SCS-C02 Identity and Access Management Practice Test 18 — 15 Questions

Question 1

A developer wants to allow an IAM role to be assumed by an EC2 instance that is part of an Auto Scaling group. Which TWO AWS services or features are required? (Choose TWO.)

Accepted Answer

Instance profile. An instance profile is required to attach an IAM role to an EC2 instance. When an EC2 instance is launched with an instance profile, the AWS credentials provider on the instance can retrieve temporary security credentials from the IAM role via the instance metadata service (IMDS). This allows the instance to assume the role and perform authorized API actions without embedding long-term credentials.

Answer

AWS Config

Answer

AWS CloudFormation

Answer

AWS Single Sign-On (SSO)

Question 2

A company uses AWS KMS to encrypt objects in an S3 bucket. The security team wants to ensure that only users with the appropriate KMS key permissions can decrypt objects. Which TWO conditions should be included in the S3 bucket policy to enforce this? (Choose TWO.)

Accepted Answer

"Condition": {"StringEquals": {"kms:ViaService": "s3.us-east-1.amazonaws.com"}}. Options A and E are the only distinct conditions that can be used in an S3 bucket policy to enforce that only users with appropriate KMS key permissions can decrypt objects. kms:ViaService restricts the use of the KMS key to requests coming via the S3 service, and kms:EncryptionContext restricts decryption to requests that include the specific S3 bucket ARN. Option C is identical to A and thus does not provide an additional constraint, making it redundant. Options B and D are not valid condition keys for S3 bucket policies.

Answer

"Condition": {"StringEquals": {"kms:KeySpec": "SYMMETRIC_DEFAULT"}}

Answer

"Condition": {"StringEquals": {"kms:ViaService": "s3.us-east-1.amazonaws.com"}}

Answer

"Condition": {"StringEquals": {"kms:GranteePrincipal": "arn:aws:iam::123456789012:role/Admin"}}

Question 3

A large enterprise uses AWS Organizations to manage multiple accounts. The security team has implemented a Service Control Policy (SCP) at the root level that denies all actions unless the request originates from the corporate IP range (10.0.0.0/8). Recently, a developer in a member account tried to launch an EC2 instance from the AWS Management Console while connected via a VPN that provides an IP address within the corporate range. However, the launch failed with an 'AccessDenied' error. The developer is using an IAM user with full EC2 permissions (ec2:*). The SCP is as follows: {"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"*","Resource":"*","Condition":{"NotIpAddress":{"aws:SourceIp":"10.0.0.0/8"}}}]}. What is the MOST likely reason for the failure?

Accepted Answer

The aws:SourceIp condition key does not work correctly for requests made via the AWS Management Console because the console may use a different IP.. The SCP uses the aws:SourceIp condition, but when accessing the Management Console, the IP address seen by AWS is the console's IP, which may not be the same as the developer's VPN IP if the console uses a proxy or if the VPN is configured incorrectly. Option A is wrong because SCPs affect all principals, including the root user. Option B is wrong because the SCP denies actions, not allows them; an explicit deny overrides allows. Option D is wrong because the SCP denies all actions, so even if the developer has permissions, the SCP denies them.

Answer

The SCP allows actions only from the specified IP range, but the developer's IP is not in that range.

Answer

The SCP does not apply to IAM users in member accounts; it only applies to the root user.

Answer

The IAM user does not have the necessary permissions because the SCP explicitly denies all actions.

Question 4

A security engineer is designing IAM policies for a data analytics platform that uses Amazon S3, Amazon Athena, and AWS Glue. The platform must allow data scientists to query data in S3 using Athena, but only from specific VPC subnets. Additionally, the data must be encrypted at rest using AWS KMS. Which TWO actions should the engineer take to meet these requirements? (Choose TWO.)

Accepted Answer

Grant kms:Decrypt permission in the IAM policy and configure the KMS key policy to allow the IAM role to use the key.. A: Correct – Granting kms:Decrypt permission in the IAM policy and ensuring the KMS key policy allows the IAM role enables Athena to decrypt S3 objects encrypted with a customer-managed KMS key. C: Correct – Creating a VPC endpoint for Athena (or S3) and attaching a bucket policy that restricts access to that endpoint ensures queries are only allowed from the specified VPC subnets. B: Incorrect – The s3:SourceIp condition key does not work for requests made via VPC endpoints; use aws:SourceVpce instead. D: Incorrect – The kms:EncryptionContext condition is not used for restricting encryption at rest; it is used for encryption context in KMS operations. E: Incorrect – SSE-S3 does not use KMS, so the KMS key policy would not be relevant.

Answer

Add kms:EncryptionContext condition to the IAM policy to require a specific encryption context.

Answer

Use the s3:SourceIp condition key in the IAM policy to restrict access to the private IP ranges of the VPC subnets.

Answer

Enable default encryption on the S3 bucket using SSE-S3 and configure the KMS key policy to allow the IAM role.

