SCS-C02 Identity and Access Management Practice Test 3 — 15 Questions

Question 1

A company wants to allow its employees to authenticate to the AWS Management Console using their existing corporate credentials. Which AWS service should be used to integrate with the company's identity provider?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS IAM Identity Center (AWS SSO). AWS IAM Identity Center (formerly AWS SSO) is the correct service because it is specifically designed to enable single sign-on (SSO) from an external identity provider (IdP) to AWS accounts and business applications. It supports federation via SAML 2.0 or OIDC, allowing employees to authenticate using their existing corporate credentials and then access the AWS Management Console without needing separate IAM users.

Answer

AWS Secrets Manager

Answer

AWS Directory Service for Microsoft Active Directory

Answer

AWS Certificate Manager

Question 2

Which TWO of the following are AWS best practices for managing access keys? (Choose 2.)

Accepted Answer

Delete unused access keys.. AWS best practices recommend deleting unused access keys to reduce the risk of unauthorized access. Unused keys represent a potential attack vector, as they may be forgotten and left active, allowing an attacker who discovers them to gain access to AWS resources. By regularly auditing and removing keys that are no longer in use, you minimize the exposure of long-lived credentials.

Answer

Use the same access key for multiple users.

Answer

Share access keys via email.

Answer

Embed access keys directly in application code.

Question 3

A company wants to allow an IAM user to list objects in an S3 bucket named 'my-bucket'. Which IAM policy statement grants the minimum required permissions?

Accepted Answer

{"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::my-bucket"}. The s3:ListBucket action is the specific permission required to list objects in an S3 bucket, and the resource ARN must be the bucket itself (arn:aws:s3:::my-bucket) without a trailing /*. This grants the minimum necessary permission to perform the ListObjects (or ListObjectsV2) API call, which returns the object keys in the bucket.

Answer

{"Effect":"Allow","Action":"s3:PutObject","Resource":"arn:aws:s3:::my-bucket/*"}

Answer

{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::my-bucket/*"}

Answer

{"Effect":"Allow","Action":"s3:*","Resource":"arn:aws:s3:::my-bucket"}

Question 4

A developer needs to allow a Lambda function to write logs to CloudWatch Logs. What is the MINIMUM IAM policy that should be attached to the Lambda execution role?

Accepted Answer

{"Effect":"Allow","Action":["logs:CreateLogGroup","logs:CreateLogStream","logs:PutLogEvents"],"Resource":"*"}. It grants the minimum required actions: logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents, which are all necessary for a Lambda function to write logs to CloudWatch Logs. Option B is wrong because it only grants logs:PutLogEvents but lacks logs:CreateLogGroup and logs:CreateLogStream, which are required if the log group and log stream do not already exist. Option C is wrong because it grants all logs actions (logs:*), which is overly permissive and not the minimum required. Option D is wrong because it grants only describe actions, which do not allow the writing of log events.

Answer

{"Effect":"Allow","Action":"logs:PutLogEvents","Resource":"arn:aws:logs:us-east-1:123456789012:log-group:my-log-group:*"}

Answer

{"Effect":"Allow","Action":"logs:*","Resource":"*"}

Answer

{"Effect":"Allow","Action":["logs:DescribeLogGroups","logs:DescribeLogStreams"],"Resource":"*"}

Question 5

A company has an IAM policy that allows s3:GetObject on all buckets. However, a specific S3 bucket policy explicitly denies s3:GetObject to all principals. An IAM user with the IAM policy tries to read an object from that bucket. What is the result?

Accepted Answer

The request is denied because the explicit deny in the bucket policy overrides the allow in the IAM policy.. D is correct because AWS IAM policy evaluation logic follows an explicit deny override: any explicit deny in any applicable policy (resource-based or identity-based) overrides any allow. The S3 bucket policy explicitly denies s3:GetObject to all principals, so even though the IAM policy allows the action, the explicit deny takes precedence, resulting in a denied request.

Answer

The request is allowed because the IAM policy is more specific.

Answer

The request is allowed because the IAM policy allows the action.

Answer

The request is denied because the bucket policy applies only to IAM users.

Question 6

Which TWO actions can be used to restrict access to an S3 bucket to only requests that originate from a specific VPC?

Accepted Answer

Use an IAM policy with a condition key aws:SourceVpce to restrict access to the VPC endpoint.. The `aws:SourceVpce` condition key in an IAM policy allows you to restrict access to an S3 bucket to requests that originate from a specific VPC endpoint (VPC Endpoint ID). This ensures that only traffic coming through that VPC endpoint can access the bucket, effectively limiting access to the VPC. Option C is also correct because you can configure a VPC endpoint for S3 and attach a bucket policy that explicitly allows access only from that endpoint using the `aws:SourceVpce` condition, achieving the same restriction.

Answer

Use a security group to allow inbound traffic from the VPC to S3.

Answer

Use a network ACL to allow traffic from the VPC to S3.

Answer

Use an IAM policy with a condition key aws:SourceIp to restrict access to the VPC CIDR.

Question 7

An IAM policy attached to a user allows s3:GetObject on bucket 'my-bucket'. The user also has a service control policy (SCP) in the organization that denies s3:GetObject on all resources. The user attempts to download an object from 'my-bucket'. What is the outcome?

Accepted Answer

The request fails because the SCP explicitly denies the action.. The request fails because AWS Organizations Service Control Policies (SCPs) act as a boundary for all accounts within the organization. An explicit deny in an SCP overrides any allow from an IAM policy, including those attached to the user. Since the SCP denies s3:GetObject on all resources, the user's IAM policy allowing the same action is effectively blocked, resulting in a failed request.

