SCS-C02 Identity and Access Management Practice Test 18 — 15 Questions

Question 1

A company wants to allow users from an external AWS account to assume an IAM role in its account. What must be configured in both accounts?

Accepted Answer

Both the trusting account's role trust policy and the external account's IAM policy to allow sts:AssumeRole.. Cross-account role assumption requires a two-sided trust relationship. The trusting account (where the role lives) must have a trust policy that names the external account as a Principal and allows sts:AssumeRole. The external account must also grant its users or roles an IAM policy permitting sts:AssumeRole on the role ARN, otherwise the request is denied even if the trust policy allows it.

Answer

An IAM password policy in both accounts.

Answer

Only the trusting account's role trust policy.

Answer

Only the external account's IAM policy to allow sts:AssumeRole.

Question 2

A company has an S3 bucket with a bucket policy that grants access to an IAM role used by an application running on EC2. The application is unable to read objects from the bucket, even though the IAM role has the necessary permissions. What is the most likely cause?

Accepted Answer

The bucket policy denies access to the IAM role.. The most likely cause is that the bucket policy explicitly denies access to the IAM role. Even though the IAM role has the necessary permissions via its attached policies, an explicit deny in the bucket policy overrides any allow, resulting in denied access. Option A is incorrect because cross-account access can be granted with proper permissions. Option C is incorrect because while a missing explicit allow would also deny access by default, the question says the IAM role has the necessary permissions, implying the issue is an explicit deny. Option D is incorrect because if the IAM role had an explicit deny, it would also deny access, but the role is stated to have the necessary permissions.

Answer

The bucket is in a different AWS account.

Answer

The bucket policy does not explicitly allow the IAM role.

Answer

The IAM role has an explicit deny statement.

Question 3

A security engineer needs to restrict access to an S3 bucket so that only requests from a specific VPC endpoint are allowed. Which condition must be configured?

Accepted Answer

aws:SourceVpce. To restrict S3 bucket access to a specific VPC endpoint, the bucket policy must include a condition that checks the VPC endpoint ID. The condition key `aws:SourceVpce` evaluates the endpoint ID of the VPC endpoint through which the request arrives. This ensures that only requests originating from that specific endpoint are allowed, effectively blocking access from the public internet or other endpoints.

Answer

aws:SourceIp

Answer

aws:UserAgent

Answer

aws:SourceVpc

Answer

aws:Referer

Question 4

An IAM policy includes the following statement: 'Effect': 'Allow', 'Action': 's3:GetObject', 'Resource': 'arn:aws:s3:::example-bucket/*', 'Condition': {'IpAddress': {'aws:SourceIp': '192.0.2.0/24'}}. Which TWO statements about this policy are correct?

Accepted Answer

Requests from outside 192.0.2.0/24 will be implicitly denied.. Option E is correct because the statement's Action is s3:GetObject and its Condition restricts aws:SourceIp to 192.0.2.0/24, so the allow applies exactly to GetObject requests originating from that CIDR range. Option B is correct because IAM policies are deny-by-default: any request that does not satisfy the IpAddress condition (i.e., comes from outside 192.0.2.0/24) is not matched by this Allow and is therefore implicitly denied, absent another applicable allow. Option A is wrong because s3:PutObject is not listed in the Action, so the policy never grants write access. Option C is wrong because there is no condition on bucket ownership; the only condition is the source IP. Option D is wrong because the policy grants no anonymous/public access by itself—it only allows GetObject when the request's source IP falls in the specified range, and it does not remove authentication requirements.

Answer

The policy allows s3:PutObject from the IP range 192.0.2.0/24.

Answer

The policy allows s3:GetObject only if the bucket owner matches.

Answer

The policy allows anonymous access.

Question 5

A company wants to enforce that all IAM users must use multi-factor authentication (MFA) to access the AWS Management Console. Which THREE steps should the company take?

Accepted Answer

Create an IAM policy that denies all actions if aws:MultiFactorAuthPresent is false.. The correct steps are to enable MFA for each IAM user (E), create an IAM policy that denies all actions if `aws:MultiFactorAuthPresent` is false (A), and attach the policy to all IAM users or groups (C). Enabling MFA per user is a prerequisite. The policy enforces MFA usage by denying API calls when MFA is not present. Attaching the policy ensures it applies to users. Option B (CloudTrail) is for auditing, not enforcement. Option D (password policy) does not enforce MFA for console access; it only sets password requirements.

Answer

Enable CloudTrail to monitor MFA usage.

Answer

Set the password policy to require MFA.

Question 6

Refer to the exhibit. An IAM policy allows running EC2 instances. A developer tries to launch a t2.micro instance but receives an 'AccessDenied' error. What is the most likely reason?

Accepted Answer

The policy does not grant permissions for other required resources such as images or security groups.. Even though the policy allows the ec2:RunInstances action on the instance resource, the RunInstances API call requires permissions for other resources such as Amazon Machine Images (AMI), security groups, and key pairs. Without explicit permissions for these resources, the API call fails with an AccessDenied error. Option B is incorrect because the condition specifies t2.micro, matching the developer's request. Option C is incorrect because the policy does not restrict by region. Option D is incorrect because there is no explicit deny; the denial is due to missing resource permissions.

Answer

The developer is trying to launch a different instance type.

Answer

The region in the policy does not match the developer's region.

Answer

The policy has an explicit deny elsewhere.

