SCS-C02 Identity and Access Management Practice Test 4 — 15 Questions

Question 1

A company uses AWS Organizations and wants to restrict all IAM users in member accounts from using the Amazon EC2 RunInstances API unless they have MFA. What is the most efficient way to enforce this?

Accepted Answer

Create a service control policy (SCP) that denies ec2:RunInstances unless MFA is present, and attach it to the organization root or relevant OUs.. A service control policy (SCP) can centrally enforce restrictions across all accounts in the organization, denying ec2:RunInstances unless MFA is present. Option A is incorrect because managing policies per account is inefficient. Option B is incorrect because security groups only control network traffic, not API calls. Option D is incorrect because the root user policy does not affect member account IAM users.

Answer

Create an IAM policy in each member account and attach it to all IAM users.

Answer

Use a security group to block outbound traffic from EC2 instances unless MFA is used.

Answer

Attach a policy to the root user of the master account.

Question 2

An administrator is troubleshooting an issue where an IAM user cannot launch an EC2 instance in a specific VPC. The user has the AmazonEC2FullAccess policy attached. What is the most likely cause?

Accepted Answer

The user's permissions boundary blocks EC2 actions.. The most likely cause is that the user's permissions boundary blocks EC2 actions, specifically by not allowing ec2:RunInstances for the specified VPC. Permissions boundaries can include conditions that restrict actions to certain resources, such as a specific VPC. Since the user has AmazonEC2FullAccess, which allows all EC2 actions, a permissions boundary can limit these permissions. Option B is incorrect because account limits are not specific to a single VPC. Option C is incorrect because VPCs do not support resource-based IAM policies; IAM policies cannot be attached directly to a VPC. Option D is incorrect because key pair ownership does not affect the ability to launch an instance in a specific VPC.

Answer

The user has exceeded the maximum number of EC2 instances allowed.

Answer

The VPC has an IAM policy attached that denies the ec2:RunInstances action.

Answer

The key pair specified is not owned by the user.

Question 3

A company uses AWS SSO to manage access to multiple accounts. An employee leaves the company. What is the most efficient way to revoke all AWS access for that employee?

Accepted Answer

Deactivate the user in the connected identity provider (e.g., Active Directory).. The most efficient way to revoke all AWS access for a former employee is to deactivate the user in the connected identity provider (e.g., Active Directory). AWS SSO relies on the external IdP for authentication; once the user is deactivated there, they cannot authenticate to AWS SSO, and all active SSO sessions are invalidated. This single action immediately blocks access across all accounts and applications federated through AWS SSO, without needing to touch individual IAM roles or accounts.

Answer

Delete the corresponding IAM user in every AWS account.

Answer

Remove the user from all groups in AWS SSO.

Answer

Delete the IAM role that the user assumes in each account.

Question 4

A security engineer is troubleshooting an issue where an IAM policy allows access to S3 but the user is denied access to a specific bucket. The policy has the following statement:

{
  "Effect": "Allow",
  "Action": "s3:*",
  "Resource": "*"
}

What is the most likely cause of the denial?

Accepted Answer

An explicit deny statement in a different policy (e.g., SCP, permissions boundary) is overriding the allow.. An explicit deny in a separate policy (e.g., service control policy, permissions boundary, or another IAM policy) overrides any allow. Even though the user's policy allows s3:* on all resources, an explicit deny for that specific bucket will deny access. Option A is incorrect because AWS does not automatically deny access to specific buckets based on broad policies. Option C is incorrect because the bucket policy could deny access, but that is not the 'most likely' cause given the IAM allow; an explicit deny in an SCP or permissions boundary is more common in troubleshooting. Option D is incorrect because assuming a role would replace the user's permissions, but the scenario does not indicate role assumption.

Answer

The policy statement is too broad and AWS automatically denies access to specific buckets.

Answer

The S3 bucket has a bucket policy that denies access to the user.

Answer

The policy is attached to the user but the user is assuming a role that does not have S3 permissions.

Question 5

An application running on an EC2 instance needs to access an S3 bucket. What is the most secure way to grant the EC2 instance the necessary permissions?

Accepted Answer

Create an IAM role with the necessary S3 permissions and attach it to the EC2 instance as an instance profile.. The most secure way to grant permissions to an EC2 instance is to use an IAM role attached as an instance profile. This avoids hardcoding credentials in the instance, which is a security risk. Option A correctly describes this approach. Option B is less secure because encrypted files still require managing encryption keys. Option C is insecure because credentials in code can be exposed. Option D is not suitable because bucket policies based on IP can be spoofed and do not provide fine-grained access control.

