SCS-C02 Identity and Access Management Practice Test 2 — 15 Questions

Question 1

A developer is trying to upload an object to an S3 bucket named 'my-bucket' using the AWS CLI. The developer has an IAM user with a policy that includes 's3:PutObject' for 'arn:aws:s3:::my-bucket/*'. However, the upload fails with an 'Access Denied' error. The bucket policy is set to allow all principals from the same AWS account to perform 's3:PutObject'. What is the most likely cause of this failure?

Accepted Answer

The IAM policy grants 's3:PutObject' only on objects (/*), but the request may also require 's3:PutObject' on the bucket itself for some operations.. Option C is correct because the IAM policy grants 's3:PutObject' only on the bucket's object ARN (arn:aws:s3:::my-bucket/*), but certain S3 operations, such as multipart uploads initiated via the AWS CLI, may require the 's3:PutObject' permission on the bucket resource itself (arn:aws:s3:::my-bucket) to complete the upload. The bucket policy allows 's3:PutObject' for all principals in the same account, but the IAM user's policy is too restrictive, causing the 'Access Denied' error.

Answer

The IAM user is not authorized to perform 's3:PutObject' on the bucket 'my-bucket'.

Answer

The bucket policy denies access because the principal is not explicitly listed.

Answer

The bucket 'my-bucket' does not exist in the same region as the CLI request.

Question 2

A security administrator is designing a cross-account access strategy. The administrator needs to allow users in Account A to assume an IAM role in Account B to access an S3 bucket. Which TWO of the following statements are true regarding this configuration?

Accepted Answer

The IAM users in Account A must have an IAM policy that allows the sts:AssumeRole action for the role ARN in Account B.. Option A is correct because for an IAM user in Account A to assume a role in Account B, the user must be explicitly granted permission to call the sts:AssumeRole API action against the role's Amazon Resource Name (ARN). This is done by attaching an IAM policy to the user (or a group/role the user belongs to) that includes the sts:AssumeRole action and specifies the target role ARN as the resource. Without this permission, the user cannot initiate the cross-account role assumption, even if the role's trust policy allows it.

Answer

The trust policy for the role must be defined in Account A.

Answer

The S3 bucket policy must grant access to the IAM users in Account A.

Answer

The IAM users in Account A must have cross-account permissions on the S3 bucket in Account B.

Question 3

An IAM policy is attached to a user. The user is trying to change their own password in the IAM console but receives an 'Access Denied' error. The user has an MFA device configured and is logged in with MFA. Why is the password change failing?

Accepted Answer

The Deny statement uses 'BoolIfExists' which evaluates to true if the condition key is not present. In the IAM console, the 'aws:MultiFactorAuthPresent' key may not be set, causing the Deny to apply even when the user has MFA.. Option B is correct because the Deny statement uses the `BoolIfExists` condition operator with the `aws:MultiFactorAuthPresent` key. In the IAM console, the `aws:MultiFactorAuthPresent` key may not be present in the request context (e.g., during the initial password change flow before MFA is re-validated), causing `BoolIfExists` to evaluate to true when the key is absent. This triggers the Deny even though the user has an MFA device and is logged in with MFA, blocking the `iam:ChangePassword` action.

Answer

The Allow statement for iam:ChangePassword is not sufficient because the Deny statement explicitly denies all actions.

Answer

The Deny statement denies all actions unconditionally, so the Allow statement cannot override it.

Answer

The user does not have permission to change their own password because the Allow statement is not specific enough.

Question 4

A company has a single AWS account with multiple IAM users. The administrator created an IAM policy that allows all users to launch EC2 instances, but only if they use a specific AMI ID (ami-12345678) and a specific instance type (t3.micro). The policy uses a condition that checks the EC2 instance type and AMI ID. However, a user is able to launch an EC2 instance with a different AMI ID and a larger instance type. The administrator reviews the policy and confirms that the condition is correctly written. What is the most likely reason that the policy is not working as expected?

Accepted Answer

The condition keys used (ec2:InstanceType and ec2:ImageId) are not supported for the RunInstances action in IAM policies.. Option A is correct because the `ec2:InstanceType` and `ec2:ImageId` condition keys are not supported for the `ec2:RunInstances` action in IAM policies. AWS IAM condition keys for EC2 are action-specific, and for RunInstances, only certain keys like `ec2:InstanceType` and `ec2:ImageId` are actually supported in the request context. However, the key detail is that `ec2:ImageId` is not a valid condition key for RunInstances; the correct key is `ec2:ImageId` is not listed in the AWS documentation for RunInstances, meaning the condition is silently ignored, allowing any AMI and instance type.

Answer

The policy is attached to the user but must also be attached to the IAM group.

Answer

The policy does not include an explicit deny statement for non-compliant launches.

Answer

The condition is written incorrectly; it should use StringLike instead of StringEquals.

Question 5

A company has an S3 bucket policy that allows cross-account access for a specific IAM role in another account. The bucket policy includes a Principal element with the ARN of the role. However, users in the other account that assume the role are unable to access the bucket. Which of the following is the MOST likely cause?

