SCS-C02 Identity and Access Management Practice Test 2 — 15 Questions

Question 1

Match each AWS KMS key type to its description.

Accepted Answer

Customer managed key: You create, manage, and control the key lifecycle, including rotation, deletion, and policies.. Customer managed keys give you full control over the key lifecycle and policies. AWS managed keys are created and managed by AWS but allow you to view and audit usage. AWS owned keys are fully managed by AWS and used across many accounts. Custom key store keys are stored in a CloudHSM cluster under your control. Distractors swap the definitions of customer and AWS managed keys.

Answer

Customer managed key: AWS creates and manages the key, but you can view it and audit its usage.

Answer

AWS managed key: You create, manage, and control the key lifecycle.

Question 2

Match each AWS CloudHSM feature to its description.

Accepted Answer

Dedicated HSM: Each customer gets exclusive access to a hardware security module.. CloudHSM provides dedicated hardware security modules that are FIPS 140-2 Level 3 validated and support automatic key replication across clusters. Common confusions include mistaking single-tenant as multi-tenant or assuming a software emulator is used.

Answer

Multi-tenant: Multiple customers share the same HSM.

Answer

HSM client: CloudHSM provides a software-based HSM emulator.

Question 3

A company wants to allow an IAM user to manage only their own access keys. Which IAM policy should be attached to the user?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"iam:*AccessKey*","Resource":"arn:aws:iam::*:user/${aws:username}"}]}. The IAM policy uses the ${aws:username} variable in the Resource element. When this policy is attached to a user, ${aws:username} resolves to that user's username, thereby restricting the actions to only that user's own access keys. Option A allows access to all users' keys. Option B denies all AccessKey actions. Option D allows all AccessKey actions without restriction.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"iam:*AccessKey*","Resource":"arn:aws:iam::*:user/*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"iam:*AccessKey*","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"iam:*AccessKey*","Resource":"*"}]}

Question 4

A security engineer must ensure that cross-account access to an S3 bucket is restricted to only accounts that are part of a specific AWS organization. Which IAM policy condition key should be used in the bucket policy?

Accepted Answer

aws:PrincipalOrgID. The `aws:PrincipalOrgID` condition key allows you to restrict access to only principals (accounts) that belong to a specific AWS organization. By specifying the organization ID in the bucket policy, you ensure that only accounts within that organization can access the S3 bucket, regardless of whether they are from the same account or cross-account. This key is evaluated against the organization ID of the principal's account, making it ideal for cross-account access control based on organizational membership.

Answer

aws:SourceIp

Answer

aws:MultiFactorAuthPresent

Answer

aws:SourceVpce

Question 5

An IAM user reports that they are unable to launch an EC2 instance in us-east-1. The IAM policy attached to the user allows ec2:RunInstances but with a condition that the instance type must be t2.micro. What could be the reason for the failure?

Accepted Answer

The user is trying to launch an instance type other than t2.micro.. The condition likely specifies 'ec2:InstanceType' equals 't2.micro', so if the user tries to launch any other type, the action is denied. Option B is irrelevant because the policy allows the action. Option C is not a common condition. Option D is unrelated.

Answer

The user has not attached a security group to the instance.

Answer

The IAM policy does not include ec2:RunInstances for us-east-1.

Answer

The user's account has reached the EC2 instance limit.

Question 6

A company uses IAM roles for EC2 instances. An application running on an EC2 instance needs to read from an S3 bucket in another AWS account. What is the most secure way to grant access?

Accepted Answer

Create an IAM role in the target account with read access to the bucket, and allow the EC2 instance's role to assume it.. Using a cross-account IAM role in the target account allows the EC2 instance to assume the role and access the bucket securely, without sharing long-term credentials. This follows the principle of least privilege and avoids storing permanent credentials on the instance. Option B is insecure as it stores long-term IAM user access keys on the instance, which could be compromised. Option C makes the bucket public, violating security. Option D relies on the instance's public IP, which is not a secure access control mechanism and can change.

Answer

Store the other account's IAM user access keys in the EC2 instance.

Answer

Make the bucket public.

Answer

Create a bucket policy that allows access from the EC2 instance's public IP.

Question 7

A security engineer notices that an IAM user has permissions that are not explicitly granted through any policy. The engineer suspects that the user might have inherited permissions from a group or role. Which IAM feature should the engineer use to identify the source of these permissions?

Accepted Answer

IAM Policy Simulator. IAM Policy Simulator allows you to simulate actions and view the effective permissions for a user, including permissions inherited from groups or roles. It can identify which policy (direct or inherited) grants a specific permission. IAM Access Analyzer, on the other hand, is designed to analyze resource-based policies for unintended access, not to trace the source of user permissions. Therefore, the engineer should use IAM Policy Simulator.

Answer

IAM Roles Anywhere

Answer

CloudTrail Insights

Answer

IAM Access Analyzer

Question 8

An administrator needs to grant an IAM user the ability to change their own password without allowing them to change other users' passwords. Which IAM action should be included in the policy?

Accepted Answer

iam:ChangePassword. The correct action is iam:ChangePassword (option D). This action allows an IAM user to change their own password. Option A (iam:CreateLoginProfile) is typically used to create a login profile for a user, which includes setting a password, but it is not the standard way to allow a user to change their own password; iam:ChangePassword is the specific action for self-service password changes. Option B (iam:UpdateAccountPasswordPolicy) is for modifying the account-level password policy, not individual passwords. Option C (iam:UpdateServiceSpecificCredential) is for managing credentials for specific services, not passwords.

