SCS-C02 Identity and Access Management Practice Test 17 — 15 Questions

Question 1

A security engineer is designing a solution to allow an external auditor to access logs in an S3 bucket in the company's AWS account. The auditor does not have an AWS account. The engineer needs to grant read-only access to the specific bucket for a limited time. Which TWO actions should the engineer take? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS STS to issue temporary credentials that the auditor can use to access the bucket.. AWS Security Token Service (STS) can issue temporary, limited-privilege credentials (access key, secret key, and session token) that the auditor can use to authenticate API requests to the S3 bucket. This approach does not require the auditor to have an AWS account and allows the engineer to control the validity period (via the DurationSeconds parameter) to enforce a limited time window. Option D is correct because a pre-signed URL embeds temporary credentials and a specific expiration time, granting read-only access to a single object without requiring the auditor to have AWS credentials or an AWS account.

Answer

Enable S3 Access Analyzer on the bucket to generate findings for the auditor.

Answer

Create a cross-account IAM role in the company's account and share the role ARN with the auditor.

Answer

Configure the bucket policy to grant access to 'Principal': '*' with a condition that limits access to the auditor's IP address.

Question 2

Refer to the exhibit. A security engineer runs the IAM Policy Simulator with the provided policy input. The result shows 'explicitDeny' for ec2:RunInstances even though the policy only contains an Allow. What is the most likely reason?

Accepted Answer

The user has an attached policy or SCP that explicitly denies ec2:RunInstances.. The most likely reason is that the user has another policy attached (such as an identity-based policy or a service control policy) that explicitly denies ec2:RunInstances. The IAM Policy Simulator evaluates all applicable policies, so even if the provided policy only contains an Allow, an explicit deny from another policy overrides and results in an explicitDeny. Option B (syntax error) is not likely because a syntax error typically causes an error or implicit deny, not an explicit deny. Option C is incorrect because the simulate-custom-policy command does support ec2:RunInstances. Option D is incorrect because an incorrect resource ARN would result in an implicit deny, not an explicit deny.

Answer

The policy input has a syntax error.

Answer

The simulate-custom-policy command does not support ec2:RunInstances.

Answer

The resource ARN is incorrect for ec2:RunInstances.

Question 3

A company uses AWS Organizations with SCPs to restrict services. An administrator creates an SCP that denies access to EC2. A developer in a member account tries to launch an EC2 instance but fails. What is the most likely reason?

Accepted Answer

The SCP from the organization denies EC2. Service Control Policies (SCPs) in AWS Organizations act as a centralized governance mechanism that applies a deny effect across all IAM principals in member accounts. When an SCP explicitly denies access to EC2, it overrides any allow permissions at the account level, including those granted by IAM policies. The developer's launch attempt fails because the SCP's deny is evaluated before any account-level permissions, effectively blocking the action regardless of the developer's IAM role or user permissions.

Answer

The root user of the account has denied EC2

Answer

The developer's IAM permissions boundary blocks EC2

Answer

The EC2 instance has a resource-based policy denying access

Question 4

A security engineer needs to ensure that an IAM role can be assumed only from a specific VPC. Which IAM policy condition key should be used?

Accepted Answer

aws:SourceVpc. Aws:SourceVpc. This condition key allows you to restrict requests to originate from a specific VPC ID. Option A, aws:RequestedRegion, restricts region, not VPC. Option B, aws:VpcSourceIp, is not a valid condition key. Option D, aws:SourceIp, restricts source IP address, not VPC.

Answer

aws:RequestedRegion

Answer

aws:VpcSourceIp

Answer

aws:SourceIp

Question 5

A company uses an IAM role to allow an EC2 instance to access an S3 bucket. The security team wants to ensure that if the EC2 instance is compromised, the attacker cannot use the role credentials to access resources outside the account. What should the security team do?

Accepted Answer

Attach a permissions boundary to the IAM role that limits access to only the required S3 bucket.. Using a permissions boundary restricts the maximum permissions the role can have, limiting the impact of a compromised instance.

Answer

Store the role credentials in AWS Secrets Manager and rotate them frequently.

Answer

Use an instance profile with a short-lived session token.