Answer

Store the credentials in an encrypted file on the EC2 instance and decrypt them at runtime.

Answer

Store the AWS access key and secret key in the application code.

Answer

Use an S3 bucket policy that allows access from the EC2 instance's public IP address.

Question 6

A company wants to grant an IAM user the ability to rotate their own access keys. What is the least privileged IAM policy that allows this?

Accepted Answer

A policy with Action: 'iam:CreateAccessKey', 'iam:DeleteAccessKey', 'iam:UpdateAccessKey' and Resource: 'arn:aws:iam::*:user/${aws:username}'. It grants only the specific actions required to rotate access keys (CreateAccessKey, DeleteAccessKey, UpdateAccessKey) and restricts the resource to the user's own path using the ${aws:username} variable. This ensures the IAM user can only manage their own keys, adhering to the least privilege principle.

Answer

A policy with Action: 'iam:*AccessKey*' and Resource: 'arn:aws:iam::*:user/*'

Answer

A policy with Action: 'iam:ListAccessKeys' and 'iam:GetAccessKeyLastUsed' and Resource: '*'

Answer

A policy with Action: 'iam:*' and Resource: '*'

Question 7

A company uses AWS Organizations and wants to restrict all IAM users in all accounts from using the AWS Management Console. What is the most effective way to achieve this?

Accepted Answer

Create an SCP with a condition that denies access if the user is signing in using the AWS Management Console.. A service control policy (SCP) with a condition that denies access when the user is signing in via the AWS Management Console can be applied at the organizational level to restrict all IAM users across all accounts. Option B is incorrect because an IAM password policy only sets password requirements; it does not prevent users from signing in to the console. Option C is incorrect because an SCP that denies iam:CreateLoginProfile would only stop new login profile creation; existing users with login profiles could still access the console. Additionally, SCPs cannot be overridden by account administrators. Option D is incorrect because restricting a region does not block console access; users could still sign in to the console in other regions.

Answer

Set an IAM password policy that requires strong passwords.

Answer

Create a service control policy (SCP) that denies the 'iam:CreateLoginProfile' action and attach it to all accounts.

Answer

Create an SCP that denies the 'aws:RequestedRegion' condition for us-east-1.

Question 8

A company has a multi-account AWS Organizations setup with a central security account (Account ID: 111122223333) and several member accounts. The security team uses AWS CloudTrail to log all API calls across accounts and stores the logs in an S3 bucket (my-cloudtrail-bucket) in the security account. The team wants to allow the security team members (IAM users in the security account) to access the CloudTrail logs, while denying access to all other users in the organization, including the root user of the security account. The security team has attached the following IAM policy to the IAM group containing the security team members:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-cloudtrail-bucket/*"
    }
  ]
}

However, a security team member reports that they are receiving an AccessDenied error when trying to download a log file. The bucket policy is as follows:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-cloudtrail-bucket/*",
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "false"
        }
      }
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::111122223333:root"
      },
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-cloudtrail-bucket/*"
    },
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": "arn:aws:s3:::my-cloudtrail-bucket/*",
      "Condition": {
        "StringNotEquals": {
          "aws:PrincipalAccount": "111122223333"
        }
      }
    }
  ]
}

What is the most likely reason for the AccessDenied error?

Accepted Answer

The bucket policy allows only the root user of the security account, not the IAM users.. The bucket policy includes an Allow statement for the root user of the security account (arn:aws:iam::111122223333:root), but this does not grant access to IAM users in that account. IAM users are not the root user, so the Allow statement does not apply to them. While the IAM policy allows s3:GetObject, the bucket policy does not grant access to the IAM users, resulting in an implicit deny. Option A is incorrect because the Deny for non-111122223333 accounts does not affect users within the same account. Option B is incorrect because the SecureTransport condition only denies when HTTPS is not used; the error is not due to that condition. Option D is incorrect because the IAM policy does not have an explicit deny; it's an Allow. Therefore, the most likely reason is that the bucket policy only allows the root user, not IAM users.

Answer

The bucket policy denies access to all principals except those in account 111122223333, but the IAM users are in that account, so they are denied.

Answer

The bucket policy requires secure transport, and the security team member is not using HTTPS.

Answer

The IAM policy has an implicit deny because the security team members are not allowed to access S3.

