SCS-C02 Identity and Access Management Practice Test 5 — 15 Questions

Question 1

A large enterprise uses AWS Organizations to manage multiple accounts. The security team has implemented a Service Control Policy (SCP) at the root level that denies all actions unless the request originates from the corporate IP range (10.0.0.0/8). Recently, a developer in a member account tried to launch an EC2 instance from the AWS Management Console while connected via a VPN that provides an IP address within the corporate range. However, the launch failed with an 'AccessDenied' error. The developer is using an IAM user with full EC2 permissions (ec2:*). The SCP is as follows: {"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"*","Resource":"*","Condition":{"NotIpAddress":{"aws:SourceIp":"10.0.0.0/8"}}}]}. What is the MOST likely reason for the failure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The aws:SourceIp condition key does not work correctly for requests made via the AWS Management Console because the console may use a different IP.. The most likely reason is that the aws:SourceIp condition key does not work reliably for requests made via the AWS Management Console because the console makes API calls from the user's browser, but the IP seen by AWS may be different due to proxies or the console's backend services. The SCP denies all actions unless the request originates from 10.0.0.0/8, but the console might not preserve the source IP, leading to AccessDenied.

Answer

The SCP allows actions only from the specified IP range, but the developer's IP is not in that range.

Answer

The SCP does not apply to IAM users in member accounts; it only applies to the root user.

Answer

The IAM user does not have the necessary permissions because the SCP explicitly denies all actions.

Question 2

A company runs a serverless application using AWS Lambda functions that access an Amazon DynamoDB table. The Lambda functions are part of a microservices architecture and need to read and write to the DynamoDB table. The security team wants to ensure that the Lambda functions have the minimum required permissions. Initially, the team attached the AWS managed policy 'AWSLambdaDynamoDBExecutionRole' to the Lambda execution role, but later discovered that this policy grants more permissions than needed. The team decides to create a custom policy with only the required actions: GetItem, PutItem, UpdateItem, and DeleteItem. However, after attaching the custom policy, the Lambda functions start failing with 'AccessDeniedException' when trying to access DynamoDB. The CloudWatch logs show that the Lambda function is unable to write logs to CloudWatch Logs. What is the MOST likely cause of the failures?

Accepted Answer

The custom policy does not include permissions for CloudWatch Logs actions (logs:CreateLogGroup, logs:CreateLogStream, logs:PutLogEvents), which are required for Lambda to write logs.. The custom policy only grants DynamoDB permissions but does not include permissions for CloudWatch Logs, which are needed for Lambda to write logs. The managed policy included both DynamoDB and CloudWatch Logs permissions. Option B is wrong because the Lambda function does not need VPC permissions unless it is in a VPC. Option C is wrong because the Lambda function does not need to list tables to perform read/write operations. Option D is wrong because the condition keys are not the issue; the problem is missing permissions.

Answer

The custom policy does not include dynamodb:ListTables, which is required for the DynamoDB SDK to work.

Answer

The DynamoDB table has a resource-based policy that denies access from Lambda functions without a specific condition key.

Answer

The Lambda function is attached to a VPC and requires permissions to create Elastic Network Interfaces (ec2:CreateNetworkInterface).

Question 3

A company is using Amazon API Gateway to expose a set of REST APIs. The APIs are backed by AWS Lambda functions. The security team wants to control access to the APIs using IAM authorization. The team has created an IAM policy for a group of developers that allows them to invoke the APIs only from within the corporate network (IP range 203.0.113.0/24). The policy is attached to an IAM group, and the developers are members of the group. However, when a developer tries to invoke the API from the corporate network, they receive a '403 Forbidden' error. The API Gateway endpoint is configured with IAM authorization. The IAM policy is as follows: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"execute-api:Invoke","Resource":"arn:aws:execute-api:us-east-1:123456789012:api-id/*","Condition":{"IpAddress":{"aws:SourceIp":"203.0.113.0/24"}}}]}. What is the MOST likely reason for the failure?

Accepted Answer

The resource ARN in the policy does not include the stage and method; it should be 'arn:aws:execute-api:us-east-1:123456789012:api-id/stage/GET/resource'.. The resource ARN in the IAM policy must include the stage and HTTP method to match the API Gateway endpoint. The current policy uses 'api-id/*', which is a wildcard but may not cover all paths correctly if the stage and method are not specified. In this case, the developers receive a 403 error because the policy's resource ARN does not match the actual API resource path. Option B is incorrect because IAM policies can be attached to groups, and the developers inherit them. Option C is incorrect because the 'aws:SourceIp' condition works with API Gateway IAM authorization. Option D is incorrect because API Gateway IAM authorization supports resource-level conditions; the issue is the resource ARN format.

