SCS-C02 Identity and Access Management Practice Test 4 — 15 Questions

Question 1

A developer needs to grant an IAM user temporary access to an S3 bucket for 15 minutes. Which AWS service should be used to generate temporary credentials?

Accepted Answer

AWS Security Token Service (STS). AWS STS is used to request temporary, limited-privilege credentials for IAM users or federated users.

Answer

AWS Certificate Manager (ACM)

Answer

AWS Key Management Service (KMS)

Answer

AWS Directory Service

Question 2

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that no IAM user in any account can create or modify IAM roles. What is the MOST effective way to enforce this?

Accepted Answer

Create an SCP that denies iam:CreateRole and iam:UpdateAssumeRolePolicy and attach it to the root organizational unit.. A service control policy (SCP) can be applied to the root organizational unit to deny the specified actions across all accounts.

Answer

Use AWS Config rules to detect role creation and automatically delete the roles.

Answer

Set up a Lambda function that monitors CloudTrail and revokes role creation permissions.

Answer

Create an IAM policy that denies role creation and attach it to each user in every account.

Question 3

A company wants to allow its employees to authenticate to the AWS Management Console using their existing corporate credentials. Which AWS service should be used to integrate with the company's identity provider?

Accepted Answer

AWS IAM Identity Center (AWS SSO). AWS IAM Identity Center (formerly AWS SSO) is the correct service because it is specifically designed to enable single sign-on (SSO) from an external identity provider (IdP) to AWS accounts and business applications. It supports federation via SAML 2.0 or OIDC, allowing employees to authenticate using their existing corporate credentials and then access the AWS Management Console without needing separate IAM users.

Answer

AWS Secrets Manager

Answer

AWS Directory Service for Microsoft Active Directory

Answer

AWS Certificate Manager

Question 4

A security engineer is troubleshooting an issue where an IAM user is unable to list objects in an S3 bucket even though the user has an IAM policy that allows s3:ListBucket. What is the MOST likely cause?

Accepted Answer

The bucket policy explicitly denies the action for that user.. S3 bucket policies and IAM user policies are evaluated together; if the bucket policy denies access, it overrides the allow.

Answer

The user's IAM policy is not attached to the user.

Answer

The bucket is in a different AWS region.

Answer

The user needs to use MFA.

Question 5

An application running on an EC2 instance needs to read from an S3 bucket. What is the BEST practice for granting permissions to the EC2 instance?

Accepted Answer

Use an IAM role and attach it to the EC2 instance profile.. Using an IAM role attached to the EC2 instance is the secure and recommended way to grant permissions to applications on EC2.

Answer

Store AWS access keys in the application code.

Answer

Create an IAM user and give access keys to the developer.

Answer

Use the root account credentials.

Question 6

A company uses cross-account IAM roles to allow a third-party vendor to access resources in the company's AWS account. The security team wants to ensure that the vendor can only access the specific S3 bucket named 'vendor-bucket'. What should the security team do?

Accepted Answer

In the trust policy of the role, specify the vendor's AWS account and attach a permissions policy that allows s3:* on 'vendor-bucket'. Also create a bucket policy that allows the role.. The correct approach is to create a cross-account IAM role for the vendor. In the role's trust policy, specify the vendor's AWS account as the trusted entity. Attach a permissions policy to the role that grants access only to the specific S3 bucket 'vendor-bucket' (e.g., s3:GetObject, s3:PutObject). Additionally, create a bucket policy on 'vendor-bucket' that allows the role to access the bucket. This ensures the vendor can only assume the role and access the designated bucket.

Answer

Create an IAM user for the vendor and attach a policy that allows access to 'vendor-bucket'.

Answer

Use an SCP to deny access to all S3 buckets except 'vendor-bucket'.

Answer

Create a new AWS account for the vendor and use VPC peering.

Question 7

A security engineer notices that an IAM user has been using an access key that was not rotated for over 90 days. What is the BEST action to take?

Accepted Answer

Disable the user's access key and create a new one.. Rotating access keys regularly is a security best practice to reduce the risk of compromised keys.

Answer

Do nothing; 90 days is acceptable.

Answer

Delete the IAM user and create a new one.

Answer

Notify the user and ask them to rotate the key.

Question 8

Which THREE of the following are characteristics of IAM roles? (Choose 3.)

Accepted Answer

Roles can be assumed by IAM users in another AWS account.. Roles are assumed by trusted entities, provide temporary credentials, and can be used by AWS services.

Answer

Roles have long-term credentials like access keys.

Answer

Roles require a password for assumption.

Question 9

Which TWO of the following are AWS best practices for managing access keys? (Choose 2.)

Accepted Answer

Delete unused access keys.. AWS best practices recommend deleting unused access keys to reduce the risk of unauthorized access. Unused keys represent a potential attack vector, as they may be forgotten and left active, allowing an attacker who discovers them to gain access to AWS resources. By regularly auditing and removing keys that are no longer in use, you minimize the exposure of long-lived credentials.

Answer

Use the same access key for multiple users.

Answer

Share access keys via email.

Answer

Embed access keys directly in application code.