Question 9

A security engineer notices that an IAM user, 'svc-backup', has full S3 access (s3:*) to all buckets. The engineer wants to restrict the user to only put objects into a specific bucket named 'mycompany-backup' and deny all other S3 actions. Which IAM policy should be attached?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","NotAction":"s3:PutObject","Resource":"*","Condition":{...}}]}. It uses Deny with NotAction to deny all S3 actions except s3:PutObject. This ensures that only PutObject is allowed, and any existing full S3 access policy will be overridden by the explicit Deny for all other actions. Option A is incorrect because it only allows PutObject without denying other actions; if the user has any other policy granting S3 access, those actions would still be permitted. Option C is incorrect because it allows all S3 actions on the specific bucket, granting more permissions than intended. Option D is incorrect because the explicit Deny on all S3 actions overrides the Allow for PutObject, resulting in denial of all S3 actions including PutObject.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:PutObject","Resource":"arn:aws:s3:::mycompany-backup/*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:*","Resource":"arn:aws:s3:::mycompany-backup/*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:PutObject","Resource":"arn:aws:s3:::mycompany-backup/*"},{"Effect":"Deny","Action":"s3:*","Resource":"*"}]}

Question 10

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all IAM users in the member accounts must have multi-factor authentication (MFA) enabled to access the AWS Management Console. Which approach should be used?

Accepted Answer

Attach an SCP to the root OU that denies all AWS actions unless the request includes MFA authentication. A Service Control Policy (SCP) attached to the root OU can deny all actions unless the request includes MFA authentication, effectively enforcing MFA across all accounts in the organization. Option A is incorrect because AWS Config rules can detect non-compliance but cannot automatically disable access or enforce MFA at the time of access. Option C is incorrect because attaching an IAM policy requiring MFA to all users in each account is not centrally managed and could be cumbersome; also, it does not prevent users from bypassing the policy if they have other permissions. Option D is incorrect because SCPs are permission boundaries and cannot attach IAM policies to users; they can only deny or allow actions based on conditions.

Answer

Use AWS Config rules to detect users without MFA and automatically disable their access

Answer

Create an IAM policy in each account that allows console access only if MFA is present and attach it to all users

Answer

Attach an SCP to the root OU that adds an IAM policy requiring MFA to all users

Question 11

An IAM policy allows a user to pass a specific role and launch EC2 instances. The user tries to launch an EC2 instance with the role 'ec2-full-access' but receives an error: 'You are not authorized to perform iam:PassRole'. What is the MOST likely cause?

Accepted Answer

The user is attempting to pass a role with an ARN that does not exactly match the one in the policy. The error 'You are not authorized to perform iam:PassRole' indicates that the IAM policy does not allow the user to pass the role. The most likely cause is that the role ARN the user is trying to pass does not exactly match the ARN specified in the policy. Option A is incorrect because if the role didn't exist, the error would be different (e.g., 'The role does not exist'). Option C is incorrect because ec2:InstanceProfile is not a condition key for PassRole; it's a resource attribute. Option D is incorrect because the error is about PassRole, not RunInstances.

Answer

The role 'ec2-full-access' does not exist in the account

Answer

The policy is missing a condition key such as ec2:InstanceProfile

Answer

The user does not have permission to call ec2:RunInstances

Question 12

A company runs a multi-tier web application on AWS. The application consists of an Application Load Balancer (ALB) that distributes traffic to a fleet of EC2 instances in an Auto Scaling group. The EC2 instances need to read from an Amazon RDS MySQL database and write logs to an S3 bucket. The security team wants to ensure that the EC2 instances have only the minimum required permissions. Currently, the EC2 instances are launched with an IAM role that has an attached policy allowing full S3 access (s3:*) and full RDS access (rds:*). The security team has identified that this is overly permissive and wants to restrict access to only the specific resources needed. Additionally, the team wants to ensure that the EC2 instances can only access the RDS database using SSL/TLS. Which combination of actions should the security team take?

Accepted Answer

Update the IAM role to have two policies: one that allows s3:PutObject on the specific S3 bucket with a prefix, and another that allows rds:Connect on the specific RDS instance ARN with a condition requiring rds:ForceSsl. Also, ensure the RDS instance requires SSL.. By updating the IAM role with two separate policies, one for S3 and one for RDS, the permissions are scoped to the specific resources. The S3 policy allows s3:PutObject on the specific bucket and prefix, which is minimal for writing logs. The RDS policy allows rds:Connect on the specific RDS instance ARN and includes a condition requiring rds:ForceSsl to enforce SSL/TLS. Additionally, ensuring the RDS instance requires SSL matches the security team's requirement. Option A is incorrect because resource-based policies on S3 and RDS cannot grant access to EC2 instances directly without an IAM role; also, S3 bucket policies are not the appropriate method for EC2 instance access. Option B is incorrect because storing access keys in S3 is insecure and not a best practice; IAM roles with temporary credentials should be used. Option D is incorrect because it lacks the SSL enforcement condition and uses a single policy which might not be as clear but more importantly misses the SSL requirement.

