SCS-C02 Identity and Access Management Practice Test 2 — 15 Questions

Question 1

A company has an S3 bucket policy that allows cross-account access for a specific IAM role in another account. The bucket policy includes a Principal element with the ARN of the role. However, users in the other account that assume the role are unable to access the bucket. Which of the following is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The IAM role does not have a permissions policy granting s3:GetObject on the bucket.. For cross-account access using an S3 bucket policy, the IAM role in the trusted account must have a permissions policy that grants the necessary S3 actions (e.g., s3:GetObject). Without this policy, even if the bucket policy allows the role, the role itself does not have permission to perform the action. Options B, C, and D are less likely: B is possible but not the most common; C is incorrect because the trust policy allows users to assume the role, not the S3 service; D is incorrect because role ARNs are valid principals in S3 bucket policies.

Answer

The bucket policy has an explicit Deny statement that overrides the Allow.

Answer

The role's trust policy does not allow the S3 service to assume the role.

Answer

The bucket policy uses the role ARN in the Principal element instead of the AWS account ID.

Question 2

Drag and drop the steps to implement AWS KMS key rotation in the correct order.

Accepted Answer

Create a CMK, then enable automatic key rotation, then perform manual key rotation (if needed), then update applications to use the new key, then verify decryption.. Key rotation starts with creating a CMK, enabling auto-rotation, manual rotation if needed, updating apps, and verifying decryption.

Answer

Create a CMK, then perform manual key rotation, then enable automatic key rotation, then update applications to use the new key, then verify decryption.

Answer

Enable automatic key rotation, then create a CMK, then perform manual key rotation, then update applications, then verify decryption.

Answer

Create a CMK, then enable automatic key rotation, then update applications to use the new key, then perform manual key rotation, then verify decryption.

Question 3

Drag and drop the steps to configure AWS CloudTrail for logging across all regions and accounts in the correct order.

Accepted Answer

Create an S3 bucket, then create a CloudTrail trail, then configure the trail to apply to all regions, then enable log file integrity validation, then create an organization trail.. CloudTrail setup requires S3 bucket, trail creation, multi-region selection, integrity validation, and organization trail.

Answer

Create a CloudTrail trail, then create an S3 bucket, then configure the trail to apply to all regions, then enable log file integrity validation, then create an organization trail.

Answer

Create an S3 bucket, then create a CloudTrail trail, then enable log file integrity validation, then configure the trail to apply to all regions, then create an organization trail.

Answer

Create an S3 bucket, then create an organization trail, then create a CloudTrail trail, then configure the trail to apply to all regions, then enable log file integrity validation.

Question 4

A security engineer must ensure that cross-account access to an S3 bucket is restricted to only accounts that are part of a specific AWS organization. Which IAM policy condition key should be used in the bucket policy?

Accepted Answer

aws:PrincipalOrgID. The `aws:PrincipalOrgID` condition key allows you to restrict access to only principals (accounts) that belong to a specific AWS organization. By specifying the organization ID in the bucket policy, you ensure that only accounts within that organization can access the S3 bucket, regardless of whether they are from the same account or cross-account. This key is evaluated against the organization ID of the principal's account, making it ideal for cross-account access control based on organizational membership.

Answer

aws:SourceIp

Answer

aws:MultiFactorAuthPresent

Answer

aws:SourceVpce

Question 5

A security engineer notices that an IAM user has permissions that are not explicitly granted through any policy. The engineer suspects that the user might have inherited permissions from a group or role. Which IAM feature should the engineer use to identify the source of these permissions?

Accepted Answer

IAM Policy Simulator. IAM Policy Simulator allows you to simulate actions and view the effective permissions for a user, including permissions inherited from groups or roles. It can identify which policy (direct or inherited) grants a specific permission. IAM Access Analyzer, on the other hand, is designed to analyze resource-based policies for unintended access, not to trace the source of user permissions. Therefore, the engineer should use IAM Policy Simulator.

Answer

IAM Roles Anywhere

Answer

CloudTrail Insights

Answer

IAM Access Analyzer

Question 6

A company has multiple AWS accounts and wants to centrally manage access using IAM Identity Center (AWS SSO). Which feature allows the company to define permissions once and reuse them across multiple accounts?

Accepted Answer

Permission sets. Permission sets in IAM Identity Center define a collection of administrator-defined policies that grant specific permissions to users or groups. Once created, a permission set can be assigned to any number of AWS accounts within the organization, enabling centralized permission management and reuse across multiple accounts without duplicating policy definitions.

Answer

Application assignments

Answer

Identity providers

Answer

Account assignments

Question 7

A developer needs to access AWS resources from a mobile app. Which AWS service allows the app to obtain temporary credentials for authenticated users?

Accepted Answer

Amazon Cognito identity pools (federated identities). Amazon Cognito identity pools (federated identities) enable mobile apps to obtain temporary AWS credentials for authenticated users. User pools handle sign-in and user directories but do not directly provide AWS credentials. IAM Identity Center is for enterprise SSO, not mobile app credentials. KMS is for key management, not credential issuance.

Answer

Amazon Cognito user pools

Answer

AWS IAM Identity Center (AWS SSO)

Answer

AWS Key Management Service (AWS KMS)

Question 8

A security engineer notices that an IAM role for an EC2 instance has a policy that allows s3:PutObject on a bucket. However, the application reports access denied when trying to upload. The bucket policy does not explicitly deny access. What is a likely cause?

