SCS-C02 Identity and Access Management Practice Test 3 — 15 Questions

Question 1

Refer to the exhibit. A KMS key policy allows decryption only when the request comes through S3 in us-east-1. An application in account 111122223333 tries to decrypt an S3 object using the KMS key directly via the KMS API (not through S3). What will happen?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The decryption fails because the condition on kms:ViaService is not satisfied.. The KMS key policy includes a condition that restricts decryption to requests that come through S3 (kms:ViaService) in us-east-1. Since the application is calling the KMS API directly, not through S3, the condition is not satisfied, resulting in an implicit deny. Option A is incorrect because the root user principal is allowed, but the condition blocks the request. Option B is incorrect because the policy is valid; the condition works as intended. Option C is incorrect because the principal is allowed, but the condition is not met.

Answer

The decryption succeeds because the principal is the root user.

Answer

The decryption fails because the policy is invalid.

Answer

The decryption succeeds because the principal is allowed.

Question 2

A developer needs to grant an IAM user access to a specific S3 bucket only. Which IAM policy element should be used to restrict access to that bucket?

Accepted Answer

Resource. The Resource element specifies the ARN of the S3 bucket. Option A is wrong because Principal specifies who gets access, not the resource. Option B is wrong because Action specifies allowed actions. Option D is wrong because Condition specifies when the policy applies.

Answer

Principal

Answer

Condition

Answer

Action

Question 3

A security engineer is designing a cross-account access solution. An IAM role in Account A needs to be assumed by users from Account B. Which two components are required?

Accepted Answer

Trust policy allowing Account B to assume the role, and IAM policy in Account B allowing sts:AssumeRole. For cross-account IAM role access, two components are required: (1) a trust policy on the role in Account A that grants permissions for principals in Account B to assume the role, and (2) an IAM policy in Account B that allows its users to call sts:AssumeRole on the role ARN in Account A. Option A is incorrect because a permissions boundary is optional and not a required component. Option B is incorrect because Service Control Policies (SCPs) are used to restrict permissions at the organizational level, not to allow actions; they cannot explicitly allow AssumeRole. Option D is incorrect because IAM roles do not support resource-based policies; only trust policies are used for cross-account access.

Answer

Permissions boundary on the role to limit permissions

Answer

Service control policy in Account A allowing AssumeRole

Answer

Resource-based policy on the role allowing cross-account access

Question 4

A company uses IAM roles for EC2 instances to access S3. A security audit reveals that some instances have roles with overly permissive policies. What is the BEST practice to scope down permissions while maintaining functionality?

Accepted Answer

Create custom IAM policies that grant only the necessary S3 actions on specific buckets. Custom IAM policies allow you to grant least privilege by specifying exactly the S3 actions (e.g., GetObject, PutObject) on specific buckets or prefixes. Option A is wrong because bucket policies are resource-based and do not restrict the IAM role's permissions; they are complementary but not a replacement for scoping down the role. Option B is wrong because AdministratorAccess grants full access and conditions cannot sufficiently limit actions. Option D is wrong because a permissions boundary only sets a maximum permissions limit; the role still needs a policy that grants specific permissions, so it does not solve the over-permissive policy issue.

Answer

Use S3 bucket policies instead of IAM policies

Answer

Attach the AdministratorAccess policy to the role and use S3 conditions

Answer

Create a new instance profile with a more restrictive permissions boundary

Question 5

An IAM user needs to rotate their own access keys. Which IAM policy action should be allowed?

Accepted Answer

iam:UpdateAccessKey. IAM:UpdateAccessKey is used to rotate access keys (e.g., changing the status from Active to Inactive). Option A is incorrect because IAM:DeleteAccessKey removes a key entirely, not part of rotation. Option C is incorrect because IAM:CreateAccessKey creates a new key but does not handle the deactivation step. Option D is incorrect because IAM:ChangePassword is for password changes, not access keys.

Answer

iam:DeleteAccessKey

Answer

iam:CreateAccessKey

Answer

iam:ChangePassword

Question 6

A security engineer notices that an IAM role for an EC2 instance has a policy that allows s3:PutObject on a bucket. However, the application reports access denied when trying to upload. The bucket policy does not explicitly deny access. What is a likely cause?

Accepted Answer

The policy condition key does not match the request context. The likely cause is that the policy condition key does not match the request context (Option D). Even though the role allows s3:PutObject, if the policy includes conditions (e.g., source IP, VPC, encryption) that are not met by the request, the effective permission becomes an implicit deny. Since the bucket policy does not explicitly deny, the problem lies in the role policy's conditions. Option A is incorrect because the stem explicitly states the bucket policy does not explicitly deny. Option B is incorrect because if the instance profile were not attached, the role would not be available; but the role is attached as stated. Option C is incorrect because the role policy does include s3:PutObject.

Answer

The bucket policy denies access

Answer

The instance profile is not attached to the EC2 instance

Answer

The role's policy does not include s3:PutObject

Question 7

A company uses AWS IAM Identity Center (AWS SSO) to manage access. A user is assigned to a permission set that grants AdministratorAccess. However, when the user tries to access the AWS console, they receive an error that they are not authorized. What is a possible reason?

Accepted Answer

The user is not assigned to the AWS account in Identity Center. In AWS IAM Identity Center, a user must be assigned to both a permission set and an AWS account. The error occurs when the user has the permission set but not the account assignment. Option B is incorrect because MFA is about authentication, not authorization; the user could be authenticated but still lack access to the account. Option C is incorrect because the permission set already includes AdministratorAccess, which provides full permissions; the issue is the account assignment. Option D is incorrect because the error is about accessing the console, not about managing permission sets.

