SCS-C02 Identity and Access Management Practice Test 18 — 15 Questions

Question 1

A security engineer is troubleshooting an IAM policy that is not working as expected. The policy allows ec2:StartInstances and ec2:StopInstances but the user gets an access denied error when trying to stop an instance. What is the most likely cause?

Accepted Answer

The user does not have permission to call ec2:DescribeInstances.. Option D is correct because if the user does not have ec2:DescribeInstances, the AWS Management Console may show an error. Option A is wrong because the policy allows stop. Option B is wrong because if there were an explicit deny, it would be separate. Option C is wrong because SCPs are at the OU level, not account.

Answer

A service control policy is denying the action.

Answer

The policy does not allow stopping instances in all regions.

Answer

There is an explicit deny statement in the policy.

Question 2

A company wants to grant cross-account access to an S3 bucket. The bucket policy allows access from account 111111111111. An IAM user in account 111111111111 has a policy allowing s3:GetObject on that bucket. However, the user gets AccessDenied. What is the most likely reason?

Accepted Answer

The bucket policy grants access to the account, but the IAM user's ARN is not explicitly listed.. Option A is correct because the S3 bucket policy must explicitly grant access to the IAM user ARN, not just the account. Option B is wrong because explicit deny in the IAM policy would be unusual. Option C is wrong because S3 does not require VPC endpoints. Option D is wrong because the user is in the same account as the policy.

Answer

The S3 bucket is in a different region and requires a VPC endpoint.

Answer

The IAM user policy is attached to a group, not directly to the user.

Answer

The IAM user policy has an explicit deny for s3:GetObject.

Question 3

Which IAM feature allows you to grant temporary, limited-privilege credentials for a specific role?

Accepted Answer

AWS STS. Option A is correct because STS is used for temporary credentials. Option B is wrong because IAM roles are the entity, not the feature. Option C is wrong because SCPs are for Organizations. Option D is wrong because resource-based policies are for granting to other accounts.

Answer

Resource-based policies

Answer

IAM roles

Answer

Service control policies

Question 4

An IAM policy includes: { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/MyRole" }. What does this allow?

Accepted Answer

Allows the user to pass the role MyRole to an AWS service like Lambda.. Option C is correct because PassRole allows passing a role to an AWS service. Option A is wrong because it's not about assuming. Option B is wrong because it's not about creating. Option D is wrong because it's not about attaching to users.

Answer

Allows the user to create the role MyRole.

Answer

Allows the user to assume the role MyRole.

Answer

Allows the user to attach the role to an IAM user.

Question 5

A company wants to enforce that all IAM users use multi-factor authentication (MFA) to access the AWS Management Console. What is the best way to achieve this?

Accepted Answer

Attach an IAM policy to all users that denies console access without MFA.. Option D is correct because an IAM policy with a condition requiring MFA for console access is the standard approach. Option A is wrong because MFA is not enforced by default. Option B is wrong because password policy does not enforce MFA. Option C is wrong because SCPs are not typically used for user-level MFA enforcement.

Answer

Enable MFA in the account settings.

Answer

Set a password policy that requires MFA.

Answer

Use an SCP to deny access if MFA is not present.

Question 6

A company uses an IAM role to allow an EC2 instance to access an S3 bucket. The instance is launched in a VPC with a VPC endpoint for S3. The IAM role has a policy that grants s3:GetObject on the bucket. However, the application on the instance receives 'Access Denied' errors when trying to read objects. What is the MOST likely cause?

Accepted Answer

The VPC endpoint policy for S3 does not allow the required action.. Option B is correct because a VPC endpoint policy can restrict access to specific buckets, and if it does not allow the target bucket, requests will be denied even if the IAM role allows it. Option A is wrong because the S3 bucket policy is not required to allow the role if the role already grants access. Option C is wrong because the IAM role is correctly associated with the instance. Option D is wrong because S3 does not require encryption for access.

Answer

The EC2 instance does not have an encryption key to decrypt the objects.

Answer

The S3 bucket policy does not explicitly allow the IAM role.

Answer

The IAM role is not attached to the EC2 instance profile.

Question 7

A security engineer is troubleshooting an issue where an IAM user cannot assume a role in another AWS account. The trust policy of the role allows the user's account to assume the role, and the user has a policy that allows sts:AssumeRole. The user receives an error: 'Access denied: User is not authorized to perform sts:AssumeRole.' What is the MOST likely cause?

Accepted Answer

The user's policy does not specify the resource ARN of the role.. Option C is correct because if the user's IAM policy does not explicitly allow the specific role ARN, sts:AssumeRole will fail. Option A is wrong because external ID is optional unless required by the trust policy. Option B is wrong because MFA is not required unless the policy specifies it. Option D is wrong because the trust policy already allows the account.

Answer

The role requires an external ID that the user did not provide.

Answer

The user must use multi-factor authentication (MFA).

Answer

The trust policy does not include the user's IAM user ARN.

Question 8

A company wants to grant temporary credentials to mobile app users to access their own data in an S3 bucket. Which AWS service should be used to achieve this securely?

Accepted Answer

Amazon Cognito identity pools. Option A is correct because Cognito Identity Pools can issue temporary AWS credentials for authenticated users. Option B is wrong because IAM users are not suitable for millions of mobile users. Option C is wrong because KMS is for encryption keys. Option D is wrong because CloudFront is a CDN, not for issuing credentials.

