SCS-C02 Identity and Access Management Practice Test 2 — 15 Questions

Question 1

An IAM user needs to rotate their own access keys. Which IAM policy action should be allowed?

Accepted Answer

iam:UpdateAccessKey. IAM:UpdateAccessKey is used to rotate access keys (e.g., changing the status from Active to Inactive). Option A is incorrect because IAM:DeleteAccessKey removes a key entirely, not part of rotation. Option C is incorrect because IAM:CreateAccessKey creates a new key but does not handle the deactivation step. Option D is incorrect because IAM:ChangePassword is for password changes, not access keys.

Answer

iam:DeleteAccessKey

Answer

iam:CreateAccessKey

Answer

iam:ChangePassword

Question 2

A security engineer notices that an IAM role for an EC2 instance has a policy that allows s3:PutObject on a bucket. However, the application reports access denied when trying to upload. The bucket policy does not explicitly deny access. What is a likely cause?

Accepted Answer

The policy condition key does not match the request context. The most likely cause is that the policy condition key does not match the request context, such as a condition requiring a specific VPC endpoint, source IP, or MFA that the request does not satisfy. Even though the role allows s3:PutObject, the condition in the policy (or bucket policy) may evaluate to false, resulting in access denied. This is a common issue when conditions like aws:SourceVpce or aws:PrincipalArn are misconfigured.

Answer

The bucket policy denies access

Answer

The instance profile is not attached to the EC2 instance

Answer

The role's policy does not include s3:PutObject

Question 3

A security engineer needs to ensure that an IAM role can be assumed only from a specific VPC. Which IAM policy condition key should be used?

Accepted Answer

aws:SourceVpc. The aws:SourceVpc condition key restricts access based on the VPC endpoint (via VPC endpoint ID) from which the request originates. It is used in IAM policies to allow actions only when the request comes through a specified VPC endpoint, which is the correct way to ensure an IAM role can be assumed only from a specific VPC. This key works with VPC endpoint policies and IAM trust policies.

Answer

aws:RequestedRegion

Answer

aws:VpcSourceIp

Answer

aws:SourceIp

Question 4

Which TWO of the following are valid IAM policy condition keys? (Choose TWO.)

Accepted Answer

aws:RequestedRegion. Option A, aws:RequestedRegion, is a valid global IAM condition key that lets you restrict access based on the AWS Region the request is sent to, commonly used to enforce regional data-residency or deny calls outside approved Regions. Option C, aws:SourceIp, is a valid condition key that compares the requester's IP address against a specified CIDR range, typically used to restrict API calls to corporate network ranges. The other options are not real IAM condition keys: aws:RequestedService, aws:PrincipalService, and aws:SourceArn do not exist in the IAM condition key namespace (the closest real keys are aws:PrincipalArn and aws:SourceArn is actually valid only in some service-specific contexts like SNS/SQS policies, but it is not a global IAM condition key as presented here).

Answer

aws:RequestedService

Answer

aws:PrincipalService

Answer

aws:SourceArn

Question 5

A security engineer attaches this policy to an IAM user. The user tries to download an object from the bucket from an IP address 10.1.0.5. What will happen?

Accepted Answer

The user will be denied access because the condition does not match. The policy's condition likely restricts access to a specific IP range (e.g., 10.0.0.0/8 or a specific CIDR) that does not include 10.1.0.5, so the condition evaluates to false and the Allow statement does not apply. With no matching Allow and default implicit deny, the request is denied. The correct answer is that the user is denied because the condition does not match.

Answer

The user will be allowed access because the policy allows s3:GetObject

Answer

The policy is invalid and will cause an error

Answer

The user will be denied access because there is an explicit deny

Question 6

A developer creates this CloudFormation stack. An EC2 instance with this role tries to list objects in the bucket. What will happen?

Accepted Answer

The instance can list objects in the bucket. The bucket policy grants `s3:ListBucket` action, which allows listing the objects in the bucket (i.e., the `ListObjects` API). The EC2 instance with that role can therefore list objects in the bucket. However, to upload objects, `s3:PutObject` would be required, which is not granted. Thus, option D is correct.

Answer

The instance can list the bucket but not the objects

Answer

The instance cannot assume the role because the principal is ec2.amazonaws.com

Answer

The instance can upload objects to the bucket

Question 7

A company uses an IAM role to allow an EC2 instance to access an S3 bucket. The security team wants to ensure that if the EC2 instance is compromised, the attacker cannot use the role credentials to access resources outside the account. What should the security team do?

Accepted Answer

Attach a permissions boundary to the IAM role that limits access to only the required S3 bucket.. Using a permissions boundary restricts the maximum permissions the role can have, limiting the impact of a compromised instance.

Answer

Store the role credentials in AWS Secrets Manager and rotate them frequently.

Answer

Use an instance profile with a short-lived session token.

Answer

Use an SCP to deny all actions except S3 access for the role.

Question 8

A security engineer notices that an IAM user has been using an access key that was not rotated for over 90 days. What is the BEST action to take?

Accepted Answer

Disable the user's access key and create a new one.. The best action is to disable the stale access key and create a new one, immediately removing the risk posed by a long-lived credential while restoring the user's access. AWS best practice and CIS benchmarks recommend rotating access keys every 90 days or less, so a key exceeding that threshold should be remediated promptly. Disabling first (rather than deleting) preserves auditability and allows rollback if needed.

Answer

Do nothing; 90 days is acceptable.

Answer

Delete the IAM user and create a new one.

Answer

Notify the user and ask them to rotate the key.

Question 9

A security engineer needs to enforce that all IAM users in an AWS account use multi-factor authentication (MFA) when making API calls. What is the MOST effective way to enforce this?