Answer

The user has not set up MFA

Answer

The permission set does not include the necessary policies

Answer

The user does not have permissions to manage permission sets

Question 8

A company uses IAM roles for cross-account access. Developers in Account A need to assume a role in Account B. What must be true for the AssumeRole call to succeed?

Accepted Answer

The role's trust policy must allow Account A and the user must have sts:AssumeRole permission. For a user in Account A to assume a role in Account B, the role's trust policy must grant access to Account A (as a principal), and the user must have the sts:AssumeRole permission. Option A is wrong because an SCP in Account A could deny sts:AssumeRole, but it is not required to allow it. Option B is wrong because MFA is not a requirement for cross-account role assumption. Option D is wrong because a permissions boundary is not required; it can limit permissions but does not enable the assumption.

Answer

Account A must have an SCP that allows sts:AssumeRole

Answer

The user in Account A must have MFA enabled

Answer

The role in Account B must have a permissions boundary

Question 9

Which TWO of the following are valid IAM policy condition keys? (Choose TWO.)

Accepted Answer

aws:RequestedRegion. The `aws:RequestedRegion` condition key is valid and used to restrict access to specific AWS Regions. It evaluates the Region endpoint that the API request is sent to, allowing you to enforce that actions can only be performed in designated Regions, such as us-east-1 or eu-west-2.

Answer

aws:RequestedService

Answer

aws:PrincipalService

Answer

aws:SourceArn

Question 10

Which THREE of the following are best practices for managing IAM access keys? (Choose THREE.)

Accepted Answer

Use IAM roles for EC2 instances instead of access keys. The correct best practices are A, C, and E. Using IAM roles for EC2 instances (A) eliminates the need for long-term access keys. Deleting unused access keys (C) reduces risk. Rotating access keys regularly (E) limits exposure if keys are compromised. Option B is incorrect because long-lived access keys increase risk; they should be rotated. Option D is incorrect because embedding access keys in application code is insecure; use IAM roles instead.

Answer

Use long-lived access keys for applications

Answer

Embed access keys in application code for convenience

Question 11

Which TWO of the following are valid use cases for IAM permissions boundaries? (Choose TWO.)

Accepted Answer

To prevent an IAM user from escalating privileges. IAM permissions boundaries are a feature that allows you to set the maximum permissions that an identity-based policy can grant to an IAM entity. By attaching a permissions boundary to a user or role, you can prevent that entity from creating or modifying IAM resources (such as roles or policies) to escalate their privileges, even if their attached policies would otherwise allow it. This acts as a guardrail to enforce a hard limit on what actions the entity can perform, directly addressing privilege escalation risks.

Answer

To allow cross-account access to an S3 bucket

Answer

To delegate permission management to non-administrators

Answer

To restrict access to an S3 bucket based on IP address

Question 12

A security engineer attaches this policy to an IAM user. The user tries to download an object from the bucket from an IP address 10.1.0.5. What will happen?

Accepted Answer

The user will be denied access because the condition does not match. The condition in the policy restricts access to IP addresses within the 10.0.0.0/16 range. The user's IP address 10.1.0.5 is not in that range, so the allow statement for s3:GetObject does not apply. Since there is no applicable allow statement, the default implicit deny takes effect, resulting in denied access. Option B is wrong because the allow only applies when the condition is satisfied. Option C is wrong because the policy is syntactically valid. Option D is wrong because there is no explicit deny statement; the denial is implicit.

Answer

The user will be allowed access because the policy allows s3:GetObject

Answer

The policy is invalid and will cause an error

Answer

The user will be denied access because there is an explicit deny

Question 13

A security engineer reviews the trust policy of an IAM role. Which accounts can assume this role?

Accepted Answer

Account 111111111111. The trust policy of the IAM role specifies a principal of "111111111111" as the trusted entity. This means only accounts explicitly listed in the Principal element can assume the role. Since the policy does not include account 123456789012 or allow any AWS account, only account 111111111111 is authorized to assume the role.

Answer

Only the root user of account 123456789012

Answer

Account 123456789012

Answer

Any AWS account

Question 14

A developer creates this CloudFormation stack. An EC2 instance with this role tries to list objects in the bucket. What will happen?

Accepted Answer

The instance can list objects in the bucket. The bucket policy grants `s3:ListBucket` action, which allows listing the objects in the bucket (i.e., the `ListObjects` API). The EC2 instance with that role can therefore list objects in the bucket. However, to upload objects, `s3:PutObject` would be required, which is not granted. Thus, option D is correct.

Answer

The instance can list the bucket but not the objects

Answer

The instance cannot assume the role because the principal is ec2.amazonaws.com

Answer

The instance can upload objects to the bucket

Question 15

A security engineer is reviewing an AWS account and notices that multiple IAM users have full administrative access. The company policy requires that users have only the permissions necessary to perform their job. What is the MOST secure and efficient way to enforce this policy?

Accepted Answer

Use an IAM group for each job function, attach appropriate managed policies to the group, and add users to the group.. Using IAM groups and attaching managed policies to them allows centralized permission management and simplifies the principle of least privilege.

Answer

Create an IAM policy that denies all actions except those specifically allowed, and attach it to each user.

Answer

Use an SCP in AWS Organizations to deny all actions by default.

Answer

Assign an inline policy to each user that specifies allowed actions.