Accepted Answer

The policy condition key does not match the request context. The likely cause is that the policy condition key does not match the request context (Option D). Even though the role allows s3:PutObject, if the policy includes conditions (e.g., source IP, VPC, encryption) that are not met by the request, the effective permission becomes an implicit deny. Since the bucket policy does not explicitly deny, the problem lies in the role policy's conditions. Option A is incorrect because the stem explicitly states the bucket policy does not explicitly deny. Option B is incorrect because if the instance profile were not attached, the role would not be available; but the role is attached as stated. Option C is incorrect because the role policy does include s3:PutObject.

Answer

The bucket policy denies access

Answer

The instance profile is not attached to the EC2 instance

Answer

The role's policy does not include s3:PutObject

Question 9

A company uses IAM roles for cross-account access. Developers in Account A need to assume a role in Account B. What must be true for the AssumeRole call to succeed?

Accepted Answer

The role's trust policy must allow Account A and the user must have sts:AssumeRole permission. For a user in Account A to assume a role in Account B, the role's trust policy must grant access to Account A (as a principal), and the user must have the sts:AssumeRole permission. Option A is wrong because an SCP in Account A could deny sts:AssumeRole, but it is not required to allow it. Option B is wrong because MFA is not a requirement for cross-account role assumption. Option D is wrong because a permissions boundary is not required; it can limit permissions but does not enable the assumption.

Answer

Account A must have an SCP that allows sts:AssumeRole

Answer

The user in Account A must have MFA enabled

Answer

The role in Account B must have a permissions boundary

Question 10

Which TWO of the following are valid use cases for IAM permissions boundaries? (Choose TWO.)

Accepted Answer

To prevent an IAM user from escalating privileges. IAM permissions boundaries are a feature that allows you to set the maximum permissions that an identity-based policy can grant to an IAM entity. By attaching a permissions boundary to a user or role, you can prevent that entity from creating or modifying IAM resources (such as roles or policies) to escalate their privileges, even if their attached policies would otherwise allow it. This acts as a guardrail to enforce a hard limit on what actions the entity can perform, directly addressing privilege escalation risks.

Answer

To allow cross-account access to an S3 bucket

Answer

To delegate permission management to non-administrators

Answer

To restrict access to an S3 bucket based on IP address

Question 11

A security engineer reviews the trust policy of an IAM role. Which accounts can assume this role?

Accepted Answer

Account 111111111111. The trust policy of the IAM role specifies a principal of "111111111111" as the trusted entity. This means only accounts explicitly listed in the Principal element can assume the role. Since the policy does not include account 123456789012 or allow any AWS account, only account 111111111111 is authorized to assume the role.

Answer

Only the root user of account 123456789012

Answer

Account 123456789012

Answer

Any AWS account

Question 12

A developer creates this CloudFormation stack. An EC2 instance with this role tries to list objects in the bucket. What will happen?

Accepted Answer

The instance can list objects in the bucket. The bucket policy grants `s3:ListBucket` action, which allows listing the objects in the bucket (i.e., the `ListObjects` API). The EC2 instance with that role can therefore list objects in the bucket. However, to upload objects, `s3:PutObject` would be required, which is not granted. Thus, option D is correct.

Answer

The instance can list the bucket but not the objects

Answer

The instance cannot assume the role because the principal is ec2.amazonaws.com

Answer

The instance can upload objects to the bucket

Question 13

A company wants to allow its employees to authenticate to the AWS Management Console using their existing corporate credentials. Which AWS service should be used to integrate with the company's identity provider?

Accepted Answer

AWS IAM Identity Center (AWS SSO). AWS IAM Identity Center (formerly AWS SSO) is the correct service because it is specifically designed to enable single sign-on (SSO) from an external identity provider (IdP) to AWS accounts and business applications. It supports federation via SAML 2.0 or OIDC, allowing employees to authenticate using their existing corporate credentials and then access the AWS Management Console without needing separate IAM users.

Answer

AWS Secrets Manager

Answer

AWS Directory Service for Microsoft Active Directory

Answer

AWS Certificate Manager

Question 14

A company wants to allow an IAM user to list objects in an S3 bucket named 'my-bucket'. Which IAM policy statement grants the minimum required permissions?

Accepted Answer

{"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::my-bucket"}. The s3:ListBucket action is the specific permission required to list objects in an S3 bucket, and the resource ARN must be the bucket itself (arn:aws:s3:::my-bucket) without a trailing /*. This grants the minimum necessary permission to perform the ListObjects (or ListObjectsV2) API call, which returns the object keys in the bucket.

Answer

{"Effect":"Allow","Action":"s3:PutObject","Resource":"arn:aws:s3:::my-bucket/*"}

Answer

{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::my-bucket/*"}

Answer

{"Effect":"Allow","Action":"s3:*","Resource":"arn:aws:s3:::my-bucket"}

Question 15

A developer needs to allow a Lambda function to write logs to CloudWatch Logs. What is the MINIMUM IAM policy that should be attached to the Lambda execution role?

Accepted Answer

{"Effect":"Allow","Action":["logs:CreateLogGroup","logs:CreateLogStream","logs:PutLogEvents"],"Resource":"*"}. It grants the minimum required actions: logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents, which are all necessary for a Lambda function to write logs to CloudWatch Logs. Option B is wrong because it only grants logs:PutLogEvents but lacks logs:CreateLogGroup and logs:CreateLogStream, which are required if the log group and log stream do not already exist. Option C is wrong because it grants all logs actions (logs:*), which is overly permissive and not the minimum required. Option D is wrong because it grants only describe actions, which do not allow the writing of log events.

Answer

{"Effect":"Allow","Action":"logs:PutLogEvents","Resource":"arn:aws:logs:us-east-1:123456789012:log-group:my-log-group:*"}

Answer

{"Effect":"Allow","Action":"logs:*","Resource":"*"}

Answer

{"Effect":"Allow","Action":["logs:DescribeLogGroups","logs:DescribeLogStreams"],"Resource":"*"}