SCS-C02 Identity and Access Management Practice Test 4 — 15 Questions

Question 1

A company wants to grant a set of developers the ability to launch EC2 instances but only in a specific subnet. Which THREE steps should be taken?

Accepted Answer

Add a condition to the policy that restricts the subnet ID using ec2:Subnet.. Option E is correct because the developers need an IAM role whose policy grants the ec2:RunInstances action, which is the API call required to launch EC2 instances. Option B is correct because the policy must include a condition key such as ec2:Subnet (or the aws:RequestTag/ec2:Subnet condition) to restrict instance launches to the specific subnet ID, enforcing least privilege. Option C is correct because the developers must be allowed to assume that role, either through the role's trust policy specifying their principal or through an IAM policy granting sts:AssumeRole. Option A is incorrect because a VPC endpoint for EC2 is not required to launch instances and does not control authorization. Option D is incorrect because a security group controls network traffic to and from instances, not the permission to launch them in a subnet.

Answer

Create a VPC endpoint for EC2.

Answer

Configure a security group to allow outbound traffic from the subnet.

Question 2

A company has an S3 bucket that contains sensitive data. The security team wants to ensure that all objects uploaded to the bucket are encrypted at rest using server-side encryption with AWS KMS (SSE-KMS). What should the security team do to enforce this requirement?

Accepted Answer

Use an S3 bucket policy with a condition that denies PutObject if the x-amz-server-side-encryption header is not set to 'aws:kms'.. To enforce SSE-KMS encryption on all uploaded objects, the security team should use an S3 bucket policy that explicitly denies PutObject requests when the x-amz-server-side-encryption header is not set to 'aws:kms'. This ensures that any upload without the required encryption header is rejected, effectively enforcing the requirement at the API level. This is the standard AWS pattern for mandatory encryption enforcement.

Answer

Use an S3 bucket policy that requires the x-amz-server-side-encryption-aws-kms-key-id header to match a specific KMS key.

Answer

Use an S3 bucket policy with a condition that requires the x-amz-server-side-encryption header to be present.

Answer

Configure the bucket's default encryption to use SSE-KMS.

Question 3

A company wants to allow cross-account access to an S3 bucket in Account A for a user in Account B. What is the correct combination of steps?

Accepted Answer

Add a bucket policy in Account A allowing access to the user in Account B, and attach an IAM policy to the user in Account B allowing access to the bucket.. Cross-account access to an S3 bucket requires two key permissions: a resource-based policy (bucket policy) in the owning account (Account A) that grants access to the specific IAM user in Account B, and an identity-based policy (IAM policy) attached to that user in Account B that permits the necessary S3 actions. Option A correctly describes this combination. Option D grants the bucket policy to the entire Account B, which may work but is less secure and not the recommended least-privilege approach; furthermore, the bucket policy to 'Account B' alone does not grant access to a specific user unless accompanied by the correct IAM policy, but the phrasing is ambiguous and not as precise as Option A. Option B suggests using an IAM role in Account A, which would require the user to assume the role, a different pattern not matching the question's scenario. Option C is incorrect because the user in Account B must have an explicit IAM policy; the bucket policy alone is insufficient.

Answer

Create an IAM role in Account A with access to the bucket, and have the user in Account B assume that role.

Answer

Add a bucket policy in Account A allowing access to Account B, and no action is needed in Account B because the user already has permissions.

Answer

Add a bucket policy in Account A allowing access to Account B, and attach an IAM policy to the user in Account B allowing access to the bucket.

Question 4

A company uses AWS Organizations and wants to restrict all IAM users in all accounts from using the AWS Management Console. What is the most effective way to achieve this?

Accepted Answer

Create an SCP with a condition that denies access if the user is signing in using the AWS Management Console.. An SCP with a condition such as aws:ViaAWSService or a console-sign-in condition (e.g., denying when the principal uses the console) applied at the organization root or OUs blocks console access for all IAM users across every account, which is the broadest and most effective control in AWS Organizations. SCPs are the right tool because they set the maximum permissions for all principals in member accounts and can enforce this uniformly. Option B is ineffective because a strong password policy only changes password complexity, not whether console sign-in is allowed. Option C only blocks creation of new console login profiles via iam:CreateLoginProfile, leaving existing console-enabled users able to sign in. Option D is unrelated because denying a specific region condition does not prevent console authentication or use of the console in other regions.

Answer

Set an IAM password policy that requires strong passwords.

Answer

Create a service control policy (SCP) that denies the 'iam:CreateLoginProfile' action and attach it to all accounts.

Answer

Create an SCP that denies the 'aws:RequestedRegion' condition for us-east-1.