Answer

Use an SCP to deny all actions except S3 access for the role.

Question 6

Which TWO of the following are valid ways to grant an IAM user permissions to access an S3 bucket? (Choose 2.)

Accepted Answer

Attach an IAM policy to the user.. An IAM policy attached directly to a user explicitly grants that user permissions to perform specific actions on an S3 bucket. This is a fundamental method of identity-based access control in AWS, where the policy document defines allowed or denied actions (e.g., s3:GetObject) and resources (e.g., arn:aws:s3:::example-bucket/*).

Answer

Assign an instance profile to the user.

Answer

Create a VPC endpoint policy.

Answer

Use an SCP to allow access.

Question 7

A company uses an IAM role to allow an EC2 instance to access an S3 bucket. The role has an attached policy that grants s3:GetObject on the bucket. However, the application on the EC2 instance is unable to read objects. What is the MOST likely cause?

Accepted Answer

The EC2 instance does not have an IAM instance profile configured.. For an IAM role to be used by an EC2 instance, the role must be associated with an instance profile, and that profile must be attached to the instance. Without the instance profile, the instance cannot assume the role, so the application lacks the necessary permissions to read from S3. Option A is incorrect because the bucket policy denying access would be a possible cause, but it is not the most likely given that the role already has the s3:GetObject permission. Option C is incorrect because policies are attached to roles, not instances directly. Option D is incorrect because the user data script does not affect IAM permissions.

Answer

The S3 bucket policy denies access to the IAM role.

Answer

The policy is attached to the EC2 instance instead of the role.

Answer

The EC2 instance is not running the latest user data script.

Question 8

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that no IAM user in any account can create new IAM users. Which approach should be used?

Accepted Answer

Apply a service control policy (SCP) at the root organizational unit that denies IAM:CreateUser.. Service control policies (SCPs) are the correct mechanism because they allow you to centrally restrict permissions across all accounts in an AWS Organization. By attaching an SCP at the root organizational unit that denies the `iam:CreateUser` action, you ensure that no IAM user in any member account can create new IAM users, regardless of any IAM policies applied within those accounts. SCPs act as a guardrail that overrides any allow permissions granted by IAM policies.

Answer

Apply an IAM policy to the root user of each account.

Answer

Use an SCP attached to each IAM user.

Answer

Use an IAM permissions boundary on each IAM user.

Question 9

A company requires that all access to its S3 buckets be logged for compliance. Which AWS service should be used to record API calls to S3?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls for auditing purposes, making it the correct service for logging access to S3 buckets. Option A is incorrect because Amazon GuardDuty is a threat detection service, not a logging service. Option B is incorrect because Amazon Inspector assesses vulnerabilities. Option C is incorrect because AWS Config tracks resource configuration changes, not API calls.

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Answer

AWS Config

Question 10

A company wants to allow an IAM user to manage only their own password in the AWS Management Console. Which IAM policy action should be used?

Accepted Answer

iam:ChangePassword. The correct IAM policy action to allow a user to manage only their own password is iam:ChangePassword. This action enables the user to change their password in the AWS Management Console. Option A is correct. Option B (iam:ListUsers) is used to list IAM users, not relevant to password management. Option C (iam:CreateAccessKey) creates access keys, which is unrelated. Option D (iam:DeactivateMFADevice) deactivates MFA devices, also not relevant. Therefore, only iam:ChangePassword is appropriate.

Answer

iam:ListUsers

Answer

iam:CreateAccessKey

Answer

iam:DeactivateMFADevice

Question 11

Which IAM entity can be used to delegate permissions to an AWS service to perform actions on your behalf?

Accepted Answer

Service role. A service role is an IAM role that a service assumes to perform actions on your behalf. Option A is correct. Option B is wrong because a service-linked role is a special type of service role, but not all service roles are service-linked. Option C is wrong because an instance profile is used for EC2. Option D is wrong because a permissions boundary is used to set maximum permissions.

Answer

Service-linked role

Answer

Instance profile

Answer

Permissions boundary

Question 12

Which TWO actions can be used to restrict access to an S3 bucket to only users who authenticate using multi-factor authentication (MFA)? (Choose TWO.)