Answer

iam:CreateLoginProfile

Answer

iam:UpdateAccountPasswordPolicy

Answer

iam:UpdateServiceSpecificCredential

Question 9

A company has multiple AWS accounts and wants to centrally manage access using IAM Identity Center (AWS SSO). Which feature allows the company to define permissions once and reuse them across multiple accounts?

Accepted Answer

Permission sets. Permission sets in IAM Identity Center define a collection of administrator-defined policies that grant specific permissions to users or groups. Once created, a permission set can be assigned to any number of AWS accounts within the organization, enabling centralized permission management and reuse across multiple accounts without duplicating policy definitions.

Answer

Application assignments

Answer

Identity providers

Answer

Account assignments

Question 10

An organization wants to enforce that all IAM users use MFA. The security team creates an IAM policy that denies all actions unless MFA is present. However, some users report they cannot even change their own password to enable MFA. What should the security team do to resolve this?

Accepted Answer

Add an exception statement that allows iam:ChangePassword without MFA.. IAM users need the ability to change their password to set up MFA even when MFA is not yet enabled. The policy should include an exception for the iam:ChangePassword action to allow this action without MFA. Option A would allow all actions without MFA, defeating the purpose of enforcement. Option C is impractical as users without MFA cannot access the console to enable it. Option D removes MFA enforcement entirely, violating the requirement.

Answer

Add a statement that allows all actions when MFA is present.

Answer

Assign the policy only after users have enabled MFA.

Answer

Remove the MFA condition from the policy.

Question 11

A developer needs to access AWS resources from a mobile app. Which AWS service allows the app to obtain temporary credentials for authenticated users?

Accepted Answer

Amazon Cognito identity pools (federated identities). Amazon Cognito identity pools (federated identities) enable mobile apps to obtain temporary AWS credentials for authenticated users. User pools handle sign-in and user directories but do not directly provide AWS credentials. IAM Identity Center is for enterprise SSO, not mobile app credentials. KMS is for key management, not credential issuance.

Answer

Amazon Cognito user pools

Answer

AWS IAM Identity Center (AWS SSO)

Answer

AWS Key Management Service (AWS KMS)

Question 12

Which TWO statements are true about IAM roles? (Choose two.)

Accepted Answer

IAM roles can be used by federated users.. The correct answers are A and E. IAM roles can be used by federated users to grant temporary access (A), and they can be assumed by AWS services like EC2 to obtain permissions (E). Option B is false because IAM roles are global, not region-specific. Option C is false because roles can be attached to EC2 instances via instance profiles. Option D is false because roles use temporary credentials obtained through AWS STS, not permanent access keys.

Answer

IAM roles are specific to an AWS region.

Answer

IAM roles cannot be attached to an EC2 instance.

Answer

IAM roles have permanent access keys.

Question 13

Which THREE are valid ways to grant cross-account access to an S3 bucket? (Choose three.)

Accepted Answer

Create an IAM role in the target account and allow the source account to assume it.. The correct methods for granting cross-account access to an S3 bucket are: creating an IAM role in the target account and allowing the source account to assume it (B), using an S3 access point with a policy that allows cross-account access (C), and creating a bucket policy that grants access to the other account's root user (D). Option A (using IAM user access keys in the source account) is not a valid cross-account access method because access keys are tied to a specific user and do not provide cross-account delegation. Option E (bucket ACL) does not support cross-account full control grants for S3 buckets in AWS.

Answer

Use an IAM user in the source account with access keys.

Answer

Set the bucket ACL to grant full control to the other account.

Question 14

Which TWO are IAM best practices? (Choose two.)

Accepted Answer

Use conditions in IAM policies to restrict access based on tags or IP addresses.. Using conditions in IAM policies (e.g., `aws:SourceIp`, `aws:RequestTag`) allows you to enforce fine-grained access control based on contextual attributes like IP addresses or resource tags. This follows the principle of least privilege by restricting permissions to only the necessary scope, reducing the attack surface. For example, you can deny access to S3 buckets unless the request originates from a corporate IP range.

Answer

Avoid using IAM roles and instead attach policies directly to users.

Answer

Use the root user for everyday administrative tasks.

Answer

Grant broad permissions to all users to simplify management.

Question 15

Refer to the exhibit. An IAM policy allows s3:GetObject on an S3 bucket only when the object is encrypted with SSE-KMS. An IAM user with this policy attempts to download an object that is not encrypted. What will happen?

Accepted Answer

The download fails because the condition is not met, even though the action is allowed.. The policy allows s3:GetObject only when the condition (SSE-KMS encryption) is met. Since the object is not encrypted with SSE-KMS, the condition fails, the allow does not apply, and the request is implicitly denied. Option B is incorrect because the condition is required for the allow to take effect. Option C is incorrect because the policy is syntactically valid. Option D is incorrect because the absence of an explicit deny does not grant permission; the allow condition must still be satisfied.

Answer

The download succeeds because the condition is not required.

Answer

The download fails because the policy is invalid.

Answer

The download succeeds because there is no explicit deny.