Question 5

Which TWO actions are valid ways to grant an IAM user in Account A access to an S3 bucket in Account B? (Choose 2.)

Accepted Answer

Add a bucket policy in Account B that grants access to the user's ARN in Account A.. Option B is correct because a cross-account S3 access can be granted directly by attaching a bucket policy on the bucket in Account B that names the IAM user's ARN from Account A as Principal, which authorizes that external principal to access the bucket. Option D is correct because the standard cross-account pattern is to create an IAM role in Account B with a trust policy allowing the Account A user (or account) to assume it, and a permissions policy granting S3 access; the user then calls sts:AssumeRole and uses temporary credentials. Option A is not valid on its own because an identity policy in Account A cannot grant access to a resource in Account B unless Account B's bucket policy also trusts that principal. Option C is wrong because SCPs only restrict/allow maximum permissions for principals within the organization account where they are applied and cannot grant cross-account access to an external user. Option E is wrong because IAM policies are attached to identities or roles, not to S3 buckets; bucket-level permissions must be expressed as a bucket policy (or ACL), not an 'IAM policy on the bucket.'

Answer

Attach an IAM policy to the user in Account A that allows access to the S3 bucket.

Answer

Use a service control policy (SCP) in Account B to allow access from Account A.

Answer

Add an IAM policy to the S3 bucket in Account B granting access to the user.

Question 6

A company has a multi-account AWS Organizations setup with a central security account (Account ID: 111122223333) and several member accounts. The security team uses AWS CloudTrail to log all API calls across accounts and stores the logs in an S3 bucket (my-cloudtrail-bucket) in the security account. The team wants to allow the security team members (IAM users in the security account) to access the CloudTrail logs, while denying access to all other users in the organization, including the root user of the security account. The security team has attached the following IAM policy to the IAM group containing the security team members:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-cloudtrail-bucket/*"
    }
  ]
}

However, a security team member reports that they are receiving an AccessDenied error when trying to download a log file. The bucket policy is as follows:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-cloudtrail-bucket/*",
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "false"
        }
      }
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::111122223333:root"
      },
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-cloudtrail-bucket/*"
    },
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": "arn:aws:s3:::my-cloudtrail-bucket/*",
      "Condition": {
        "StringNotEquals": {
          "aws:PrincipalAccount": "111122223333"
        }
      }
    }
  ]
}

What is the most likely reason for the AccessDenied error?

Accepted Answer

The bucket policy allows only the root user of the security account, not the IAM users.. The bucket policy includes an Allow statement for the root user of the security account (arn:aws:iam::111122223333:root), but this does not grant access to IAM users in that account. IAM users are not the root user, so the Allow statement does not apply to them. While the IAM policy allows s3:GetObject, the bucket policy does not grant access to the IAM users, resulting in an implicit deny. Option A is incorrect because the Deny for non-111122223333 accounts does not affect users within the same account. Option B is incorrect because the SecureTransport condition only denies when HTTPS is not used; the error is not due to that condition. Option D is incorrect because the IAM policy does not have an explicit deny; it's an Allow. Therefore, the most likely reason is that the bucket policy only allows the root user, not IAM users.

Answer

The bucket policy denies access to all principals except those in account 111122223333, but the IAM users are in that account, so they are denied.

Answer

The bucket policy requires secure transport, and the security team member is not using HTTPS.

Answer

The IAM policy has an implicit deny because the security team members are not allowed to access S3.

Question 7

A company has an AWS Lambda function that processes messages from an Amazon SQS queue. The Lambda function is configured with an execution role that has the following IAM policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "sqs:ReceiveMessage",
        "sqs:DeleteMessage",
        "sqs:GetQueueAttributes"
      ],
      "Resource": "arn:aws:sqs:us-east-1:123456789012:MyQueue"
    },
    {
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents"
      ],
      "Resource": "*"
    }
  ]
}

The Lambda function is also configured with an SQS trigger that uses the same queue. The function code tries to send a message to an Amazon SNS topic, but the send fails with an AccessDenied error. What is the most likely cause?

Accepted Answer

The Lambda execution role does not have permissions to publish to SNS.. The correct answer. The Lambda function's execution role grants permissions for SQS and CloudWatch Logs but does not include any SNS actions (e.g., sns:Publish). Therefore, when the function attempts to send a message to an SNS topic, the request fails with an AccessDenied error. Option A is incorrect because an SQS queue policy cannot deny Lambda from calling SNS; SQS and SNS are separate services. Option C is incorrect because the SNS topic policy might allow or deny, but the primary issue is the missing IAM permission on the Lambda role. Option D is incorrect because SQS does not need configuration for Lambda to call SNS; the Lambda function makes the SNS call directly.