Question 5

A security engineer is troubleshooting an issue where an IAM role used by an EC2 instance cannot access an S3 bucket, even though the role has an attached policy that grants s3:GetObject on the bucket. The bucket policy does not explicitly deny access. What is the most likely cause?

Accepted Answer

The bucket policy does not grant access to the IAM role. The bucket policy does not grant access to the IAM role. For an IAM role used by an EC2 instance to access an S3 bucket, both the IAM policy attached to the role and the bucket policy must allow the action. Even though the IAM policy grants s3:GetObject, the bucket policy must also explicitly grant access to the role principal. Since the bucket policy does not explicitly deny access (option D is false), the lack of an explicit allow in the bucket policy is the most likely cause. Options A and C are incorrect: SCPs would deny at the organization level, and the IAM policy is attached to the role, not the user.

Answer

A service control policy (SCP) is denying access

Answer

The IAM policy is attached to the user instead of the role

Answer

The bucket has an explicit deny in its policy

Question 6

Refer to the exhibit. A security engineer runs the 'simulate-custom-policy' command to test a policy. The output shows 'explicitDeny' for ec2:RunInstances. What is the most likely reason?

Accepted Answer

The policy includes an explicit Deny statement for ec2:RunInstances. The 'simulate-custom-policy' output shows 'explicitDeny', which indicates that the policy contains an explicit Deny statement for the action ec2:RunInstances. An explicitDeny is only returned when a Deny statement matches the action, not when the action is simply missing from an Allow list. Therefore, the most likely reason is that the policy includes an explicit Deny statement.

Answer

The policy does not include ec2:RunInstances in the Action list

Answer

The policy allows ec2:Describe* but the action ec2:RunInstances is not a Describe action

Answer

The policy uses a Resource of '*' which does not include the required resources

Question 7

A security engineer is investigating an IAM role that was used to access AWS resources from an external account. The role has a trust policy that allows the external account to assume it. Which of the following is a required step for the external account to use the role?

Accepted Answer

Attach an IAM policy to an IAM user in the external account that allows sts:AssumeRole for the role ARN.. To assume a role in another AWS account, the external account must have an IAM user or role with permissions to call the sts:AssumeRole API for the target role ARN. Option D correctly describes this requirement. Option A is incorrect because MFA is not a required step unless specified in the role's trust policy. Option B is incorrect because the external account does not need to create a new role; it only needs a principal (user or role) with the appropriate permissions. Option C is incorrect because the trust policy is attached to the role in the target account, not the external account.

Answer

Configure the role to require MFA for the external account.

Answer

Create a new IAM role in the external account with a trust policy allowing the role's ARN.

Answer

Add the external account's root user ARN to the role's trust policy.

Question 8

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all IAM users in member accounts must have a password policy that requires a minimum length of 14 characters. How can this be achieved centrally?

Accepted Answer

Use an SCP that denies the UpdateAccountPasswordPolicy action unless the policy has MinimumPasswordLength >= 14.. A service control policy (SCP) can deny the UpdateAccountPasswordPolicy action if the password policy does not have MinimumPasswordLength >= 14. Option A is incorrect because SCPs cannot set password policies; they only allow or deny actions. Option B is incorrect because IAM permission boundaries do not apply to password policy changes, and IAM is a global service. Option C is incorrect because AWS Config rules can detect non-compliance but cannot enforce the policy; remediation requires additional steps and is not a centralized enforcement method.

Answer

Use a service control policy (SCP) to enforce the password policy across all accounts.

Answer

Use IAM permission boundaries to restrict password policy changes to specific Regions.

Answer

Use AWS Config rules to automatically remediate non-compliant password policies.

Question 9

A developer needs to grant an EC2 instance read-only access to an S3 bucket. Which of the following is the most secure way to provide these permissions?

Accepted Answer

Create an IAM role with read-only access and attach it to the EC2 instance profile.. Using an IAM role attached to an instance profile grants temporary credentials and eliminates long-term access keys. Option A is incorrect because storing credentials in Parameter Store (or any static storage) is less secure than using an instance profile, and IAM roles do not have static credentials to store. Option C is incorrect because a bucket policy cannot grant access based on an instance's public IP in a secure or reliable way, and it would grant access to anyone with that IP, not just the instance. Option D is incorrect because storing IAM user access keys in user data exposes long-term credentials, which is less secure than using an instance profile.

Answer

Use an IAM role and store the credentials in AWS Systems Manager Parameter Store, then retrieve them at instance launch.

Answer

Create a bucket policy that grants read-only access to the instance's public IP address.

Answer

Create an IAM user with read-only access and store the access keys in the instance's user data.

Question 10

A company wants to grant an IAM user the ability to manage (create and update) their own access keys. Which TWO IAM actions must be allowed in the policy?

Accepted Answer

iam:UpdateAccessKey. To allow a user to manage (create and update) their own access keys, the policy must include iam:CreateAccessKey and iam:UpdateAccessKey. These actions enable the user to generate new keys and activate/deactivate them. iam:DeleteAccessKey is not required for this specific scope.

