SCS-C02 Identity and Access Management Practice Test 19 — 15 Questions

Question 1

A company wants to allow its users to assume an IAM role in a different AWS account. What must the company configure to enable cross-account access?

Accepted Answer

In the target account, create an IAM role with a trust policy that allows the source account, and attach a permissions policy to that role. In the source account, allow users to call sts:AssumeRole.. Cross-account access requires creating an IAM role in the target account with a trust policy that specifies the source account as a trusted entity, and attaching a permissions policy that defines what actions the role can perform. The source account must then have a policy that allows its users to call sts:AssumeRole for that role. Option A is incorrect because S3 bucket policies are used for resource-based access, not for role assumption. Option C is incorrect because sharing access keys violates security best practices and does not provide the controlled, temporary access that IAM roles offer. Option D is incorrect because trust policies are attached to roles, not IAM groups.

Answer

In the source account, create an S3 bucket policy that allows access from the target account.

Answer

In the target account, create an IAM user and share the access keys securely with the source account users.

Answer

In the target account, attach a trust policy to an IAM group that allows the source account.

Question 2

A security engineer notices that a developer's IAM user has full administrator access. The engineer wants to implement the principle of least privilege for the developer. What is the best way to proceed?

Accepted Answer

Use IAM Access Advisor to review the developer's historical usage and create a custom policy that only includes the services and actions used.. The best way to implement least privilege is to use IAM Access Advisor to review the developer's historical usage and then create a custom policy that only includes the services and actions actually used. This approach is data-driven and ensures that the developer retains necessary permissions while removing unnecessary ones. It aligns with the principle of least privilege by tailoring permissions to actual needs.

Answer

Create a new IAM group with the AdministratorAccess policy and add the developer to the group.

Answer

Replace the AdministratorAccess policy with a managed job function policy such as PowerUserAccess.

Answer

Remove the administrative access and ask the developer to request permissions as needed.

Question 3

A company uses AWS IAM Identity Center (SSO) for managing access to multiple AWS accounts. A user reports that they can log in to the SSO portal but cannot see any AWS accounts in their dashboard. What is the most likely cause?

Accepted Answer

The user has not been assigned to any AWS accounts in IAM Identity Center.. In IAM Identity Center, users see AWS accounts in their portal only if they have been assigned to those accounts via account assignments (which link a user/group, a permission set, and an AWS account). If no account assignments exist, the user can authenticate successfully but will see an empty dashboard. This is the most common cause of the reported symptom.

Answer

The user's identity source (e.g., Active Directory) is not synchronized correctly.

Answer

The user's session token has expired.

Answer

The permission set assigned to the user does not grant any permissions.

Question 4

A company has an S3 bucket that contains sensitive data. The security team wants to ensure that all access to the bucket is encrypted in transit. What is the most effective way to enforce this?

Accepted Answer

Add a bucket policy that denies access if the request does not use HTTPS (aws:SecureTransport condition).. A bucket policy with the aws:SecureTransport condition denies any request that does not use HTTPS, enforcing encryption in transit. Option A is incorrect because SSE-S3 only encrypts data at rest, not during transmission. Option B is incorrect because CloudTrail logs access but does not enforce encryption. Option D is incorrect because an IAM policy can deny non-HTTPS requests, but enforcing this at the bucket policy level is more direct and applies to all principals accessing the bucket.

Answer

Enable default encryption on the S3 bucket using SSE-S3.

Answer

Enable AWS CloudTrail to log all S3 access and alert on non-HTTPS requests.

Answer

Create an IAM policy that denies S3 actions without the condition aws:SecureTransport.

Question 5

A developer is trying to use the AWS CLI to list objects in an S3 bucket but receives an AccessDenied error. The developer has an IAM user with a policy that allows s3:ListBucket on the bucket. What could be causing the error?

Accepted Answer

The S3 bucket has a bucket policy that denies access to the developer's IAM user.. S3 access decisions are evaluated by combining IAM identity-based policies with bucket policies, and an explicit Deny in either location always wins. Even though the developer's IAM policy grants s3:ListBucket, a bucket policy that explicitly denies the user's principal overrides that Allow. This is the classic 'explicit deny beats allow' rule in AWS's policy evaluation logic.

