely cause?

Accepted Answer

The S3 bucket policy denies access to the role.. When an IAM role has an identity-based policy allowing s3:GetObject but access is still denied, the most likely cause is an explicit Deny in the S3 bucket policy, because in AWS an explicit Deny anywhere in the evaluation chain overrides any Allow. The bucket policy is a resource-based policy evaluated alongside the identity-based policy, and a Deny there will block the role even though the IAM policy grants permission.

Answer

The IAM policy is not attached to the role.

Answer

The trust policy does not allow the EC2 service to assume the role.

Answer

The EC2 instance does not have an instance profile associated with the role.

Question 12

A company hosts a web application on EC2 instances behind an Application Load Balancer. The application accesses an S3 bucket to store user uploads. The security team needs to ensure that the EC2 instances can access the S3 bucket without storing AWS credentials on the instances. What should the security team do?

Accepted Answer

Create an IAM role with an S3 access policy and attach it to the EC2 instance profile.. An IAM instance profile with an IAM role grants temporary credentials to EC2 instances. Option A is wrong because storing credentials on instances is insecure. Option B is wrong because it's not a best practice. Option D is wrong because security groups do not grant access to S3.

Answer

Create an IAM user with programmatic access and use those credentials in the application.

Answer

Configure a security group that allows outbound traffic to the S3 bucket.

Answer

Store AWS access keys in a configuration file on the EC2 instances.

Question 13

A company's security policy requires that all IAM users must use strong passwords. Which IAM feature should be used to enforce this requirement?

Accepted Answer

IAM password policy. The IAM password policy is the feature that enforces password requirements such as minimum length, complexity (uppercase, lowercase, numbers, symbols), reuse prevention, and expiration for IAM users. It is applied at the account level and directly addresses the requirement for strong passwords. Other services like AWS Organizations, KMS, and CloudTrail do not manage IAM user password rules.

Answer

AWS Organizations

Answer

AWS Key Management Service (AWS KMS)

Answer

AWS CloudTrail

Question 14

A security engineer is configuring a VPC endpoint for Amazon S3 and wants to ensure that only traffic from specific IAM roles can access the S3 bucket through the endpoint. Which policy element should the engineer use?

Accepted Answer

aws:PrincipalArn. Aws:PrincipalArn. This condition key allows you to specify the ARN of an IAM role (or user) to control access to the S3 bucket through the VPC endpoint. Option A (aws:SourceVpc) restricts traffic to a specific VPC, not an IAM role. Option C (aws:username) is used for IAM users, not roles. Option D (aws:SourceVpce) restricts traffic to a specific VPC endpoint, not a role.

Answer

aws:SourceVpc

Answer

aws:username

Answer

aws:SourceVpce

Question 15

An IAM policy includes the following statement: 'Effect': 'Deny', 'Action': 's3:*', 'Resource': '*', 'Condition': {'Bool': {'aws:SecureTransport': 'false'}}. What does this policy do?

Accepted Answer

Denies all S3 actions when the request is not using HTTPS.. The policy statement has an explicit Deny effect for all S3 actions on all resources, with a condition that the request must have aws:SecureTransport set to false. aws:SecureTransport is a global condition key that evaluates to true if the request uses SSL/TLS, and false otherwise. Therefore, the policy denies all S3 actions when the request is not using HTTPS (i.e., when SecureTransport is false).

Answer

Denies all S3 actions to a specific bucket.

Answer

Denies all S3 actions for all users.

Answer

Allows all S3 actions only when using HTTPS.