SCS-C02 Identity and Access Management Practice Test 3 — 15 Questions

Question 1

An administrator needs to grant an IAM user the ability to change their own password without allowing them to change other users' passwords. Which IAM action should be included in the policy?

Accepted Answer

iam:ChangePassword. Option A is correct because iam:ChangePassword allows a user to change their own password. Option B allows any password change. Option C is for creating login profiles. Option D is a service control policy action.

Answer

iam:CreateLoginProfile

Answer

iam:UpdateAccountPasswordPolicy

Answer

iam:UpdateServiceSpecificCredential

Question 2

A company has multiple AWS accounts and wants to centrally manage access using IAM Identity Center (AWS SSO). Which feature allows the company to define permissions once and reuse them across multiple accounts?

Accepted Answer

Permission sets. Option B is correct because permission sets in IAM Identity Center define collections of policies that can be assigned to users and groups across accounts. Option A is for managing access to external applications. Option C is for federation. Option D is for account management.

Answer

Application assignments

Answer

Identity providers

Answer

Account assignments

Question 3

An organization wants to enforce that all IAM users use MFA. The security team creates an IAM policy that denies all actions unless MFA is present. However, some users report they cannot even change their own password to enable MFA. What should the security team do to resolve this?

Accepted Answer

Add an exception statement that allows iam:ChangePassword without MFA.. Option C is correct because the policy should include an exception for the iam:ChangePassword action to allow users to change their password (and set up MFA) before the MFA condition is enforced. Option A would allow all actions without MFA. Option B is too permissive. Option D doesn't fix the issue.

Answer

Add a statement that allows all actions when MFA is present.

Answer

Assign the policy only after users have enabled MFA.

Answer

Remove the MFA condition from the policy.

Question 4

A developer needs to access AWS resources from a mobile app. Which AWS service allows the app to obtain temporary credentials for authenticated users?

Accepted Answer

Amazon Cognito identity pools (federated identities). Option A is correct because Amazon Cognito identity pools provide temporary AWS credentials for app users. Option B is for user directories and sign-in. Option C is for single sign-on. Option D is for key management.

Answer

Amazon Cognito user pools

Answer

AWS IAM Identity Center (AWS SSO)

Answer

AWS Key Management Service (AWS KMS)

Question 5

Which TWO statements are true about IAM roles? (Choose two.)

Accepted Answer

IAM roles can be used by federated users.. Options B and C are correct. IAM roles can be assumed by AWS services (B) and can be used by federated users (C). Option A is false; roles do not have long-term credentials. Option D is false; roles are not region-specific. Option E is false; roles can be attached to EC2 instances via instance profiles.

Answer

IAM roles are specific to an AWS region.

Answer

IAM roles cannot be attached to an EC2 instance.

Answer

IAM roles have permanent access keys.

Question 6

Which THREE are valid ways to grant cross-account access to an S3 bucket? (Choose three.)

Accepted Answer

Create an IAM role in the target account and allow the source account to assume it.. Options A, B, and C are correct. A bucket policy with the target account's root user ARN (A), an IAM role in the target account that can be assumed (B), and an S3 access point with a policy (C) all allow cross-account access. Option D allows list but not full access. Option E is not a valid method.

Answer

Use an IAM user in the source account with access keys.

Answer

Set the bucket ACL to grant full control to the other account.

Question 7

Which TWO are IAM best practices? (Choose two.)

Accepted Answer

Use conditions in IAM policies to restrict access based on tags or IP addresses.. Option D is correct because using conditions in IAM policies (e.g., `aws:SourceIp`, `aws:RequestTag`) allows you to enforce fine-grained access control based on contextual attributes like IP addresses or resource tags. This follows the principle of least privilege by restricting permissions to only the necessary scope, reducing the attack surface. For example, you can deny access to S3 buckets unless the request originates from a corporate IP range.

Answer

Avoid using IAM roles and instead attach policies directly to users.

Answer

Use the root user for everyday administrative tasks.

Answer

Grant broad permissions to all users to simplify management.

Question 8

Refer to the exhibit. An IAM policy allows s3:GetObject on an S3 bucket only when the object is encrypted with SSE-KMS. An IAM user with this policy attempts to download an object that is not encrypted. What will happen?

Accepted Answer

The download fails because the condition is not met, even though the action is allowed.. Option D is correct because the policy grants access only when the condition is met (SSE-KMS). Since the object is not encrypted with SSE-KMS, the condition fails, and the request is denied by default (implicit deny). Option A is incorrect because the policy does not have an explicit deny. Option B is incorrect because the condition must be met. Option C is incorrect because the condition is evaluated.

Answer

The download succeeds because the condition is not required.

Answer

The download fails because the policy is invalid.

Answer

The download succeeds because there is no explicit deny.

