SCS-C02 Identity and Access Management Practice Test 3 — 15 Questions

Question 1

A developer needs to grant an IAM user the ability to launch EC2 instances with specific tags. Which IAM condition key should be used to enforce that the instance is tagged with 'Environment=Production'?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

aws:RequestTag. The aws:RequestTag condition key evaluates the tags that the requester is trying to apply in the API call itself, which is exactly what is needed to enforce that a new EC2 instance is launched with Environment=Production. It is used with the ec2:CreateTags or RunInstances actions to require specific tag key-value pairs at creation time. aws:ResourceTag, by contrast, evaluates tags already on an existing resource.

Answer

aws:ResourceTag

Answer

aws:SourceIp

Answer

ec2:ResourceTag

Question 2

A security team is troubleshooting an issue where an IAM role assumed by a Lambda function is unable to write logs to CloudWatch Logs. The role has an attached policy that allows logs:CreateLogGroup and logs:PutLogEvents. What is a likely reason for the failure?

Accepted Answer

The trust policy of the role does not include Lambda as a trusted entity.. The Lambda function's execution role must have a trust policy that allows the Lambda service to assume the role. Without this trust relationship, Lambda cannot assume the role to perform actions like writing logs, even if the permissions policy grants logging actions. Option A correctly identifies this issue. Option B is about VPC networking, which does not directly affect CloudWatch Logs access unless the function is in a VPC without required endpoints; however, the question does not mention VPC. Option C is incorrect because the failure is about writing logs, not creating network interfaces. Option D is about CloudWatch Logs resource policies, which can deny access, but the question does not indicate such a policy exists, and the trust policy is a more likely cause given the setup.

Answer

The Lambda function is in a VPC without a NAT gateway.

Answer

The role does not have permission to create network interfaces.

Answer

The CloudWatch Logs resource policy denies the role.

Question 3

A company uses AWS Organizations and wants to prevent any IAM user from creating access keys for a long period. Which SCP should be applied to the root OU to enforce that IAM users cannot create access keys unless explicitly allowed?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"iam:CreateAccessKey","Resource":"arn:aws:iam::*:user/*","Condition":{"StringNotEquals":{"aws:ResourceTag/purpose":"temporary"}}}]}. It uses a Deny effect with a condition that blocks iam:CreateAccessKey unless the user has the tag 'purpose' with value 'temporary'. SCPs are deny-by-default, so an explicit Deny with a condition enforces the restriction while allowing exceptions for tagged users. This matches the requirement to prevent long-term access keys unless explicitly allowed.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"iam:CreateAccessKey","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"iam:DeleteAccessKey","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"iam:CreateAccessKey","Resource":"arn:aws:iam::*:user/*"}]}

Question 4

Which TWO AWS services can be used to centrally manage permissions across multiple AWS accounts?

Accepted Answer

AWS Single Sign-On. AWS Single Sign-On (option A) is correct because it centrally manages access and permissions across multiple AWS accounts by integrating with AWS Organizations to assign users and groups to permission sets that map to IAM roles in each account. AWS Organizations (option E) is correct because it provides centralized management of multiple AWS accounts, including service control policies (SCPs) that set permission guardrails across all accounts in the organization. AWS Config (option B) is incorrect because it is a resource inventory, configuration history, and compliance evaluation service, not a permissions management service. AWS WAF (option C) is incorrect because it is a web application firewall that filters HTTP(S) traffic against web exploits, not an identity or permissions service. AWS Identity and Access Management (option D) is incorrect because IAM manages users, roles, and policies within a single AWS account, not centrally across multiple accounts.

Answer

AWS Config

Answer

AWS WAF

Answer

AWS Identity and Access Management (IAM)

Question 5

An IAM role has the above trust policy. Users from account 123456789012 try to assume the role. What is required for the AssumeRole API call to succeed?

Accepted Answer

The user must have MFA enabled and present the MFA token.. The trust policy includes a condition requiring MFA (e.g., aws:MultiFactorAuthPresent: true). Therefore, users must have MFA enabled and provide the MFA token when calling AssumeRole. Option A is incorrect because the role can be assumed by users from another account, but MFA is still required. Option B is incorrect because the user does not need an IAM policy allowing sts:AssumeRole; the trust policy grants the permission. Option D is incorrect because the condition is about MFA, not IP address.

Answer

The user must be an IAM user in the same account as the role.