Answer

The SQS queue has a resource-based policy that denies the Lambda function from sending to SNS.

Answer

The SNS topic has a resource-based policy that denies the Lambda function.

Answer

The SQS queue is not configured to allow the Lambda function to send messages to SNS.

Question 8

A company wants to grant a Lambda function access to write logs to CloudWatch Logs in the same AWS account. What is the BEST practice for granting this permission?

Accepted Answer

Create an IAM role with a policy allowing logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents, and attach it to the Lambda function. Lambda functions assume an IAM execution role at runtime, and AWS SDK calls made from the function automatically use temporary credentials from that role via the instance metadata-style credential provider. Attaching a role with logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents grants the function exactly the permissions needed to write to CloudWatch Logs without embedding any long-lived secrets. This is the AWS-recommended best practice for all compute services that support IAM roles.

Answer

Store AWS access keys in the Lambda environment variables

Answer

Add a resource-based policy to the Lambda function to allow CloudWatch Logs to write logs

Answer

Use the AWS account root user credentials directly in the Lambda function

Question 9

A security engineer notices that an IAM user, 'svc-backup', has full S3 access (s3:*) to all buckets. The engineer wants to restrict the user to only put objects into a specific bucket named 'mycompany-backup' and deny all other S3 actions. Which IAM policy should be attached?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","NotAction":"s3:PutObject","Resource":"*","Condition":{...}}]}. It uses Deny with NotAction to deny all S3 actions except s3:PutObject. This ensures that only PutObject is allowed, and any existing full S3 access policy will be overridden by the explicit Deny for all other actions. Option A is incorrect because it only allows PutObject without denying other actions; if the user has any other policy granting S3 access, those actions would still be permitted. Option C is incorrect because it allows all S3 actions on the specific bucket, granting more permissions than intended. Option D is incorrect because the explicit Deny on all S3 actions overrides the Allow for PutObject, resulting in denial of all S3 actions including PutObject.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:PutObject","Resource":"arn:aws:s3:::mycompany-backup/*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:*","Resource":"arn:aws:s3:::mycompany-backup/*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:PutObject","Resource":"arn:aws:s3:::mycompany-backup/*"},{"Effect":"Deny","Action":"s3:*","Resource":"*"}]}

Question 10

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all IAM users in the member accounts must have multi-factor authentication (MFA) enabled to access the AWS Management Console. Which approach should be used?

Accepted Answer

Attach an SCP to the root OU that denies all AWS actions unless the request includes MFA authentication. An SCP attached to the root OU that denies all actions unless the request is made with MFA (using the aws:MultiFactorAuthPresent condition key) enforces MFA across all member accounts centrally. SCPs are the only mechanism in AWS Organizations that can enforce such a guardrail across multiple accounts. This approach ensures that even if an IAM user has permissions, they cannot perform actions without MFA.

Answer

Use AWS Config rules to detect users without MFA and automatically disable their access

Answer

Create an IAM policy in each account that allows console access only if MFA is present and attach it to all users

Answer

Attach an SCP to the root OU that adds an IAM policy requiring MFA to all users

Question 11

A security engineer needs to allow an IAM user to rotate their own access keys. Which TWO IAM actions must be allowed in the user's policy? (Choose TWO.)

Accepted Answer

iam:DeleteAccessKey. To rotate their own access keys, an IAM user must be able to create a new access key pair, which is granted by iam:CreateAccessKey (option E), and then remove the old key pair, which is granted by iam:DeleteAccessKey (option B); these two actions together complete the rotation cycle of replacing an old key with a new one. iam:GetAccessKeyLastUsed (option A) only reports the last-used timestamp and service of a key, which is useful for auditing but not required to perform rotation. iam:ListAccessKeys (option C) merely enumerates a user's access key IDs and is not strictly required for the create-and-delete rotation workflow. iam:UpdateAccessKey (option D) only changes a key's status between Active and Inactive, which is a deactivation step rather than the creation or deletion needed to rotate keys.

Answer

iam:GetAccessKeyLastUsed

Answer

iam:ListAccessKeys

Answer

iam:UpdateAccessKey

Question 12

A company has an S3 bucket that contains sensitive data. The security team wants to enforce that all access to the bucket must use HTTPS and that requests originating from outside the corporate network (as defined by a specific IP range 203.0.113.0/24) must be denied. Which THREE conditions should be included in the S3 bucket policy? (Choose THREE.)

