SCS-C02 Identity and Access Management Practice Test 4 — 15 Questions

Question 1

A security engineer notices that an IAM role for an EC2 instance has a policy that allows s3:PutObject on a bucket. However, the application reports access denied when trying to upload. The bucket policy does not explicitly deny access. What is a likely cause?

Accepted Answer

The bucket policy denies access. Option B is correct because the bucket policy may explicitly deny access, which overrides allows. Option A is wrong because missing permissions would cause implicit deny. Option C is wrong because instance profile is just a container. Option D is wrong because condition keys not matching would cause deny.

Answer

The instance profile is not attached to the EC2 instance

Answer

The role's policy does not include s3:PutObject

Answer

The policy condition key does not match the request context

Question 2

A company uses AWS IAM Identity Center (AWS SSO) to manage access. A user is assigned to a permission set that grants AdministratorAccess. However, when the user tries to access the AWS console, they receive an error that they are not authorized. What is a possible reason?

Accepted Answer

The user is not assigned to the AWS account in Identity Center. Option A is correct because the user may not have been granted access to the specific account. Option B is wrong because permission set is sufficient. Option C is wrong because MFA might be required but not the only cause. Option D is wrong because the user might not have AWS credentials to manage permission sets.

Answer

The user has not set up MFA

Answer

The permission set does not include the necessary policies

Answer

The user does not have permissions to manage permission sets

Question 3

A security engineer needs to ensure that an IAM role can be assumed only from a specific VPC. Which IAM policy condition key should be used?

Accepted Answer

aws:SourceVpc. Option B is correct because aws:SourceVpc restricts requests to originate from a specific VPC. Option A is wrong because aws:SourceIp is for IP addresses. Option C is wrong because aws:VpcSourceIp is not a condition key. Option D is wrong because aws:RequestedRegion is for region.

Answer

aws:RequestedRegion

Answer

aws:VpcSourceIp

Answer

aws:SourceIp

Question 4

A company uses IAM roles for cross-account access. Developers in Account A need to assume a role in Account B. What must be true for the AssumeRole call to succeed?

Accepted Answer

The role's trust policy must allow Account A and the user must have sts:AssumeRole permission. Option D is correct because the trust policy in Account B must allow Account A, and the user in Account A must have sts:AssumeRole permission. Option A is wrong because an SCP in Account A might allow it. Option B is wrong because MFA is not required. Option C is wrong because the role exists.

Answer

Account A must have an SCP that allows sts:AssumeRole

Answer

The user in Account A must have MFA enabled

Answer

The role in Account B must have a permissions boundary

Question 5

Which TWO of the following are valid IAM policy condition keys? (Choose TWO.)

Accepted Answer

aws:RequestedRegion. The `aws:RequestedRegion` condition key is valid and used to restrict access to specific AWS Regions. It evaluates the Region endpoint that the API request is sent to, allowing you to enforce that actions can only be performed in designated Regions, such as us-east-1 or eu-west-2.

Answer

aws:RequestedService

Answer

aws:PrincipalService

Answer

aws:SourceArn

Question 6

Which THREE of the following are best practices for managing IAM access keys? (Choose THREE.)

Accepted Answer

Use IAM roles for EC2 instances instead of access keys. Options A, B, and D are best practices. Option C is not a best practice because access keys should be rotated, not kept indefinitely. Option E is incorrect because access keys should not be embedded in code; use roles instead.

Answer

Use long-lived access keys for applications

Answer

Embed access keys in application code for convenience

Question 7

Which TWO of the following are valid use cases for IAM permissions boundaries? (Choose TWO.)

Accepted Answer

To prevent an IAM user from escalating privileges. Options A and D are valid uses. Option B is incorrect because permissions boundaries don't delegate administration. Option C is incorrect because boundaries are applied to IAM entities, not resource-based policies. Option E is incorrect because cross-account access is governed by trust policies, not boundaries.

Answer

To allow cross-account access to an S3 bucket

Answer

To delegate permission management to non-administrators

Answer

To restrict access to an S3 bucket based on IP address

Question 8

A security engineer attaches this policy to an IAM user. The user tries to download an object from the bucket from an IP address 10.1.0.5. What will happen?

Accepted Answer

The user will be denied access because the condition does not match. Option C is correct because the condition restricts access to IPs in 10.0.0.0/16, and 10.1.0.5 is not in that range. Option A is wrong because the condition is not satisfied. Option B is wrong because there is no explicit deny. Option D is wrong because the policy is valid.