Accepted Answer

Use pre-signed URLs with MFA credentials. The correct answers are B and E. Option B: Pre-signed URLs generated with MFA credentials require the user to authenticate with MFA before accessing the S3 object. Option E: A bucket policy with a condition `aws:MultiFactorAuthPresent: true` enforces MFA for all operations on the bucket. Option A is wrong because AWS CloudTrail only logs API calls, it does not enforce access control. Option C is wrong because S3 bucket ACLs do not support conditions to check MFA. Option D is wrong because IAM policies with MFA conditions apply at the user/group level, not directly to the S3 bucket; the bucket policy is needed to restrict bucket access.

Answer

Use AWS CloudTrail to log requests and deny those without MFA

Answer

Set an S3 bucket ACL that requires MFA

Answer

Add a condition in the IAM policy that checks aws:MultiFactorAuthPresent is true

Question 13

A company has an S3 bucket that contains sensitive data. The security team wants to ensure that all objects uploaded to the bucket are encrypted at rest using server-side encryption with AWS KMS (SSE-KMS). What should the security team do to enforce this requirement?

Accepted Answer

Use an S3 bucket policy with a condition that denies PutObject if the x-amz-server-side-encryption header is not set to 'aws:kms'.. An S3 bucket policy with a condition that denies PutObject requests unless the x-amz-server-side-encryption header is set to 'aws:kms' ensures that only objects encrypted with SSE-KMS can be uploaded. Option A is incorrect because requiring a specific KMS key ID is not necessary; the policy should enforce the use of SSE-KMS, not a specific key. Option B is incorrect because requiring the header to be present does not enforce SSE-KMS; it could be 'AES256' for SSE-S3. Option C is incorrect because default encryption only encrypts objects that lack encryption headers; it does not prevent uploads that specify SSE-S3 or no encryption.

Answer

Use an S3 bucket policy that requires the x-amz-server-side-encryption-aws-kms-key-id header to match a specific KMS key.

Answer

Use an S3 bucket policy with a condition that requires the x-amz-server-side-encryption header to be present.

Answer

Configure the bucket's default encryption to use SSE-KMS.

Question 14

A company wants to allow cross-account access to an S3 bucket in Account A for a user in Account B. What is the correct combination of steps?

Accepted Answer

Add a bucket policy in Account A allowing access to the user in Account B, and attach an IAM policy to the user in Account B allowing access to the bucket.. Cross-account access to an S3 bucket requires two key permissions: a resource-based policy (bucket policy) in the owning account (Account A) that grants access to the specific IAM user in Account B, and an identity-based policy (IAM policy) attached to that user in Account B that permits the necessary S3 actions. Option A correctly describes this combination. Option D grants the bucket policy to the entire Account B, which may work but is less secure and not the recommended least-privilege approach; furthermore, the bucket policy to 'Account B' alone does not grant access to a specific user unless accompanied by the correct IAM policy, but the phrasing is ambiguous and not as precise as Option A. Option B suggests using an IAM role in Account A, which would require the user to assume the role, a different pattern not matching the question's scenario. Option C is incorrect because the user in Account B must have an explicit IAM policy; the bucket policy alone is insufficient.

Answer

Create an IAM role in Account A with access to the bucket, and have the user in Account B assume that role.

Answer

Add a bucket policy in Account A allowing access to Account B, and no action is needed in Account B because the user already has permissions.

Answer

Add a bucket policy in Account A allowing access to Account B, and attach an IAM policy to the user in Account B allowing access to the bucket.

Question 15

A security team needs to audit all changes to IAM resources in their AWS account. Which AWS service should they use?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls made in the AWS account, including changes to IAM resources. Therefore, option B is correct. Option A is wrong because VPC Flow Logs capture network traffic, not IAM changes. Option C is wrong because AWS Config records resource configuration changes but does not capture all API calls; it can be used to track IAM changes but CloudTrail is the primary service for API audit. Option D is wrong because CloudWatch Logs stores logs from various sources but does not capture API calls by default; it can be integrated with CloudTrail but is not the service that directly records IAM changes.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

Amazon CloudWatch Logs