Answer

The developer has not enabled MFA on their IAM user.

Answer

The S3 bucket does not exist in the same AWS region as the CLI is configured.

Answer

The IAM policy is attached to a group, not directly to the user.

Question 6

A security engineer is designing a system to manage access to an S3 bucket containing confidential data. Which TWO actions should the engineer take to implement least privilege?

Accepted Answer

Use a condition in the IAM policy to restrict access to requests from a specific IP range.. Option A is correct because adding an IAM policy condition such as aws:SourceIp to restrict requests to a specific IP range narrows the circumstances under which the allowed S3 actions can be performed, which is a core least-privilege technique. Option B is correct because granting only the specific actions required (for example s3:GetObject instead of s3:*) limits permissions to exactly what the workload needs, directly implementing least privilege. Option C is wrong because allowing s3:* for all users in the organization grants far broader permissions than necessary and violates least privilege. Option D is wrong because making the bucket public exposes the confidential data and object ACLs alone are not a least-privilege access control mechanism. Option E is wrong because pre-signed URLs are a temporary delegation mechanism, not a substitute for scoping IAM permissions to the minimum required actions and conditions.

Answer

Use a policy that allows s3:* for all users in the organization.

Answer

Make the bucket public and rely on object ACLs to restrict access.

Answer

Use pre-signed URLs for all access to the bucket.

Question 7

A security engineer needs to grant an IAM user in Account A (111111111111) access to an S3 bucket in Account B (222222222222). The bucket policy in Account B allows cross-account access from Account A. Which additional step is required?

Accepted Answer

Attach an IAM policy to the IAM user in Account A granting s3:GetObject on the bucket.. For cross-account access to an S3 bucket, both the bucket policy in Account B and an IAM policy in Account A are required. The bucket policy grants access to the Account A user, but the user also needs an IAM policy in their own account allowing the s3:GetObject action on that bucket. This is because IAM policies in the user's account must permit the action, and the bucket policy must also allow it.

Answer

Create a cross-account role in Account B and have the user assume it.

Answer

Attach the bucket policy to the IAM user in Account A.

Answer

Create an S3 access point in Account B and grant the IAM user access.

Question 8

A company uses AWS Organizations with SCPs. The SCP for the production OU denies all actions on DynamoDB. An IAM policy attached to a user in that OU allows dynamodb:PutItem. What is the effective access?

Accepted Answer

The user cannot perform PutItem because the SCP denies all DynamoDB actions and IAM allows are overridden.. In AWS Organizations, Service Control Policies (SCPs) define the maximum permissions for accounts in an OU. An explicit Deny in an SCP overrides any Allow in IAM policies. Since the SCP denies all DynamoDB actions, the user cannot perform PutItem regardless of the IAM policy allowing it.

Answer

The user can perform PutItem because the IAM policy allows it.

Answer

The user cannot perform PutItem because the SCP applies only to the root account.

Answer

The user can perform PutItem only if the SCP has an explicit allow.

Question 9

A developer needs to run an application on an EC2 instance that accesses an S3 bucket. What is the best practice for granting permissions?

Accepted Answer

Create an IAM role with S3 access and attach it to the EC2 instance profile.. Attaching an IAM role to an EC2 instance profile provides temporary, automatically rotated credentials to the instance, eliminating the need to hardcode or manage long-term access keys. This follows the AWS best practice of using IAM roles for EC2 to grant least-privilege permissions to AWS services like S3. The instance profile acts as a container for the role and allows the EC2 instance to assume it, with credentials delivered via the Instance Metadata Service (IMDS).

Answer

Use an SCP to allow S3 access for the instance.

Answer

Create a bucket policy that grants access to the instance ID.

Answer

Store AWS access keys on the instance and use them in the application.

Question 10

Which IAM feature allows you to grant temporary, limited-privilege credentials for a specific role?

Accepted Answer

AWS STS. AWS STS (Security Token Service) is the service that provides temporary, limited-privilege credentials for IAM roles or federated users. When you assume a role, STS issues temporary security credentials that can be used to access AWS resources. This is the core mechanism for granting temporary access.