Question 9

Refer to the exhibit. A security engineer runs the IAM Policy Simulator with the provided policy input. The result shows 'explicitDeny' for ec2:RunInstances even though the policy only contains an Allow. What is the most likely reason?

Accepted Answer

The user has an attached policy or SCP that explicitly denies ec2:RunInstances.. Option B is correct because an explicit deny can come from other policies attached to the user or a service control policy (SCP). The simulate-custom-policy only evaluates the provided policy input, but if the user has other policies or SCPs, they may deny the action. Option A is unlikely because the resource ARN is not the issue. Option C is not shown. Option D is incorrect because the policy syntax is valid.

Answer

The policy input has a syntax error.

Answer

The simulate-custom-policy command does not support ec2:RunInstances.

Answer

The resource ARN is incorrect for ec2:RunInstances.

Question 10

Refer to the exhibit. A KMS key policy allows decryption only when the request comes through S3 in us-east-1. An application in account 111122223333 tries to decrypt an S3 object using the KMS key directly via the KMS API (not through S3). What will happen?

Accepted Answer

The decryption fails because the condition on kms:ViaService is not satisfied.. Option C is correct because the condition restricts kms:ViaService to S3 in us-east-1. Since the request is made directly to KMS API, the condition is not met, resulting in implicit deny. Option A is incorrect because the condition is not satisfied. Option B is incorrect because the policy is valid. Option D is incorrect because the condition is not about the principal.

Answer

The decryption succeeds because the principal is the root user.

Answer

The decryption fails because the policy is invalid.

Answer

The decryption succeeds because the principal is allowed.

Question 11

A developer needs to grant an IAM user access to a specific S3 bucket only. Which IAM policy element should be used to restrict access to that bucket?

Accepted Answer

Resource. Option C is correct because the Resource element specifies the ARN of the S3 bucket. Option A is wrong because Principal specifies who gets access, not the resource. Option B is wrong because Action specifies allowed actions. Option D is wrong because Condition specifies when the policy applies.

Answer

Principal

Answer

Condition

Answer

Action

Question 12

A company uses AWS Organizations with SCPs to restrict services. An administrator creates an SCP that denies access to EC2. A developer in a member account tries to launch an EC2 instance but fails. What is the most likely reason?

Accepted Answer

The SCP from the organization denies EC2. The correct answer is A because Service Control Policies (SCPs) in AWS Organizations act as a centralized governance mechanism that applies a deny effect across all IAM principals in member accounts. When an SCP explicitly denies access to EC2, it overrides any allow permissions at the account level, including those granted by IAM policies. The developer's launch attempt fails because the SCP's deny is evaluated before any account-level permissions, effectively blocking the action regardless of the developer's IAM role or user permissions.

Answer

The root user of the account has denied EC2

Answer

The developer's IAM permissions boundary blocks EC2

Answer

The EC2 instance has a resource-based policy denying access

Question 13

A security engineer is designing a cross-account access solution. An IAM role in Account A needs to be assumed by users from Account B. Which two components are required?

Accepted Answer

Trust policy allowing Account B to assume the role, and IAM policy in Account B allowing sts:AssumeRole. Option D is correct because the trust policy in Account A allows Account B to assume the role, and users in Account B need permissions to call sts:AssumeRole. Option A is wrong because a resource-based policy on the role is not used. Option B is wrong because permission boundary is optional. Option C is wrong because an SCP in Account B might deny the action.

Answer

Permissions boundary on the role to limit permissions

Answer

Service control policy in Account A allowing AssumeRole

Answer

Resource-based policy on the role allowing cross-account access

Question 14

A company uses IAM roles for EC2 instances to access S3. A security audit reveals that some instances have roles with overly permissive policies. What is the BEST practice to scope down permissions while maintaining functionality?

Accepted Answer

Create custom IAM policies that grant only the necessary S3 actions on specific buckets. Option A is correct because the principle of least privilege is applied by granting only required actions on specific resources. Option B is wrong because S3 bucket policies are resource-based and can be used in addition. Option C is wrong because using the root user is insecure. Option D is wrong because instance profiles are just containers for roles.

Answer

Use S3 bucket policies instead of IAM policies

Answer

Attach the AdministratorAccess policy to the role and use S3 conditions

Answer

Create a new instance profile with a more restrictive permissions boundary

Question 15

An IAM user needs to rotate their own access keys. Which IAM policy action should be allowed?

Accepted Answer

iam:UpdateAccessKey. Option C is correct because IAM:UpdateAccessKey is used to manage a user's own access keys. Option A is wrong because IAM:CreateAccessKey creates a new key, but rotation involves updating. Option B is wrong because IAM:ChangePassword is for password. Option D is wrong because IAM:DeleteAccessKey deletes a key.

Answer

iam:DeleteAccessKey

Answer

iam:CreateAccessKey

Answer

iam:ChangePassword