Question 10

A company wants to allow an IAM user to list objects in an S3 bucket named 'my-bucket'. Which IAM policy statement grants the minimum required permissions?

Accepted Answer

{"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::my-bucket"}. The s3:ListBucket action is the specific permission required to list objects in an S3 bucket, and the resource ARN must be the bucket itself (arn:aws:s3:::my-bucket) without a trailing /*. This grants the minimum necessary permission to perform the ListObjects (or ListObjectsV2) API call, which returns the object keys in the bucket.

Answer

{"Effect":"Allow","Action":"s3:PutObject","Resource":"arn:aws:s3:::my-bucket/*"}

Answer

{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::my-bucket/*"}

Answer

{"Effect":"Allow","Action":"s3:*","Resource":"arn:aws:s3:::my-bucket"}

Question 11

A security engineer needs to enforce that all IAM users in an AWS account use multi-factor authentication (MFA) when making API calls. What is the MOST effective way to enforce this?

Accepted Answer

Use an AWS Organizations service control policy (SCP) that denies all actions unless MFA is present.. An SCP can be applied at the organization, OU, or account level to deny all actions if MFA is not present, ensuring enforcement across all users and roles, including the root user. Option A is wrong because it only applies to the root user. Option B is wrong because CloudTrail logs do not enforce MFA. Option C is wrong because an IAM policy can be attached to users, groups, or roles but can be bypassed if not attached universally; an SCP provides broader, unavoidable enforcement.

Answer

Enable MFA for the root user.

Answer

Enable CloudTrail to log MFA usage.

Answer

Attach an IAM policy that denies all actions unless MFA is present.

Question 12

A developer needs to allow a Lambda function to write logs to CloudWatch Logs. What is the MINIMUM IAM policy that should be attached to the Lambda execution role?

Accepted Answer

{"Effect":"Allow","Action":["logs:CreateLogGroup","logs:CreateLogStream","logs:PutLogEvents"],"Resource":"*"}. It grants the minimum required actions: logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents, which are all necessary for a Lambda function to write logs to CloudWatch Logs. Option B is wrong because it only grants logs:PutLogEvents but lacks logs:CreateLogGroup and logs:CreateLogStream, which are required if the log group and log stream do not already exist. Option C is wrong because it grants all logs actions (logs:*), which is overly permissive and not the minimum required. Option D is wrong because it grants only describe actions, which do not allow the writing of log events.

Answer

{"Effect":"Allow","Action":"logs:PutLogEvents","Resource":"arn:aws:logs:us-east-1:123456789012:log-group:my-log-group:*"}

Answer

{"Effect":"Allow","Action":"logs:*","Resource":"*"}

Answer

{"Effect":"Allow","Action":["logs:DescribeLogGroups","logs:DescribeLogStreams"],"Resource":"*"}

Question 13

A company has an IAM policy that allows s3:GetObject on all buckets. However, a specific S3 bucket policy explicitly denies s3:GetObject to all principals. An IAM user with the IAM policy tries to read an object from that bucket. What is the result?

Accepted Answer

The request is denied because the explicit deny in the bucket policy overrides the allow in the IAM policy.. D is correct because AWS IAM policy evaluation logic follows an explicit deny override: any explicit deny in any applicable policy (resource-based or identity-based) overrides any allow. The S3 bucket policy explicitly denies s3:GetObject to all principals, so even though the IAM policy allows the action, the explicit deny takes precedence, resulting in a denied request.

Answer

The request is allowed because the IAM policy is more specific.

Answer

The request is allowed because the IAM policy allows the action.

Answer

The request is denied because the bucket policy applies only to IAM users.

Question 14

A company needs to grant cross-account access to an S3 bucket. Which IAM feature should be used?

Accepted Answer

Use an S3 bucket policy that grants access to the external account's IAM users.. A bucket policy can grant access to principals in another account. Option A is wrong because IAM users are within the same account. Option C is wrong because SCPs apply within an organization. Option D is wrong because a role can be used but requires the external account to assume the role, not directly access the bucket.

Answer

Create an IAM user in the source account and share the credentials.

Answer

Use a service control policy (SCP) to allow cross-account access.

Answer

Use an IAM role in the source account that the external account can assume.

Question 15

A security engineer notices that an IAM role has a trust policy that allows 'sts:AssumeRole' from any AWS account. What is the security risk?

Accepted Answer

Any IAM user in any AWS account can assume the role and gain its permissions.. The trust policy allowing 'sts:AssumeRole' from any AWS account means that any IAM user in any AWS account can request to assume the role. If the request is allowed by the role's permissions policy, the user gains the role's permissions. This is a security risk because it exposes the role's permissions to all AWS accounts, not just trusted ones. Option A is incorrect because the trust policy does not limit to AWS services; it applies to any principal. Option B is partially true but less precise than C; the main risk is that any user can assume the role and use its permissions. Option D is incorrect because the risk is not limited to resource access but includes the assumption itself.

Answer

The role can be assumed by any AWS service.

Answer

The role's permissions are exposed to all AWS accounts.

Answer

The role can be used to access resources in other accounts.