Answer

iam:GetAccessKeyLastUsed

Answer

iam:DeleteAccessKey

Answer

iam:ListAccessKeys

Question 11

A security engineer needs to design an IAM policy that allows an IAM user to launch EC2 instances only if they specify a specific security group ID (sg-12345) and a specific instance type (t2.micro). Which policy achieves this?

Accepted Answer

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:RunInstances",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "ec2:InstanceType": "t2.micro",
          "ec2:SecurityGroup": "sg-12345"
        }
      }
    }
  ]
}. It uses the condition keys 'ec2:InstanceType' and 'ec2:SecurityGroup' to restrict the RunInstances action to only allow launching t2.micro instances into the security group sg-12345. Option A incorrectly specifies the security group as a resource ARN, but security groups cannot be specified as resources in RunInstances; they are specified via condition keys. Option B uses 'aws:RequestTag/security-group' which is not a valid condition key for security groups; security groups are identified by 'ec2:SecurityGroup'. Option C only restricts instance type but does not restrict the security group. Therefore, only D correctly enforces both constraints.

Answer

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:RunInstances",
      "Resource": "arn:aws:ec2:*:*:security-group/sg-12345",
      "Condition": {
        "StringEquals": { "ec2:InstanceType": "t2.micro" }
      }
    }
  ]
}

Answer

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:RunInstances",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "ec2:InstanceType": "t2.micro",
          "aws:RequestTag/security-group": "sg-12345"
        }
      }
    }
  ]
}

Answer

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:RunInstances",
      "Resource": "*",
      "Condition": {
        "StringEquals": { "ec2:InstanceType": "t2.micro" }
      }
    }
  ]
}

Question 12

A company has an S3 bucket with a bucket policy that grants access to a specific IAM role. However, users who assume that role are unable to list objects in the bucket. The bucket policy includes a Principal element set to the role ARN. What is the MOST likely cause?

Accepted Answer

The IAM role does not have a permissions policy that allows s3:ListBucket.. Bucket policies do not grant permissions to IAM role principals unless the role has an IAM policy that allows the S3 action. Option B is false; ACLs are not the issue here; the role lacks an IAM policy. Option C is false; the scenario does not involve MFA, and even if MFA were required, the role’s inability to list objects is due to missing IAM permissions. Option D is false; the role’s trust policy allows AssumeRole, otherwise the users could not assume the role.

Answer

The bucket has an ACL that denies access to the role.

Answer

The bucket policy requires MFA, but the role does not enforce MFA.

Answer

The role's trust policy does not allow sts:AssumeRole.

Question 13

A security engineer is analyzing an IAM policy that is attached to a group. The policy is intended to allow users to manage their own credentials. However, users are reporting that they cannot change their password. The policy is: 
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["iam:ChangePassword", "iam:GetAccountPasswordPolicy"],
      "Resource": "*"
    }
  ]
}
What is the issue?

Accepted Answer

The policy resource is set to "*", but ChangePassword requires the resource to be the specific user ARN.. The ChangePassword action requires the resource ARN to be the specific user's ARN (e.g., arn:aws:iam::account-id:user/${aws:username}). Using a wildcard '*' causes the policy to fail because IAM validates the resource ARN against the user's own ARN. Options A and C are incorrect because the required action is iam:ChangePassword, not UpdateLoginProfile or CreateLoginProfile. Option B is incorrect because the policy attachment to the group is not the issue; the resource restriction is the problem.

Answer

The policy does not include the iam:UpdateLoginProfile action.

Answer

The policy should be attached to the user instead of the group.

Answer

The policy is missing the iam:CreateLoginProfile action.

Question 14

An organization is using IAM roles for EC2 instances. The security team needs to ensure that each EC2 instance can only assume a specific role based on tags. Which feature should be used?

Accepted Answer

Role trust policy with 'aws:ResourceTag' condition. The role trust policy can use the 'aws:ResourceTag' condition key to restrict which EC2 instances can assume the role based on the instance's tags. This ensures that only instances with specific tags (e.g., 'Environment=Production') are allowed to assume the IAM role, meeting the security team's requirement for tag-based role assumption.

Answer

Service Control Policy (SCP)

Answer

IAM policy with 'aws:SourceIp' condition

Answer

IAM permissions boundary

Question 15

Refer to the exhibit. An IAM user has this policy attached. Can the user create a new IAM user in the us-east-1 region?

Accepted Answer

No, because the Deny statement blocks all IAM actions in us-east-1.. The Deny statement blocks all IAM actions in us-east-1, which overrides the Allow for CreateUser. Since the Deny is explicit, it blocks the action even though there is an Allow. The request fails.

Answer

Yes, because the Allow statement explicitly permits CreateUser.

Answer

No, because IAM is a global service and region conditions do not apply.

Answer

Yes, because the Deny only applies to us-east-1.