Answer

The user will be allowed access because the policy allows s3:GetObject

Answer

The policy is invalid and will cause an error

Answer

The user will be denied access because there is an explicit deny

Question 9

A security engineer reviews the trust policy of an IAM role. Which accounts can assume this role?

Accepted Answer

Account 111111111111. Option B is correct because the principal is the root user of account 111111111111, meaning any IAM user or role from that account with sts:AssumeRole permission can assume the role. Option A is wrong because it's not any AWS account. Option C is wrong because only account 111111111111. Option D is wrong because the IAM user's root account is 111111111111, not 123456789012.

Answer

Only the root user of account 123456789012

Answer

Account 123456789012

Answer

Any AWS account

Question 10

A developer creates this CloudFormation stack. An EC2 instance with this role tries to list objects in the bucket. What will happen?

Accepted Answer

The instance can list the bucket but not the objects. Option A is correct because the policy only allows s3:ListBucket, which lists the bucket itself, not its objects. s3:ListObjects is required to list objects. Option B is wrong because s3:GetObject is for reading objects. Option C is wrong because s3:PutObject is for uploading. Option D is wrong because the role can assume.

Answer

The instance cannot assume the role because the principal is ec2.amazonaws.com

Answer

The instance can upload objects to the bucket

Answer

The instance can list objects in the bucket

Question 11

A security engineer is reviewing an AWS account and notices that multiple IAM users have full administrative access. The company policy requires that users have only the permissions necessary to perform their job. What is the MOST secure and efficient way to enforce this policy?

Accepted Answer

Use an IAM group for each job function, attach appropriate managed policies to the group, and add users to the group.. Using IAM groups and attaching managed policies to them allows centralized permission management and simplifies the principle of least privilege.

Answer

Create an IAM policy that denies all actions except those specifically allowed, and attach it to each user.

Answer

Use an SCP in AWS Organizations to deny all actions by default.

Answer

Assign an inline policy to each user that specifies allowed actions.

Question 12

A company uses an IAM role to allow an EC2 instance to access an S3 bucket. The security team wants to ensure that if the EC2 instance is compromised, the attacker cannot use the role credentials to access resources outside the account. What should the security team do?

Accepted Answer

Attach a permissions boundary to the IAM role that limits access to only the required S3 bucket.. Using a permissions boundary restricts the maximum permissions the role can have, limiting the impact of a compromised instance.

Answer

Store the role credentials in AWS Secrets Manager and rotate them frequently.

Answer

Use an instance profile with a short-lived session token.

Answer

Use an SCP to deny all actions except S3 access for the role.

Question 13

A developer needs to grant an IAM user temporary access to an S3 bucket for 15 minutes. Which AWS service should be used to generate temporary credentials?

Accepted Answer

AWS Security Token Service (STS). AWS STS is used to request temporary, limited-privilege credentials for IAM users or federated users.

Answer

AWS Certificate Manager (ACM)

Answer

AWS Key Management Service (KMS)

Answer

AWS Directory Service

Question 14

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that no IAM user in any account can create or modify IAM roles. What is the MOST effective way to enforce this?

Accepted Answer

Create an SCP that denies iam:CreateRole and iam:UpdateAssumeRolePolicy and attach it to the root organizational unit.. A service control policy (SCP) can be applied to the root organizational unit to deny the specified actions across all accounts.

Answer

Use AWS Config rules to detect role creation and automatically delete the roles.

Answer

Set up a Lambda function that monitors CloudTrail and revokes role creation permissions.

Answer

Create an IAM policy that denies role creation and attach it to each user in every account.

Question 15

A company wants to allow its employees to authenticate to the AWS Management Console using their existing corporate credentials. Which AWS service should be used to integrate with the company's identity provider?

Accepted Answer

AWS IAM Identity Center (AWS SSO). AWS IAM Identity Center (formerly AWS SSO) is the correct service because it is specifically designed to enable single sign-on (SSO) from an external identity provider (IdP) to AWS accounts and business applications. It supports federation via SAML 2.0 or OIDC, allowing employees to authenticate using their existing corporate credentials and then access the AWS Management Console without needing separate IAM users.

Answer

AWS Secrets Manager

Answer

AWS Directory Service for Microsoft Active Directory

Answer

AWS Certificate Manager