Answer

Resource-based policies

Answer

IAM roles

Answer

Service control policies

Question 11

An IAM policy includes: { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/MyRole" }. What does this allow?

Accepted Answer

Allows the user to pass the role MyRole to an AWS service like Lambda.. Iam:PassRole allows a user to pass a role to an AWS service such as Lambda, enabling the service to assume that role. Option A is incorrect because creating a role requires the iam:CreateRole action, not iam:PassRole. Option C is incorrect because assuming a role requires the sts:AssumeRole action. Option D is incorrect because attaching a role to an IAM user is not a valid operation; roles are attached to services, not users.

Answer

Allows the user to create the role MyRole.

Answer

Allows the user to assume the role MyRole.

Answer

Allows the user to attach the role to an IAM user.

Question 12

A company uses an IAM role to allow an EC2 instance to access an S3 bucket. The instance is launched in a VPC with a VPC endpoint for S3. The IAM role has a policy that grants s3:GetObject on the bucket. However, the application on the instance receives 'Access Denied' errors when trying to read objects. What is the MOST likely cause?

Accepted Answer

The VPC endpoint policy for S3 does not allow the required action.. When an EC2 instance accesses S3 through a VPC endpoint (gateway endpoint), both the IAM role policy and the VPC endpoint policy must allow the action. The default endpoint policy allows all, but if a custom policy restricts actions or resources, s3:GetObject can be denied even though the IAM role grants it. This is the most likely cause of the Access Denied error.

Answer

The EC2 instance does not have an encryption key to decrypt the objects.

Answer

The S3 bucket policy does not explicitly allow the IAM role.

Answer

The IAM role is not attached to the EC2 instance profile.

Question 13

A company wants to grant temporary credentials to mobile app users to access their own data in an S3 bucket. Which AWS service should be used to achieve this securely?

Accepted Answer

Amazon Cognito identity pools. Cognito Identity Pools can issue temporary AWS credentials for authenticated users. Option B is wrong because IAM users are not suitable for millions of mobile users. Option C is wrong because KMS is for encryption keys. Option D is wrong because CloudFront is a CDN, not for issuing credentials.

Answer

AWS Key Management Service (KMS)

Answer

IAM users with long-term access keys

Answer

Amazon CloudFront signed URLs

Question 14

An organization has a production AWS account and a development AWS account. Developers need to access the production account from the development account using IAM roles. What is the MOST secure way to set this up?

Accepted Answer

Create an IAM role in the production account with a trust policy allowing the development account to assume it.. It uses cross-account IAM roles, allowing developers in the development account to assume a role in the production account using AWS Security Token Service (STS). This provides temporary, least-privilege credentials without sharing long-term access keys. Option B is insecure because sharing access keys creates long-term credentials that are hard to rotate and manage. Option C is incorrect: a VPN provides network connectivity but does not grant IAM access. Option D is incorrect because IAM users are account-specific; duplicating users across accounts does not enable cross-account access.

Answer

Create IAM users in the production account and share access keys with developers.

Answer

Establish a VPN connection between the accounts and use directory credentials.

Answer

Create the same IAM users in both accounts with identical permissions.

Question 15

A security engineer is designing a permissions boundary for an IAM user. Which TWO statements about permissions boundaries are correct?

Accepted Answer

The effective permissions are the intersection of the identity-based policy and the permissions boundary.. Option C is correct because AWS evaluates a permissions boundary as a filter: the effective permissions for an IAM principal are the intersection of what the identity-based policy allows and what the permissions boundary allows, so an action must be permitted by both to succeed. Option E is correct because a permissions boundary is only a maximum-permissions guardrail; it never grants access by itself, and the principal still needs an identity-based policy (or another applicable policy) that allows the action. Options A and B are wrong because permissions boundaries can be attached to IAM users and IAM roles (including service roles), but not to service-linked roles, which are managed by AWS and do not support permissions boundaries. Option D is wrong because permissions boundaries only limit identity-based permissions and cannot expand or override resource-based policies; resource-based policies are evaluated separately and can grant access independently of the boundary.

Answer

Permissions boundaries can be applied to service-linked roles.

Answer

Permissions boundaries can only be applied to IAM users, not roles.

Answer

Permissions boundaries can override resource-based policies.