SCS-C02 Identity and Access Management Practice Test 17 — 15 Questions

Question 1

A company uses AWS IAM Identity Center (SSO) for managing access to multiple AWS accounts. A user reports that they can log in to the SSO portal but cannot see any AWS accounts in their dashboard. What is the most likely cause?

Accepted Answer

The user has not been assigned to any AWS accounts in IAM Identity Center.. Option C is correct because the user must be assigned to the account in IAM Identity Center with a permission set to see and access the account. Option A is wrong because the user can log in, so the identity source is fine. Option B is wrong because the permission set defines the access level, but the user must be assigned to the account first. Option D is wrong because the user is already authenticated via SSO.

Answer

The user's identity source (e.g., Active Directory) is not synchronized correctly.

Answer

The user's session token has expired.

Answer

The permission set assigned to the user does not grant any permissions.

Question 2

A company wants to allow an external auditor to read all objects in a specific S3 bucket for a limited time. What is the most secure way to grant this access?

Accepted Answer

Generate pre-signed URLs for the objects the auditor needs to read, with an expiration time.. Option C is correct because a pre-signed URL can grant temporary access to specific objects, and the URL can have an expiration time. Option A is wrong because making the bucket public is not secure. Option B is wrong because creating an IAM user for the auditor and sharing credentials is not ideal for external parties. Option D is wrong because a bucket policy with a condition for a specific IP address is an option but requires the auditor's IP and may not be as granular.

Answer

Use a bucket policy that allows access only from the auditor's IP address.

Answer

Make the bucket public and restrict access via IP address in the bucket policy.

Answer

Create an IAM user for the auditor with read-only access to the bucket and share the access keys.

Question 3

A company has an S3 bucket that contains sensitive data. The security team wants to ensure that all access to the bucket is encrypted in transit. What is the most effective way to enforce this?

Accepted Answer

Add a bucket policy that denies access if the request does not use HTTPS (aws:SecureTransport condition).. Option B is correct because a bucket policy with a condition aws:SecureTransport ensures only HTTPS requests are allowed. Option A is wrong because enabling default encryption only encrypts at rest, not in transit. Option C is wrong because CloudTrail logs do not enforce encryption. Option D is wrong because IAM policy can deny non-HTTPS but it's better to enforce at the bucket level.

Answer

Enable default encryption on the S3 bucket using SSE-S3.

Answer

Enable AWS CloudTrail to log all S3 access and alert on non-HTTPS requests.

Answer

Create an IAM policy that denies S3 actions without the condition aws:SecureTransport.

Question 4

A company uses AWS Organizations with a service control policy (SCP) that denies all IAM actions unless the request comes from a specific IP address range. A security administrator needs to create a new IAM role for a service that runs on-premises, but the request is being denied. What should the administrator do?

Accepted Answer

Modify the SCP to include the on-premises IP address range in the condition.. Option D is correct because the SCP denies all IAM actions if not from the specified IP range. To allow the on-premises service, the administrator can add the on-premises IP range to the SCP condition. Option A is wrong because the administrator already has full access but the SCP overrides. Option B is wrong because the SCP affects all principals including the administrator. Option C is wrong because the SCP applies to all accounts.

Answer

Use the root user of the management account to create the role, as root is not affected by SCPs.

Answer

Create a new IAM user in the account with full administrator access and use that user to create the role from the on-premises network.

Answer

Remove the account from the organization temporarily, create the role, and re-add the account.

Question 5

A developer is trying to use the AWS CLI to list objects in an S3 bucket but receives an AccessDenied error. The developer has an IAM user with a policy that allows s3:ListBucket on the bucket. What could be causing the error?

Accepted Answer

The S3 bucket has a bucket policy that denies access to the developer's IAM user.. Option A is correct because even if the IAM policy allows the action, the bucket policy may explicitly deny access. Option B is wrong because MFA is not required unless a condition exists. Option C is wrong because the developer can have multiple policies that combine. Option D is wrong because the bucket exists if the error is AccessDenied.

Answer

The developer has not enabled MFA on their IAM user.

Answer

The S3 bucket does not exist in the same AWS region as the CLI is configured.

Answer

The IAM policy is attached to a group, not directly to the user.

Question 6

A security engineer is designing a system to manage access to an S3 bucket containing confidential data. Which TWO actions should the engineer take to implement least privilege?