Answer

The request succeeds because the IAM policy allows it.

Answer

The request fails because the SCP effect is 'Allow' and the IAM policy is 'Deny'.

Answer

The request succeeds because the user is in the management account.

Question 8

A company wants to allow users from an external AWS account to assume a role in the company's account. What must be configured in the company's account?

Accepted Answer

A trust policy that allows the external account to assume the role.. Cross-account IAM role access requires the role in the company's account to have a trust policy that explicitly grants the external AWS account's root user or specific IAM entities permission to assume the role. The trust policy uses the `sts:AssumeRole` action and specifies the external account ID as the `Principal`, which establishes the trust relationship necessary for the external account to request temporary security credentials via AWS STS.

Answer

An IAM user in the company's account with cross-account access.

Answer

A permissions policy that allows the external account to list roles.

Answer

An IAM identity provider for the external account.

Question 9

Which TWO are best practices for managing IAM roles for EC2 instances?

Accepted Answer

Apply the principle of least privilege when defining role permissions.. The principle of least privilege ensures that an IAM role attached to an EC2 instance grants only the minimum permissions required for the application to function. This reduces the attack surface and limits potential damage from compromised instances. AWS Identity and Access Management (IAM) roles for EC2 use temporary security credentials obtained via the instance metadata service (IMDS), eliminating the need for long-term access keys.

Answer

Regularly rotate IAM user access keys.

Answer

Attach the same role to all instances for simplicity.

Answer

Store AWS access keys directly on the instance.

Question 10

Which THREE AWS services can be used to authenticate users for accessing AWS resources?

Accepted Answer

AWS Single Sign-On. AWS Single Sign-On (SSO) is a service that centrally manages access to multiple AWS accounts and business applications, authenticating users via an external identity provider (IdP) such as Microsoft Active Directory or Okta. It allows users to sign in once and gain federated access to assigned AWS resources, making it a valid authentication service for AWS resource access.

Answer

AWS Secrets Manager

Answer

AWS CloudTrail

Question 11

A developer needs to grant an EC2 instance access to an S3 bucket. Which is the most secure way to provide credentials to the EC2 instance?

Accepted Answer

Create an IAM role and attach it to the EC2 instance profile. It uses an IAM role attached to an EC2 instance profile, which allows the instance to obtain temporary, automatically rotated credentials from the AWS STS service via the instance metadata service (IMDS). This eliminates the need to hardcode, store, or manage long-term access keys, significantly reducing the risk of credential exposure.

Answer

Store AWS access keys in the application code

Answer

Store the keys in an S3 bucket and download them at startup

Answer

Use environment variables to store the keys

Question 12

A security team notices that an IAM user has permissions to launch EC2 instances but should not have access to certain instance types. Which IAM policy condition key should be used to restrict this?

Accepted Answer

ec2:InstanceType. The ec2:InstanceType condition key allows you to restrict IAM users to launching only specific EC2 instance types (e.g., t2.micro, m5.large) by evaluating the instance type value in the RunInstances API call. This is the correct key to enforce a policy that denies access to certain instance types while permitting others.

Answer

ec2:ResourceTag

Answer

ec2:Tenancy

Answer

ec2:InstanceProfile

Question 13

Which TWO IAM policy conditions can be used to enforce that API calls originate from a specific AWS region? (Choose TWO.)

Accepted Answer

aws:SourceIp. The correct answers are C and D. aws:SourceIp can be used with known IP address ranges for a specific AWS region to restrict API calls to that region, effectively enforcing region-based access. aws:RequestedRegion directly checks the AWS region specified in the API request, providing a straightforward condition for region enforcement. Option A (ec2:Region) is specific to EC2 resources and not a general IAM condition for request origin. Option B (aws:UserAgent) checks the user agent string, not the region. Option E (aws:Region) checks the region of the resource, not the request origin.

Answer

ec2:Region

Answer

aws:UserAgent

Answer

aws:Region

Question 14

A company wants to allow a third-party auditor to read objects in an S3 bucket for a limited time. The auditor does not have an AWS account. What is the most secure way to grant this access?

Accepted Answer

Generate presigned URLs for all objects in the bucket and share them with the auditor.. Presigned URLs grant time-limited access to individual objects without requiring the auditor to have an AWS account or long-term credentials. This is the most secure method for a third party without an AWS account. Option C is incorrect because the auditor does not have an AWS account, so they cannot assume a cross-account IAM role. Option A is wrong because the auditor has no AWS account. Option D is wrong because sharing IAM user credentials is a security risk and not recommended.

Answer

Use a bucket policy that grants read access to the auditor's AWS account (if they have one).

Answer

Create a cross-account IAM role with an external ID and allow the auditor to assume the role using AWS STS.

Answer

Create an IAM user with read-only access and share the credentials with the auditor.

Question 15

An organization wants to enforce multi-factor authentication (MFA) for all IAM users accessing the AWS Management Console. Which policy should be used?

Accepted Answer

A policy that denies all actions unless aws:MultiFactorAuthPresent is true.. It uses an IAM policy with a Deny effect on all actions when `aws:MultiFactorAuthPresent` is false (or not true). This ensures that any IAM user attempting to perform any action, including ConsoleLogin, must have authenticated with MFA; otherwise, the request is denied. This is the standard approach to enforce MFA for all AWS Management Console access.

Answer

A policy that allows all actions and denies when aws:MultiFactorAuthPresent is true.

Answer

A policy that allows all actions except ConsoleLogin unless MFA is present.

Answer

A policy that allows all actions when aws:MultiFactorAuthPresent is true.