Accepted Answer

"Condition": {"Bool": {"aws:SecureTransport": "true"}}. Options C, D, and E are correct. Option C uses the `aws:SecureTransport` condition to enforce HTTPS, which matches the requirement to deny non-HTTPS requests. Option D is a complete Deny statement with the `NotIpAddress` condition specifying the corporate IP range; this denies requests from outside that range. Option E is also correct as a condition element that, when used in a Deny statement, effectively denies requests from non-corporate IPs. Options A and B are incorrect: Option A uses `IpAddress` with the corporate range, which would only allow that range but not deny others; Option B uses `aws:Referer`, which checks the referrer header and not the source IP, thus not meeting the requirement.

Answer

"Condition": {"IpAddress": {"aws:SourceIp": "203.0.113.0/24"}}

Answer

"Condition": {"StringLike": {"aws:Referer": "https://corporate.internal/*"}}

Question 13

A company uses AWS KMS to encrypt objects in an S3 bucket. The security team wants to ensure that only users with the appropriate KMS key permissions can decrypt objects. Which TWO conditions should be included in the S3 bucket policy to enforce this? (Choose TWO.)

Accepted Answer

"Condition": {"StringEquals": {"kms:ViaService": "s3.us-east-1.amazonaws.com"}}. Option A is correct because the kms:ViaService condition key restricts KMS key usage to requests that come through the specified AWS service endpoint, here s3.us-east-1.amazonaws.com, ensuring the key can only be used via S3 in that Region and not through direct KMS API calls. Option E is correct because kms:EncryptionContext with the aws:s3:arn key binds the KMS operation to the specific S3 object ARN, so decryption is only permitted when the encryption context matches the intended object, adding a strong integrity and scope control. Together, these conditions enforce that only principals with the right KMS key permissions, using S3 in the correct Region and targeting the correct object, can decrypt. Option B is not correct because kms:KeySpec is not a valid condition key for restricting decrypt permissions in an S3 bucket policy. Option C duplicates Option A and is not a separate valid answer. Option D is not correct because kms:GranteePrincipal is not a supported condition key for this purpose and cannot restrict decryption to a specific IAM role in this way.

Answer

"Condition": {"StringEquals": {"kms:KeySpec": "SYMMETRIC_DEFAULT"}}

Answer

"Condition": {"StringEquals": {"kms:ViaService": "s3.us-east-1.amazonaws.com"}}

Answer

"Condition": {"StringEquals": {"kms:GranteePrincipal": "arn:aws:iam::123456789012:role/Admin"}}

Question 14

An administrator runs the AWS CLI command shown in the exhibit. What does this command do?

Accepted Answer

Lists the managed policies attached to the role 'MyRole'. The AWS CLI command shown (likely 'aws iam list-attached-role-policies --role-name MyRole') lists the managed policies attached to the specified IAM role. This command returns only managed policies, not inline policies. Therefore, it lists the managed policies attached to the role 'MyRole'.

Answer

Lists all IAM policies in the account

Answer

Lists the managed policies attached to the user 'MyRole'

Answer

Lists all inline policies attached to the role 'MyRole'

Question 15

A company runs a multi-tier web application on AWS. The application consists of an Application Load Balancer (ALB) that distributes traffic to a fleet of EC2 instances in an Auto Scaling group. The EC2 instances need to read from an Amazon RDS MySQL database and write logs to an S3 bucket. The security team wants to ensure that the EC2 instances have only the minimum required permissions. Currently, the EC2 instances are launched with an IAM role that has an attached policy allowing full S3 access (s3:*) and full RDS access (rds:*). The security team has identified that this is overly permissive and wants to restrict access to only the specific resources needed. Additionally, the team wants to ensure that the EC2 instances can only access the RDS database using SSL/TLS. Which combination of actions should the security team take?

Accepted Answer

Update the IAM role to have two policies: one that allows s3:PutObject on the specific S3 bucket with a prefix, and another that allows rds:Connect on the specific RDS instance ARN with a condition requiring rds:ForceSsl. Also, ensure the RDS instance requires SSL.. The correct approach is to scope the IAM role's policies to the specific S3 bucket/prefix and the specific RDS instance ARN, and to enforce SSL/TLS by adding a condition such as aws:SecureTransport or rds:ForceSsl, while also configuring the RDS instance to require SSL. This applies least privilege at the resource level and enforces encryption in transit, meeting both security requirements. It keeps the instance profile (role) model, which is the AWS best practice for EC2 credentials.

Answer

Remove the IAM role from the EC2 instances and instead use resource-based policies on the S3 bucket and RDS instance to grant access to the EC2 instances' VPC or subnet.

Answer

Create an IAM user with the required permissions, generate access keys, and store them in a secure S3 bucket. Have the EC2 instances retrieve the credentials at startup using an instance profile.

Answer

Create a single IAM policy that allows s3:PutObject on the specific bucket and rds:Connect on the specific RDS instance without any conditions. Attach it to the IAM role.