Accepted Answer

Use a condition in the IAM policy to restrict access to requests from a specific IP range.. Option A and D are correct. Option A: granting only required actions limits permissions. Option D: using a condition for source IP restricts access to known networks. Option B is wrong because full access is not least privilege. Option C is wrong because pre-signed URLs are for temporary access, not for ongoing least privilege. Option E is wrong because public access is the opposite.

Answer

Use a policy that allows s3:* for all users in the organization.

Answer

Make the bucket public and rely on object ACLs to restrict access.

Answer

Use pre-signed URLs for all access to the bucket.

Question 7

A company has a requirement that all IAM users must use multi-factor authentication (MFA) to access the AWS Management Console. Which TWO steps should the company take to enforce this?

Accepted Answer

Enable MFA devices for each IAM user.. Option A and D are correct. Option A: enabling MFA on each user is the first step. Option D: an IAM policy with a condition for aws:MultiFactorAuthPresent denies access if MFA is not present. Option B is wrong because the root user should not be used for daily tasks. Option C is wrong because password policy does not force MFA. Option E is wrong because SCPs do not enforce MFA at the user level.

Answer

Use a service control policy (SCP) to require MFA for all users.

Answer

Enable MFA for the root user only.

Answer

Configure an IAM password policy that requires MFA.

Question 8

A company wants to allow an IAM role from Account A to access an S3 bucket in Account B. Which THREE conditions must be met?

Accepted Answer

The S3 bucket policy in Account B must grant access to the IAM role in Account A.. Option A, C, and E are correct. Option A: the role must have a trust policy allowing the bucket's account to assume it? Actually, the role is in Account A, and the bucket in Account B. The role needs to be allowed by the bucket policy. So option A is incorrect: the bucket policy in Account B must allow the IAM role. Option B is correct? Let's re-evaluate: To grant cross-account access to an S3 bucket, the bucket policy in Account B must grant access to the IAM role in Account A. The IAM role in Account A must have a permissions policy that allows S3 actions, but the trust policy on the role is not needed for S3 access because S3 uses resource-based policies. So the correct conditions are: Option B: IAM role in Account A must have a permissions policy allowing S3 actions. Option C: S3 bucket policy in Account B must grant access to the IAM role. Option E: The IAM role must be assumed by a user or service in Account A. So the correct combination is B, C, E. Option A is incorrect because trust policy is for the role to be assumed by another account, not for S3 access. Option D is incorrect because an SCP could deny but is not required.

Answer

The IAM role in Account A must have a trust policy that allows the S3 bucket's account to assume the role.

Answer

A service control policy (SCP) must allow the cross-account access.

Question 9

Refer to the exhibit. An IAM user has this policy attached. The user tries to download an object from the S3 bucket using the AWS CLI from an on-premises server with IP address 198.51.100.50. What will happen?

Accepted Answer

The request will fail because the user's IP is not in the allowed range.. Option D is correct because the policy allows s3:GetObject only if the request comes from the specified IP range. Since the user's IP is outside that range, the request will be denied. Option A is wrong because the policy does not allow all IPs. Option B is wrong because there is no requirement for MFA. Option C is wrong because the policy does not require HTTPS; it only checks IP.

Answer

The request will succeed because the policy allows s3:GetObject.

Answer

The request will fail because the user must use HTTPS.

Answer

The request will fail because the user must use MFA.

Question 10

Refer to the exhibit. An EC2 instance is launched with an instance profile that references this role. The application on the instance tries to list objects in 'my-bucket' but receives an AccessDenied error. What is the most likely cause?

Accepted Answer

The S3 bucket has a bucket policy that denies access.. Option C is correct because the policy only allows s3:ListBucket on the bucket, but to list objects, the action s3:ListBucket is correct, but the resource arn:aws:s3:::my-bucket does not include the objects. To list objects, you also need s3:ListBucket on the bucket ARN and s3:GetObject on the objects? Actually, s3:ListBucket is for listing bucket contents, and it requires the bucket ARN. The error might be because the policy does not allow s3:GetObject for the objects, but the question says 'list objects' - that's s3:ListBucket. However, the policy allows s3:ListBucket on the bucket, so that should work. Option A is wrong because the trust policy allows EC2. Option B is wrong because the role has a policy. Option D is wrong because bucket policy is not mentioned. Actually, the most likely cause is that the bucket policy denies the access. So option D is correct.