Answer

AWS Key Management Service (KMS)

Answer

IAM users with long-term access keys

Answer

Amazon CloudFront signed URLs

Question 9

An organization has a production AWS account and a development AWS account. Developers need to access the production account from the development account using IAM roles. What is the MOST secure way to set this up?

Accepted Answer

Create an IAM role in the production account with a trust policy allowing the development account to assume it.. Option B is correct because cross-account roles allow granting least privilege access without sharing long-term credentials. Option A is wrong because sharing access keys is insecure. Option C is wrong because placing users in both accounts is not a cross-account solution. Option D is wrong because VPN does not provide IAM access.

Answer

Create IAM users in the production account and share access keys with developers.

Answer

Establish a VPN connection between the accounts and use directory credentials.

Answer

Create the same IAM users in both accounts with identical permissions.

Question 10

A security engineer is designing a permissions boundary for an IAM user. Which TWO statements about permissions boundaries are correct?

Accepted Answer

The effective permissions are the intersection of the identity-based policy and the permissions boundary.. Options A and C are correct. A: A permissions boundary limits the maximum permissions for the user, but the user must also have an identity-based policy granting the actions. C: The effective permissions are the intersection of the boundary and the identity-based policy. Option B is wrong because resource-based policies are not affected by boundaries. Option D is wrong because boundaries do not affect service-linked roles. Option E is wrong because boundaries can be used with roles as well.

Answer

Permissions boundaries can be applied to service-linked roles.

Answer

Permissions boundaries can only be applied to IAM users, not roles.

Answer

Permissions boundaries can override resource-based policies.

Question 11

A company wants to enforce that all IAM users use MFA. Which THREE actions should be taken to achieve this?

Accepted Answer

Enable MFA devices for all IAM users.. Option B is correct because enabling MFA devices for all IAM users is a prerequisite for enforcing MFA usage. Without an assigned MFA device, a user cannot authenticate via MFA, and any policy requiring MFA would lock them out. This action ensures each user has a physical or virtual MFA device associated with their IAM user account.

Answer

Set an IAM password policy requiring MFA.

Answer

Use AWS Single Sign-On (SSO) with MFA.

Question 12

A security engineer needs to restrict access to an S3 bucket so that only requests from a specific VPC are allowed. Which TWO steps are required?

Accepted Answer

Add a bucket policy that denies access unless the request source VPC endpoint matches the created endpoint.. Options B and D are correct. B: Create a VPC endpoint for S3 and attach it to the VPC. D: Add a bucket policy that denies access unless the request comes from the VPC endpoint. Option A is wrong because a bucket policy can reference the VPC endpoint. Option C is wrong because a VPC endpoint policy is not required; the bucket policy can enforce the condition. Option E is wrong because bucket policies do not have condition keys for VPC ID directly.

Answer

Add a bucket policy with aws:SourceVpc condition.

Answer

Attach a VPC endpoint policy that allows the required actions.

Answer

Create a bucket policy that allows access from the VPC ID.

Question 13

A company has an S3 bucket with a bucket policy that allows access to a specific IAM role. However, users assume the role but still get access denied. Which THREE factors could cause this?

Accepted Answer

A service control policy (SCP) denies the required actions.. Options B, C, and D are correct. B: The bucket policy must explicitly allow the role, and if it refers to a user instead, it will fail. C: If the role's trust policy does not allow the user's account, the role cannot be assumed. D: A service control policy (SCP) can block access even if IAM allows. Option A is wrong because the bucket policy does not need the role's trust policy. Option E is wrong because bucket policies do not have condition key for role session name.

Answer

The bucket policy does not reference the role's trust policy.

Answer

The bucket policy has a condition on aws:RoleSessionName that does not match.

Question 14

Refer to the exhibit. An IAM policy is attached to a group. A user in the group accesses the S3 bucket from an IP address 203.0.113.5 using HTTPS. What will be the result?

Accepted Answer

The user will be denied access because the source IP is not in the allowed ranges.. Option D is correct. The policy allows only from 192.0.2.0/24 and 198.51.100.0/24. The user's IP 203.0.113.5 does not match, so access is denied even though HTTPS is used. Option A is wrong because the IP is not within allowed ranges. Option B is wrong because the condition is AND; all conditions must be met. Option C is wrong because the action is explicitly allowed only under conditions.

Answer

The user can access objects because an Allow with conditions grants access by default.

Answer

The user will be denied access because the policy does not allow the action explicitly.

Answer

The user can access objects because the condition for SecureTransport is met.

Question 15

A company uses AWS Organizations with multiple accounts. The security team has created an SCP that denies access to all DynamoDB actions except for the 'prod' account. The SCP is attached to the root OU. The 'prod' account has an IAM role that allows full DynamoDB access. A developer in the 'prod' account tries to create a DynamoDB table but receives an 'AccessDenied' error. The developer has the correct IAM permissions. What is the MOST likely cause and what should be done to resolve the issue?

Accepted Answer

The SCP denies DynamoDB by default; the 'prod' account needs an explicit allow in the SCP.. Option A is correct. The SCP denies DynamoDB actions to all accounts except 'prod', but the SCP may not have an explicit allow for 'prod', causing implicit deny. The SCP should explicitly allow DynamoDB actions for 'prod'. Option B is wrong because SCPs do not require resource-based policies. Option C is wrong because SCPs are not overridden by IAM; they are boundaries. Option D is wrong because SCPs are not optional.

Answer

The DynamoDB table has a resource-based policy that denies access.

Answer

The SCP is attached to the OU and cannot be overridden; the developer must use a different account.

Answer

The IAM role's permissions boundary is blocking access.