Answer

The user must have an IAM policy that allows sts:AssumeRole.

Answer

The request must originate from a specific IP address range.

Question 6

A security engineer needs to grant cross-account access to an S3 bucket in Account A to a role in Account B. Which combination of IAM entities must be configured?

Accepted Answer

IAM role in Account A with trust policy for Account B. Cross-account access requires an IAM role in the trusting account (Account A) with a trust policy that allows the trusted account (Account B) to assume it, and an IAM policy in Account B that allows the user or role to call sts:AssumeRole. Option C is correct. Option A is wrong because the bucket policy alone is not sufficient; the role must also allow the action. Option B is wrong because the role is in Account A, not Account B. Option D is wrong because an IAM user in Account B cannot directly access a role in Account A without assuming it.

Answer

Bucket policy in Account A and IAM user policy in Account B

Answer

IAM role in Account B with trust policy for Account A

Answer

IAM user in Account B with permissions to the bucket

Question 7

Which IAM entity can be used to delegate permissions to an AWS service to perform actions on your behalf?

Accepted Answer

Service role. A service role is an IAM role that a service assumes to perform actions on your behalf. Option A is correct. Option B is wrong because a service-linked role is a special type of service role, but not all service roles are service-linked. Option C is wrong because an instance profile is used for EC2. Option D is wrong because a permissions boundary is used to set maximum permissions.

Answer

Service-linked role

Answer

Instance profile

Answer

Permissions boundary

Question 8

A company has a policy that all IAM users must rotate their access keys every 90 days. How can this be enforced?

Accepted Answer

Use AWS Config to check key age and automatically deactivate old keys. AWS Config can be used to create a custom rule that checks the age of IAM access keys and automatically deactivates keys older than 90 days. This enforces the rotation policy by taking action when keys exceed the threshold. AWS Config provides continuous monitoring and remediation, making it the correct solution for enforcement.

Answer

Use an IAM password policy to set the key rotation period

Answer

Use AWS CloudTrail to monitor key usage and send alerts

Answer

Use an IAM policy with a condition for key age

Question 9

A security architect is designing a system where an S3 bucket must be accessed by users from multiple AWS accounts. The solution must use the principle of least privilege. Which approach should be used?

Accepted Answer

Create an IAM role in the bucket owner account and use a bucket policy that grants access to the role. The recommended approach for cross-account access to an S3 bucket while adhering to least privilege is to create an IAM role in the bucket owner account and attach a bucket policy that grants the necessary permissions to that role. Users from other AWS accounts can then assume this role to access the bucket, ensuring that access is temporary and centrally managed. Option A is correct. Option B is incorrect because granting s3:ListBucket and s3:GetObject to all IAM users violates least privilege. Option C is incorrect because SCPs are used for service control policies at the organization level, not for granting access to specific resources across accounts. Option D is incorrect because creating IAM roles in each account with a bucket policy allowing the role decentralizes permissions and does not enforce the principle of least privilege as effectively as the centralized role approach.

Answer

Grant s3:ListBucket and s3:GetObject to all IAM users in the account

Answer

Use an SCP to allow access to the bucket for all accounts in the organization

Answer

Use an IAM role in each account with a bucket policy allowing the role

Question 10

Which TWO actions can be used to restrict access to an S3 bucket to only users who authenticate using multi-factor authentication (MFA)? (Choose TWO.)

Accepted Answer

Use pre-signed URLs with MFA credentials. Option B is correct because pre-signed URLs generated with MFA-authenticated credentials inherit the MFA session context, so only requests using those MFA-backed temporary credentials can access the object. Option E is correct because an S3 bucket policy can include a Condition block testing the aws:MultiFactorAuthPresent key (for example, "Condition": {"Bool": {"aws:MultiFactorAuthPresent": "true"}}), which denies any request not made with an MFA-verified session. Option A is wrong because CloudTrail is only an auditing/logging service and cannot enforce or deny access. Option C is wrong because S3 ACLs grant only basic READ/WRITE/READ_ACP permissions and have no MFA condition capability. Option D is wrong because an IAM identity policy condition on aws:MultiFactorAuthPresent alone does not restrict access to the S3 bucket for other principals; the resource-based bucket policy (Option E) is what enforces the restriction on the bucket itself.

Answer

Use AWS CloudTrail to log requests and deny those without MFA

Answer

Set an S3 bucket ACL that requires MFA

Answer

Add a condition in the IAM policy that checks aws:MultiFactorAuthPresent is true

Question 11

Which THREE statements about IAM roles are correct? (Choose THREE.)