Answer

The trust policy does not allow the EC2 service to assume the role.

Answer

The policy does not grant s3:GetObject permission.

Answer

The role does not have any permissions policy attached.

Question 11

Refer to the exhibit. An IAM user 'ExternalUser' from account 111111111111 tries to assume the role 'MyRole' in account 123456789012 but receives an error. The user has a policy that allows sts:AssumeRole. What is the most likely reason for the failure?

Accepted Answer

The user's AWS account has a service control policy (SCP) that denies sts:AssumeRole.. Option B is correct because the trust policy allows the specific user ARN, but if the user does not have permission to assume the role from their account, they need an IAM policy allowing sts:AssumeRole on that role. The question says the user has such a policy, so that is not the issue. Option A is wrong because the trust policy does specify a principal. Option C is wrong because the trust policy does not require MFA. Option D is wrong because the role exists. The error may be due to the user not having the correct trust policy? Actually, the trust policy allows the user, so that's fine. Another possibility is that the user's account has an SCP that denies sts:AssumeRole. So option B is plausible: the user's account might have a service control policy (SCP) that denies the action. However, the question says 'the user has a policy that allows sts:AssumeRole' but an SCP could override. So B is correct.

Answer

The role does not exist in the target account.

Answer

The user must have MFA enabled to assume the role.

Answer

The trust policy does not specify a principal.

Question 12

A security engineer needs to grant an IAM user in Account A (111111111111) access to an S3 bucket in Account B (222222222222). The bucket policy in Account B allows cross-account access from Account A. Which additional step is required?

Accepted Answer

Attach an IAM policy to the IAM user in Account A granting s3:GetObject on the bucket.. Option B is correct because cross-account access requires both a resource-based policy (bucket policy) and a permissions policy in the requesting account. Option A is wrong because you cannot attach a bucket policy to a user. Option C is wrong because S3 access points are not required. Option D is wrong because cross-account roles are an alternative, but the IAM user policy is the standard approach when using resource-based policies.

Answer

Create a cross-account role in Account B and have the user assume it.

Answer

Attach the bucket policy to the IAM user in Account A.

Answer

Create an S3 access point in Account B and grant the IAM user access.

Question 13

A company uses AWS Organizations with SCPs. The SCP for the production OU denies all actions on DynamoDB. An IAM policy attached to a user in that OU allows dynamodb:PutItem. What is the effective access?

Accepted Answer

The user cannot perform PutItem because the SCP denies all DynamoDB actions and IAM allows are overridden.. Option D is correct because SCPs are deny-by-default; they override any allow in IAM policies. Option A is wrong because SCPs apply to all principals. Option B is wrong because explicit deny in SCP overrides allow. Option C is wrong because the SCP applies to the user.

Answer

The user can perform PutItem because the IAM policy allows it.

Answer

The user cannot perform PutItem because the SCP applies only to the root account.

Answer

The user can perform PutItem only if the SCP has an explicit allow.

Question 14

A developer needs to run an application on an EC2 instance that accesses an S3 bucket. What is the best practice for granting permissions?

Accepted Answer

Create an IAM role with S3 access and attach it to the EC2 instance profile.. Option A is correct because IAM roles are the secure and recommended way to grant permissions to EC2. Option B is wrong because access keys are less secure. Option C is wrong because the bucket policy should not grant access to the instance; it should grant to the role. Option D is wrong because a service control policy does not grant permissions.

Answer

Use an SCP to allow S3 access for the instance.

Answer

Create a bucket policy that grants access to the instance ID.

Answer

Store AWS access keys on the instance and use them in the application.

Question 15

An IAM policy has the following statement: { "Effect": "Deny", "Action": "s3:*", "Resource": "*", "Condition": { "BoolIfExists": { "aws:SecureTransport": "false" } } }. What does this policy do?

Accepted Answer

Denies all S3 access if the request is not using HTTPS.. Option B is correct because the policy denies all S3 actions when the request is not using HTTPS (SecureTransport false). Option A is wrong because it denies only non-HTTPS. Option C is wrong because it does not allow anything. Option D is wrong because it does not require MFA.

Answer

Denies all S3 access for any request.

Answer

Requires MFA for all S3 access.

Answer

Allows all S3 access only if using HTTPS.