Accepted Answer

Use an AWS Organizations service control policy (SCP) that denies all actions unless MFA is present.. An AWS Organizations service control policy (SCP) is the most effective way to enforce MFA for all IAM users in an account because SCPs apply at the organization level and affect all IAM principals (including the root user) in member accounts. The SCP condition `aws:MultiFactorAuthPresent` ensures that any API call without MFA is denied, regardless of the permissions granted by identity-based policies. This provides a centralized, scalable enforcement mechanism that cannot be bypassed by account-level administrators. In contrast, an IAM policy only applies to specific principals and can be modified or removed by users with sufficient permissions, making it less robust for organization-wide enforcement.

Answer

Enable MFA for the root user.

Answer

Enable CloudTrail to log MFA usage.

Answer

Attach an IAM policy that denies all actions unless MFA is present.

Question 10

A company uses an IAM role to allow an EC2 instance to access an S3 bucket. The role has an attached policy that grants s3:GetObject on the bucket. However, the application on the EC2 instance is unable to read objects. What is the MOST likely cause?

Accepted Answer

The EC2 instance does not have an IAM instance profile configured.. For an EC2 instance to assume an IAM role, the role must be attached via an instance profile, which is the container that links the role to the instance. If the instance has no instance profile configured, the SDK/CLI on the instance cannot retrieve temporary credentials from the Instance Metadata Service (IMDS), so the s3:GetObject call fails with an access-denied or credential error.

Answer

The S3 bucket policy denies access to the IAM role.

Answer

The policy is attached to the EC2 instance instead of the role.

Answer

The EC2 instance is not running the latest user data script.

Question 11

A company needs to grant cross-account access to an S3 bucket. Which IAM feature should be used?

Accepted Answer

Use an S3 bucket policy that grants access to the external account's IAM users.. A bucket policy can grant access to principals in another account. Option A is wrong because IAM users are within the same account. Option C is wrong because SCPs apply within an organization. Option D is wrong because a role can be used but requires the external account to assume the role, not directly access the bucket.

Answer

Create an IAM user in the source account and share the credentials.

Answer

Use a service control policy (SCP) to allow cross-account access.

Answer

Use an IAM role in the source account that the external account can assume.

Question 12

A company wants to automate the rotation of IAM user access keys every 90 days. Which AWS service can be used to enforce this?

Accepted Answer

AWS Config with a custom rule that checks key age and triggers a Lambda function to rotate keys.. AWS Config with a custom rule is the correct answer because AWS Config continuously evaluates resource configurations against desired rules and can trigger remediation actions via Lambda. A custom Config rule can check IAM access key age (using the GetAccessKeyLastUsed and ListAccessKeys APIs) and invoke a Lambda function to rotate keys when they exceed 90 days. This provides both detection and automated remediation, which is the enforcement mechanism the question requires.

Answer

AWS Organizations SCP to deny access if keys are older than 90 days.

Answer

AWS CloudTrail to monitor key usage and send notifications.

Answer

AWS Lambda on a schedule to rotate keys.

Question 13

Which THREE are best practices for managing IAM roles?

Accepted Answer

Use IAM roles instead of IAM users for applications running on EC2.. Option B is correct because EC2 applications should assume an IAM role via the instance metadata service (IMDS) to obtain temporary credentials, eliminating the need to embed long-lived access keys on instances. Option C is correct because IAM roles rely on STS-issued temporary credentials that expire automatically, so rotating them is inherent and avoids manual key rotation. Option D is correct because SCPs in AWS Organizations set permission guardrails at the OU/account level, restricting the maximum permissions available to roles across accounts. Option A is wrong because a trust policy allowing any AWS account to assume the role creates a confused-deputy risk; the Principal should be scoped to specific trusted accounts or identities. Option E is wrong because granting broad permissions violates least privilege and increases blast radius; roles should be scoped narrowly and updated as needed.

Answer

Set the trust policy to allow any AWS account to assume the role.

Answer

Grant broad permissions to roles to avoid frequent updates.

Question 14

A security engineer is designing a permissions boundary for an IAM role used by an EC2 instance. The boundary must allow the instance to list all S3 buckets but deny the ability to delete any bucket. Which policy should be used as the permissions boundary?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:ListAllMyBuckets","Resource":"*"},{"Effect":"Deny","Action":"s3:DeleteBucket","Resource":"*"}]}. A permissions boundary is an IAM managed policy that sets the maximum permissions an identity can have, so it must both allow the intended action and explicitly deny the forbidden one. Option A allows s3:ListAllMyBuckets and denies s3:DeleteBucket, which is exactly the required ceiling. The effective permissions are the intersection of the boundary and the identity policy, so the deny in the boundary guarantees DeleteBucket can never be granted.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"s3:ListAllMyBuckets","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:ListAllMyBuckets","s3:DeleteBucket"],"Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:ListAllMyBuckets","Resource":"*"},{"Effect":"Allow","Action":"s3:DeleteBucket","Resource":"*"}]}

Question 15

An IAM policy attached to a user allows s3:GetObject on bucket 'my-bucket'. The user also has a service control policy (SCP) in the organization that denies s3:GetObject on all resources. The user attempts to download an object from 'my-bucket'. What is the outcome?

Accepted Answer

The request fails because the SCP explicitly denies the action.. The request fails because AWS Organizations Service Control Policies (SCPs) act as a boundary for all accounts within the organization. An explicit deny in an SCP overrides any allow from an IAM policy, including those attached to the user. Since the SCP denies s3:GetObject on all resources, the user's IAM policy allowing the same action is effectively blocked, resulting in a failed request.

Answer

The request succeeds because the IAM policy allows it.

Answer

The request fails because the SCP effect is 'Allow' and the IAM policy is 'Deny'.

Answer

The request succeeds because the user is in the management account.