Answer

The IAM policy must be attached directly to the IAM user, not to a group.

Answer

The condition key aws:SourceIp does not work for API Gateway; you must use a custom header.

Answer

API Gateway IAM authorization does not support resource-level conditions; you must use a Lambda authorizer.

Question 4

A security engineer is designing IAM policies for a data analytics platform that uses Amazon S3, Amazon Athena, and AWS Glue. The platform must allow data scientists to query data in S3 using Athena, but only from specific VPC subnets. Additionally, the data must be encrypted at rest using AWS KMS. Which TWO actions should the engineer take to meet these requirements? (Choose TWO.)

Accepted Answer

Grant kms:Decrypt permission in the IAM policy and configure the KMS key policy to allow the IAM role to use the key.. Option A is correct because to read KMS-encrypted S3 objects, the data scientist's IAM role needs kms:Decrypt in its identity-based policy, and the KMS key policy must also grant that role (or its account) permission to use the key—both sides of the KMS authorization must allow the action. Option C is correct because Athena queries against S3 are made from the Athena service, so creating a VPC endpoint (interface endpoint for Athena) and using an S3 bucket policy that restricts access to that endpoint (for example, via aws:SourceVpce) ensures queries only originate from the approved VPC. Option B is not required because an encryption context condition is optional and not mandated by the stated encryption-at-rest requirement. Option D is incorrect because s3:SourceIp evaluates the caller's IP; Athena accesses S3 from AWS service infrastructure, not from the data scientists' subnet IPs, so it would not enforce the subnet restriction. Option E is incorrect because SSE-S3 uses S3-managed keys, not AWS KMS, so it does not satisfy the KMS encryption requirement and the KMS key policy reference is inapplicable.

Answer

Add kms:EncryptionContext condition to the IAM policy to require a specific encryption context.

Answer

Use the s3:SourceIp condition key in the IAM policy to restrict access to the private IP ranges of the VPC subnets.

Answer

Enable default encryption on the S3 bucket using SSE-S3 and configure the KMS key policy to allow the IAM role.

Question 5

A company manages a multi-account AWS environment using AWS Organizations. The security team wants to enforce that all Amazon S3 buckets in the organization are encrypted with AWS KMS customer managed keys (CMKs) and that no unencrypted buckets can be created. They also want to ensure that the encryption settings cannot be changed by account administrators. The team uses AWS CloudTrail to log all S3 API calls and wants to detect any attempts to create unencrypted buckets. The security team creates a service control policy (SCP) that denies s3:PutBucketEncryption and s3:PutBucketPolicy unless the request includes a specific encryption setting. However, they find that a developer in a member account was able to create an unencrypted bucket using the AWS Management Console. The CloudTrail logs show that the bucket was created with the s3:CreateBucket API call without specifying any encryption parameters. What should the security team do to prevent this from happening?

Accepted Answer

Modify the SCP to deny s3:CreateBucket unless the request includes the x-amz-server-side-encryption-aws-kms-key-id header.. A is correct. The SCP should deny s3:CreateBucket unless the request includes the x-amz-server-side-encryption-aws-kms-key-id header. This prevents creation of unencrypted buckets because the CreateBucket API call does not include encryption parameters by default; the SCP blocks such requests. B is incorrect: CloudTrail Insights detects unusual activity but does not prevent the action. C is incorrect: IAM permissions boundary cannot override SCP; the root issue is that the SCP did not deny CreateBucket. D is incorrect: S3 Block Public Access does not enforce encryption.

Answer

Enable CloudTrail Insights to detect unusual S3 activity and create a CloudWatch alarm.

Answer

Attach an IAM permissions boundary to all IAM roles used by developers that denies s3:CreateBucket.

Answer

Enable S3 Block Public Access at the account level to prevent unencrypted bucket creation.

Question 6

A company has an AWS Lambda function that processes sensitive data stored in an Amazon S3 bucket. The Lambda function needs to read objects from the S3 bucket and write results to a different S3 bucket. The security engineer is configuring IAM permissions for the Lambda execution role. The engineer wants to follow the principle of least privilege. The Lambda function is triggered by S3 events from the source bucket. The engineer creates an IAM policy that grants s3:GetObject on the source bucket and s3:PutObject on the destination bucket. However, when testing, the Lambda function fails with an access denied error when trying to process an object. The error message indicates that the Lambda function does not have permission to list the objects in the source bucket. The engineer checks the S3 event notification configuration and confirms that the event is configured correctly. What should the engineer do to resolve the issue?