Question 7

A company is using IAM roles to grant EC2 instances access to an S3 bucket. The security team wants to ensure that the instances can only access their own bucket. Which policy should be attached to the IAM role to enforce this?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::my-bucket/*"}]}. Option D is the only policy that scopes the Allow to a specific bucket ARN (arn:aws:s3:::my-bucket/*), which enforces least privilege by ensuring the role can only access objects in that one bucket. The other options either grant wildcard access or use conditions that do not restrict the resource to the instance's own bucket.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:*","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"*","Condition":{"IpAddress":{"aws:SourceIp":"10.0.0.0/16"}}}]}

Question 8

A company has multiple AWS accounts and wants to allow a user in the production account to assume a role in the development account. The role in the development account has a trust policy that allows the production account to assume it. What additional configuration is required?

Accepted Answer

Attach a policy to the user in the production account allowing sts:AssumeRole for the development role ARN.. The user in the production account must have an IAM policy that allows sts:AssumeRole targeting the development account role ARN. Option B is wrong because the trust policy is already set. Option C is wrong because the role must be created in the development account. Option D is wrong because the trust policy should reference the production account.

Answer

Modify the trust policy of the role in the development account to allow the user ARN instead of the account ARN.

Answer

Set up a VPC peering connection between the accounts.

Answer

Create a new IAM user in the development account with the same name.

Question 9

An organization wants to enforce multi-factor authentication (MFA) for all IAM users who perform sensitive actions. Which condition key should be used in an IAM policy to require MFA?

Accepted Answer

aws:MultiFactorAuthPresent. The condition key 'aws:MultiFactorAuthPresent' is used in IAM policies to check whether the principal authenticated with MFA. When set to 'true' in a policy condition, it requires that the user has presented a valid MFA token for the request to be allowed, making it the correct choice for enforcing MFA on sensitive actions.

Answer

aws:SourceIp

Answer

aws:UserAgent

Answer

aws:CurrentTime

Question 10

A company wants to allow a Lambda function to read objects from an S3 bucket in the same account. What should be done?

Accepted Answer

Create an IAM role with an S3 read policy and attach it to the Lambda function.. Lambda functions require an IAM role (execution role) to obtain temporary AWS credentials via the AWS Security Token Service (STS). Attaching a policy with s3:GetObject permissions to this role grants the Lambda function the necessary access to read objects from the S3 bucket without hardcoding long-term credentials.

Answer

Store IAM user access keys in the Lambda function's environment variables.

Answer

Add a bucket policy allowing s3:GetObject for the Lambda service principal.

Answer

Configure the S3 bucket to be public.

Question 11

An administrator wants to audit all IAM actions in the account. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity, including all IAM actions. AWS Config tracks resource configuration changes, not API actions. Amazon GuardDuty is a threat detection service. Amazon CloudWatch monitors metrics and logs, but does not record API calls.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

Amazon CloudWatch

Question 12

A company has an S3 bucket with a bucket policy that grants access to an IAM role. The security team wants to restrict access to only requests that originate from the company's VPC. How can this be achieved?

Accepted Answer

Add a condition in the bucket policy using aws:SourceVpce with the VPC endpoint ID.. To restrict S3 bucket access to requests originating from a VPC, you add a condition to the bucket policy using the aws:SourceVpce condition key with the VPC endpoint ID. This ensures that only requests traversing the specified VPC endpoint (and thus originating from within the VPC) are allowed, which is the standard, secure way to enforce VPC-origin access for S3.

Answer

Create a new IAM role that can only be assumed by instances in the VPC.

Answer

Add a condition in the IAM role policy using aws:SourceVpce.

Answer

Add a condition in the bucket policy using aws:SourceIp with the VPC CIDR range.

Question 13

Which IAM entity can be used to grant temporary access to AWS resources for users from a different AWS account?

Accepted Answer

IAM role. An IAM role is the correct entity because it is specifically designed to grant temporary, cross-account access to AWS resources. When a user from a different AWS account assumes a role, AWS STS (Security Token Service) issues temporary security credentials (access key, secret key, and session token) that are valid for a configurable duration (default 1 hour, max 12 hours). This avoids the need to create permanent IAM users or share long-term credentials across accounts.

Answer

IAM group

Answer

IAM policy

Answer

IAM user

Question 14

Which THREE are best practices for securing IAM in an AWS environment? (Choose THREE.)

Accepted Answer

Use IAM roles for applications running on EC2.. Using IAM roles for EC2 instances eliminates the need to store long-term AWS credentials (access keys) on the instance. Instead, the instance assumes the role via the EC2 metadata service, which automatically rotates temporary security credentials (via AWS STS). This follows the principle of least privilege and reduces the risk of credential leakage.

Answer

Use the AWS account root user for daily administrative tasks.

Answer

Grant broad permissions to simplify management.

Question 15

Which TWO services can be used to manage identity and access across multiple AWS accounts? (Choose TWO.)

Accepted Answer

AWS Organizations. AWS Organizations (B) is correct because it centrally manages multiple AWS accounts under a single organization, enabling consolidated billing and centralized policy-based governance through Service Control Policies (SCPs) that control access across all member accounts. AWS Single Sign-On (C) is correct because it provides centralized identity and access management across multiple AWS accounts, letting users sign in once with their existing corporate credentials and access assigned accounts and roles via permission sets. Amazon Cognito (A) is incorrect because it is a customer-facing identity service for web and mobile applications (user pools and identity pools), not for managing access across AWS accounts. AWS Config (D) is incorrect because it is a configuration compliance and auditing service that records resource changes, not an identity and access management service. AWS CloudTrail (E) is incorrect because it logs API activity and account events for auditing, not identity or access management.

Answer

Amazon Cognito

Answer

AWS Config

Answer

AWS CloudTrail