Answer

Remove the IAM role from the EC2 instances and instead use resource-based policies on the S3 bucket and RDS instance to grant access to the EC2 instances' VPC or subnet.

Answer

Create an IAM user with the required permissions, generate access keys, and store them in a secure S3 bucket. Have the EC2 instances retrieve the credentials at startup using an instance profile.

Answer

Create a single IAM policy that allows s3:PutObject on the specific bucket and rds:Connect on the specific RDS instance without any conditions. Attach it to the IAM role.

Question 13

A company runs a critical application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application processes financial transactions and must store transaction logs in an Amazon S3 bucket. The security team requires that all API calls to AWS services are logged and that the logs are stored in a secure, tamper-proof manner. The team enables AWS CloudTrail to log management events and Amazon S3 server access logs for the S3 bucket. They also enable AWS Config to track resource changes. The compliance team wants to ensure that no one can disable CloudTrail logging or delete the CloudTrail log files. The security engineer proposes a solution using an SCP in AWS Organizations to deny actions that would disable CloudTrail or delete log files. However, the engineer is concerned that the SCP might be applied too broadly and affect legitimate administrative actions. The engineer wants to ensure that only the security team’s IAM role (SecurityAdminRole) can perform these restricted actions, while all other principals (including IAM users, roles, and the root user) are denied. The engineer creates an SCP that denies cloudtrail:StopLogging, cloudtrail:DeleteTrail, and s3:DeleteObject on the CloudTrail S3 bucket. The SCP includes a condition that allows the action if the principal is SecurityAdminRole. However, after applying the SCP, the security team finds that even SecurityAdminRole is unable to stop CloudTrail logging. What is the most likely cause of this issue?

Accepted Answer

The condition in the SCP is incorrectly scoped, causing the deny to apply to all principals including SecurityAdminRole.. The most likely cause is that the condition in the SCP is incorrectly scoped. SCPs deny by default; to allow only a specific role, you must explicitly exclude that role from the deny using a condition key like `aws:PrincipalArn` with a `StringNotEquals` operator. If the condition is misconfigured (e.g., using `StringEquals` instead of `StringNotEquals`, or incorrectly formatting the ARN), the deny will apply to the SecurityAdminRole as well. Option B is incorrect because SCPs applied to the root OU affect all accounts, including the management account except the root user, but that doesn't explain why SecurityAdminRole is blocked. Option C is incorrect because even if SecurityAdminRole has the necessary IAM permissions, SCP denies override them. Option D is incorrect because if the SCP denies the action, the S3 bucket policy is irrelevant for this issue.

Answer

The SCP is applied to the root organizational unit (OU), which includes the management account where the root user is not affected by SCPs.

Answer

The SecurityAdminRole does not have the necessary IAM permissions to stop CloudTrail logging.

Answer

The S3 bucket policy on the CloudTrail bucket denies access to the SecurityAdminRole.

Question 14

A security engineer is reviewing an IAM policy that allows access to an S3 bucket. The policy includes a condition that checks 'aws:SourceIp'. However, users report they can still access the bucket from IP addresses not in the allowed list. Which THREE possible reasons could explain this behavior?

Accepted Answer

The policy is attached to an IAM role that is used by an AWS service, and the condition does not apply to service principals. When an IAM role is assumed by an AWS service (e.g., AWS Lambda, EC2), the `aws:SourceIp` condition key does not apply to requests made by the service principal. The source IP address in such cases is the service's internal IP, not the end user's IP, and the condition is evaluated against the service's principal context, which does not include a source IP. This means the condition is effectively ignored for service-invoked actions, allowing access from any IP.

Answer

The policy is attached to an IAM group, but the user is not a member of that group

Answer

The 'aws:SourceIp' condition key is not supported for S3 actions

Question 15

A company uses AWS Organizations and wants to delegate administration of IAM Access Analyzer to a member account. Which AWS service should be used to enable this delegation?

Accepted Answer

AWS Organizations. AWS Organizations. AWS Organizations allows you to register a member account as a delegated administrator for IAM Access Analyzer. This enables the member account to manage Access Analyzer settings and findings across the organization. Option A is incorrect because AWS Service Catalog is used for creating and managing catalogs of IT services, not for delegation. Option C is incorrect because AWS CloudTrail is used for logging API activity, not delegation. Option D is incorrect because AWS Config is used for resource compliance and configuration tracking, not delegation.

Answer

AWS Service Catalog

Answer

AWS CloudTrail

Answer

AWS Config