Accepted Answer

Add s3:ListBucket permission for the source bucket to the Lambda execution role.. The Lambda function needs s3:ListBucket permission on the source bucket because the S3 event notification triggers the function, but the function's code may attempt to list objects to determine which object to process, or the event itself may not provide sufficient information. The error explicitly states lack of permission to list objects, so adding s3:ListBucket resolves it. This permission is granted on the bucket resource, not the objects.

Answer

Add s3:GetObject permission for the destination bucket to the Lambda execution role.

Answer

Add s3:* permission for both buckets to the Lambda execution role.

Answer

Add s3:PutObject permission for the source bucket to the Lambda execution role.

Question 7

A security engineer is troubleshooting an issue where an IAM role used by an EC2 instance cannot access an S3 bucket, even though the role has an attached policy that grants s3:GetObject on the bucket. The bucket policy does not explicitly deny access. What is the most likely cause?

Accepted Answer

The bucket policy does not grant access to the IAM role. When an IAM role attached to an EC2 instance attempts to access an S3 bucket, AWS evaluates both identity-based policies (the role's policy) and resource-based policies (the bucket policy). If the bucket policy does not explicitly grant access to the IAM role, and the bucket is not owned by the same account as the role, the request is denied by default. This is because cross-account access requires an explicit grant in the bucket policy, even if the role's policy allows the action. The most likely cause is that the bucket policy lacks a statement allowing the role, so the identity-based policy alone is insufficient.

Answer

A service control policy (SCP) is denying access

Answer

The IAM policy is attached to the user instead of the role

Answer

The bucket has an explicit deny in its policy

Question 8

A company has multiple AWS accounts managed through AWS Organizations. The security team wants to enforce that all users must use multi-factor authentication (MFA) to access the AWS Management Console. Which combination of actions should the security team take to enforce this requirement?

Accepted Answer

Apply a service control policy (SCP) at the organization root that denies actions unless MFA is present. A service control policy (SCP) at the organization root can deny access to all AWS actions unless MFA is present, enforcing MFA across all accounts. Option A is incorrect because IAM policies in individual accounts can be overridden by account administrators. Option B is incorrect because enabling MFA through the Account Management console does not enforce its use. Option C is incorrect because an IAM policy in each account can be bypassed by account administrators who can modify or remove it.

Answer

Use AWS CloudTrail to monitor and alert on console logins without MFA

Answer

Enable MFA through the AWS Account Management console for each account

Answer

Create an IAM policy in each account that denies access without MFA

Question 9

A company is designing an IAM policy to grant a group of developers access to manage EC2 instances and RDS databases. Which TWO actions should be included to follow the principle of least privilege?

Accepted Answer

ec2:StartInstances. Option B (ec2:StartInstances) is correct because starting an existing EC2 instance is a legitimate management action that developers need, and it is a narrowly scoped action that does not grant broader permissions like creating or terminating instances. Option D (rds:StartDBInstance) is correct because starting an existing RDS DB instance is a specific, granular management action that aligns with least privilege, allowing developers to bring databases online without granting creation or deletion rights. Option A (rds:CreateDBInstance) is not marked correct because creating new database instances is a provisioning action that exceeds the management scope described and would violate least privilege. Option C (ec2:CreateInstances) is not marked correct because it is not a valid EC2 IAM action name (the correct action is ec2:RunInstances) and creating instances is a provisioning action beyond the stated management need. Option E (ec2:*) is not marked correct because a wildcard grants all EC2 actions, which directly violates the principle of least privilege.

Answer

rds:CreateDBInstance

Answer

ec2:CreateInstances

Answer

ec2:*

Question 10

A security engineer is reviewing an IAM policy that allows access to an S3 bucket. The policy includes a condition that checks 'aws:SourceIp'. However, users report they can still access the bucket from IP addresses not in the allowed list. Which THREE possible reasons could explain this behavior?