Accepted Answer

IAM roles can be used by federated users.. The correct answers are A, D, and E. IAM roles can be used by federated users (A), can be assumed by AWS services (D), and are global entities not tied to a specific region (E). Option B is incorrect because IAM roles are commonly used for cross-account access. Option C is incorrect because roles are not attached to IAM users directly; instead, users assume roles.

Answer

IAM roles cannot be used for cross-account access.

Answer

IAM roles can be attached to an IAM user.

Question 12

Which TWO IAM policy conditions can be used to enforce that API calls originate from a specific AWS region? (Choose TWO.)

Accepted Answer

aws:SourceIp. Option C (aws:SourceIp) is correct because it lets you restrict API calls to specific IP address ranges (e.g., the CIDR blocks associated with a given AWS region), so requests from outside those ranges are denied. Option D (aws:RequestedRegion) is correct because it evaluates the region that the request is targeting for the service endpoint, allowing you to enforce that calls are made only to a specific AWS region. Option A (ec2:Region) is not a valid global IAM condition key for this purpose, and it is service-specific rather than a general region-enforcement condition. Option B (aws:UserAgent) only inspects the caller's user agent string and cannot reliably enforce a source region. Option E (aws:Region) is not a real IAM condition key; the correct global key for the target region is aws:RequestedRegion.

Answer

ec2:Region

Answer

aws:UserAgent

Answer

aws:Region

Question 13

A company wants to allow a third-party auditor to read objects in an S3 bucket for a limited time. The auditor does not have an AWS account. What is the most secure way to grant this access?

Accepted Answer

Generate presigned URLs for all objects in the bucket and share them with the auditor.. Presigned URLs grant time-limited access to individual objects without requiring the auditor to have an AWS account or long-term credentials. This is the most secure method for a third party without an AWS account. Option C is incorrect because the auditor does not have an AWS account, so they cannot assume a cross-account IAM role. Option A is wrong because the auditor has no AWS account. Option D is wrong because sharing IAM user credentials is a security risk and not recommended.

Answer

Use a bucket policy that grants read access to the auditor's AWS account (if they have one).

Answer

Create a cross-account IAM role with an external ID and allow the auditor to assume the role using AWS STS.

Answer

Create an IAM user with read-only access and share the credentials with the auditor.

Question 14

A company uses AWS Organizations and wants to restrict all IAM users in member accounts from using the Amazon EC2 RunInstances API unless they have MFA. What is the most efficient way to enforce this?

Accepted Answer

Create a service control policy (SCP) that denies ec2:RunInstances unless MFA is present, and attach it to the organization root or relevant OUs.. A service control policy (SCP) in AWS Organizations is the most efficient way to enforce a permission guardrail across all member accounts. By creating an SCP that denies ec2:RunInstances unless the request is made with MFA, and attaching it to the organization root or relevant OUs, the restriction applies to all IAM users in all member accounts without needing to modify individual IAM policies. SCPs define the maximum permissions for accounts and are evaluated before IAM policies.

Answer

Create an IAM policy in each member account and attach it to all IAM users.

Answer

Use a security group to block outbound traffic from EC2 instances unless MFA is used.

Answer

Attach a policy to the root user of the master account.

Question 15

An administrator is troubleshooting an issue where an IAM user cannot launch an EC2 instance in a specific VPC. The user has the AmazonEC2FullAccess policy attached. What is the most likely cause?

Accepted Answer

The user's permissions boundary blocks EC2 actions.. The most likely cause is that the user's permissions boundary blocks EC2 actions, specifically by not allowing ec2:RunInstances for the specified VPC. Permissions boundaries can include conditions that restrict actions to certain resources, such as a specific VPC. Since the user has AmazonEC2FullAccess, which allows all EC2 actions, a permissions boundary can limit these permissions. Option B is incorrect because account limits are not specific to a single VPC. Option C is incorrect because VPCs do not support resource-based IAM policies; IAM policies cannot be attached directly to a VPC. Option D is incorrect because key pair ownership does not affect the ability to launch an instance in a specific VPC.

Answer

The user has exceeded the maximum number of EC2 instances allowed.

Answer

The VPC has an IAM policy attached that denies the ec2:RunInstances action.

Answer

The key pair specified is not owned by the user.