Accepted Answer

The bucket policy uses the role ARN in the Principal element instead of the AWS account ID.. Option D is correct because when an S3 bucket policy uses a role ARN in the Principal element, the policy only grants access to that specific role session, not to the users who assume the role. Cross-account access via S3 bucket policies requires the Principal to be set to the AWS account ID (or a canonical user ID) of the other account, not the ARN of a role. The role ARN in the Principal element is not evaluated as a valid principal for S3 bucket policies in the same way as an account ID, causing the access to fail.

Answer

The IAM role does not have a permissions policy granting s3:GetObject on the bucket.

Answer

The bucket policy has an explicit Deny statement that overrides the Allow.

Answer

The role's trust policy does not allow the S3 service to assume the role.

Question 6

A security engineer is designing a solution to allow an external auditor to access logs in an S3 bucket in the company's AWS account. The auditor does not have an AWS account. The engineer needs to grant read-only access to the specific bucket for a limited time. Which TWO actions should the engineer take? (Choose two.)

Accepted Answer

Use AWS STS to issue temporary credentials that the auditor can use to access the bucket.. Option C is correct because AWS Security Token Service (STS) can issue temporary, limited-privilege credentials (access key, secret key, and session token) that the auditor can use to authenticate API requests to the S3 bucket. This approach does not require the auditor to have an AWS account and allows the engineer to control the validity period (via the DurationSeconds parameter) to enforce a limited time window. Option D is correct because a pre-signed URL embeds temporary credentials and a specific expiration time, granting read-only access to a single object without requiring the auditor to have AWS credentials or an AWS account.

Answer

Enable S3 Access Analyzer on the bucket to generate findings for the auditor.

Answer

Create a cross-account IAM role in the company's account and share the role ARN with the auditor.

Answer

Configure the bucket policy to grant access to 'Principal': '*' with a condition that limits access to the auditor's IP address.

Question 7

Drag and drop the steps to implement AWS KMS key rotation in the correct order.

Question 8

Drag and drop the steps to configure AWS CloudTrail for logging across all regions and accounts in the correct order.

Question 9

Match each AWS KMS key type to its description.

Question 10

Match each AWS CloudHSM feature to its description.

Question 11

A company wants to allow an IAM user to manage only their own access keys. Which IAM policy should be attached to the user?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"iam:*AccessKey*","Resource":"arn:aws:iam::*:user/${aws:username}"}]}. Option C is correct because the IAM policy with 'Condition': {'StringEquals': {'iam:username': '${aws:username}'}} restricts the user to manage only their own access keys. Option A gives full access to all users' keys. Option B denies all key management. Option D allows full access without restriction.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"iam:*AccessKey*","Resource":"arn:aws:iam::*:user/*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"iam:*AccessKey*","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"iam:*AccessKey*","Resource":"*"}]}

Question 12

A security engineer must ensure that cross-account access to an S3 bucket is restricted to only accounts that are part of a specific AWS organization. Which IAM policy condition key should be used in the bucket policy?

Accepted Answer

aws:PrincipalOrgID. Option D is correct because 'aws:PrincipalOrgID' condition key checks that the principal's account belongs to a specific AWS organization. Option A is for MFA. Option B is for source IP. Option C is for VPC endpoint.

Answer

aws:SourceIp

Answer

aws:MultiFactorAuthPresent

Answer

aws:SourceVpce

Question 13

An IAM user reports that they are unable to launch an EC2 instance in us-east-1. The IAM policy attached to the user allows ec2:RunInstances but with a condition that the instance type must be t2.micro. What could be the reason for the failure?

Accepted Answer

The user is trying to launch an instance type other than t2.micro.. Option A is correct because the condition likely specifies 'ec2:InstanceType' equals 't2.micro', so if the user tries to launch any other type, the action is denied. Option B is irrelevant because the policy allows the action. Option C is not a common condition. Option D is unrelated.

Answer

The user has not attached a security group to the instance.

Answer

The IAM policy does not include ec2:RunInstances for us-east-1.

Answer

The user's account has reached the EC2 instance limit.

Question 14

A company uses IAM roles for EC2 instances. An application running on an EC2 instance needs to read from an S3 bucket in another AWS account. What is the most secure way to grant access?

Accepted Answer

Create an IAM role in the target account with read access to the bucket, and allow the EC2 instance's role to assume it.. Option B is correct because using a cross-account IAM role in the target account allows the EC2 instance to assume the role and access the bucket securely, without sharing long-term credentials. Option A is less secure and requires managing keys. Option C is not secure. Option D is overly permissive.

Answer

Store the other account's IAM user access keys in the EC2 instance.

Answer

Make the bucket public.

Answer

Create a bucket policy that allows access from the EC2 instance's public IP.

Question 15

A security engineer notices that an IAM user has permissions that are not explicitly granted through any policy. The engineer suspects that the user might have inherited permissions from a group or role. Which IAM feature should the engineer use to identify the source of these permissions?

Accepted Answer

IAM Access Analyzer. Option D is correct because IAM Access Analyzer provides policy validation and can help identify unintended access. Option A shows effective permissions but doesn't necessarily trace sources. Option B is for analyzing service roles, not user permissions. Option C is for CloudTrail analysis.

Answer

IAM Roles Anywhere

Answer

IAM Policy Simulator

Answer

CloudTrail Insights