Accepted Answer

The policy is attached to an IAM role that is used by an AWS service, and the condition does not apply to service principals. Option C is correct because when an IAM policy with an aws:SourceIp condition is attached to a role assumed by an AWS service, the condition evaluates the service's IP context rather than the end user's IP, and service principals may bypass or not match the intended source IP restriction. Option D is correct because if the condition key is misspelled (for example, aws:SourceIP or aws:sourceip instead of aws:SourceIp), the condition is not evaluated as intended and the policy can effectively allow access without enforcing the IP restriction. Option E is correct because an S3 bucket policy granting public access is evaluated independently of the IAM policy, and an explicit Allow in the bucket policy can permit access even when the IAM policy's aws:SourceIp condition would otherwise deny it. Option A is not correct because if the user is not a member of the IAM group, the group's policy would not grant them access, so it cannot explain why they can still access the bucket. Option B is not correct because aws:SourceIp is a supported global condition key and can be used with S3 actions such as s3:GetObject.

Answer

The policy is attached to an IAM group, but the user is not a member of that group

Answer

The 'aws:SourceIp' condition key is not supported for S3 actions

Question 11

A company wants to allow a Lambda function to read messages from an SQS queue and write logs to CloudWatch Logs. Which TWO IAM actions should be included in the Lambda execution role?

Accepted Answer

sqs:ReceiveMessage. Options B and D are correct because they provide the specific actions needed: sqs:ReceiveMessage to read from SQS and logs:CreateLogStream and logs:PutLogEvents to write logs to CloudWatch Logs. Option A (logs:DeleteLogGroup) is not required for writing logs. Option C (cloudwatch:*) is overly broad and CloudWatch Logs actions are under the logs: prefix, not cloudwatch:* which covers other CloudWatch services. Option E (sqs:SendMessage) is for sending messages, not reading.

Answer

logs:DeleteLogGroup

Answer

cloudwatch:*

Answer

sqs:SendMessage

Question 12

Refer to the exhibit. An IAM policy is attached to a user. The user is trying to download an object from 'example-bucket' from an IP address of 10.1.1.1. What will happen?

Accepted Answer

Access is denied because the IP address is not in the allowed range. The IAM policy likely includes a condition that restricts access to a specific IP range, and the user's IP 10.1.1.1 is outside that range. Therefore, the condition evaluates to false, and the allow statement does not apply, resulting in an implicit deny. The correct answer is that access is denied because the IP is not in the allowed range.

Answer

Access is denied because the policy does not include an explicit deny

Answer

Access is allowed because the condition key is misspelled

Answer

Access is allowed because the policy allows s3:GetObject

Question 13

A company uses AWS Organizations and wants to delegate administration of IAM Access Analyzer to a member account. Which AWS service should be used to enable this delegation?

Accepted Answer

AWS Organizations. AWS Organizations. AWS Organizations allows you to register a member account as a delegated administrator for IAM Access Analyzer. This enables the member account to manage Access Analyzer settings and findings across the organization. Option A is incorrect because AWS Service Catalog is used for creating and managing catalogs of IT services, not for delegation. Option C is incorrect because AWS CloudTrail is used for logging API activity, not delegation. Option D is incorrect because AWS Config is used for resource compliance and configuration tracking, not delegation.

Answer

AWS Service Catalog

Answer

AWS CloudTrail

Answer

AWS Config

Question 14

A security engineer needs to ensure that an IAM role can only be assumed by a specific EC2 instance. The instance has a tag 'Environment=Production'. Which condition key should be used in the trust policy of the role?

Accepted Answer

ec2:ResourceTag. The 'ec2:ResourceTag' condition key can be used in an IAM role trust policy to check the tags of the EC2 instance making the AssumeRole request. This allows the security engineer to restrict the role assumption to only instances with the tag 'Environment=Production'. Option A is incorrect because 'aws:SourceArn' is used to check the ARN of the source resource, typically for services like Lambda or SNS, not for EC2 instances. Option B is incorrect because 'aws:UserAgent' checks the user agent string of the request, which is not relevant for EC2 instance tags. Option C is incorrect because 'aws:SourceAccount' checks the AWS account ID of the source, which does not filter by instance tags.

Answer

aws:SourceArn

Answer

aws:UserAgent

Answer

aws:SourceAccount

Question 15

A company has an S3 bucket with a bucket policy that grants access to a specific IAM role. The role is used by an application running on an EC2 instance. The application is unable to access the bucket, but the role can access other resources. What is the most likely cause?

Accepted Answer

The EC2 instance does not have an instance profile associated with the role. For an EC2 instance to use an IAM role, the role must be associated with the instance via an instance profile. If the instance profile is missing, the instance cannot assume the role, and thus the application cannot access the S3 bucket. The fact that the role can access other resources suggests the role itself has permissions, but the instance is not assuming it.

Answer

A service control policy (SCP) denies access to the bucket

Answer

The bucket policy denies access to the role

Answer

The role's trust policy does not allow EC2 to assume the role