SCS-C02 Identity and Access Management Practice Test 5 — 15 Questions

Question 1

A security engineer is troubleshooting an issue where an IAM user is unable to list objects in an S3 bucket even though the user has an IAM policy that allows s3:ListBucket. What is the MOST likely cause?

Accepted Answer

The bucket policy explicitly denies the action for that user.. S3 bucket policies and IAM user policies are evaluated together; if the bucket policy denies access, it overrides the allow.

Answer

The user's IAM policy is not attached to the user.

Answer

The bucket is in a different AWS region.

Answer

The user needs to use MFA.

Question 2

An application running on an EC2 instance needs to read from an S3 bucket. What is the BEST practice for granting permissions to the EC2 instance?

Accepted Answer

Use an IAM role and attach it to the EC2 instance profile.. Using an IAM role attached to the EC2 instance is the secure and recommended way to grant permissions to applications on EC2.

Answer

Store AWS access keys in the application code.

Answer

Create an IAM user and give access keys to the developer.

Answer

Use the root account credentials.

Question 3

A company uses cross-account IAM roles to allow a third-party vendor to access resources in the company's AWS account. The security team wants to ensure that the vendor can only access the specific S3 bucket named 'vendor-bucket'. What should the security team do?

Accepted Answer

In the trust policy of the role, specify the vendor's AWS account and attach a permissions policy that allows s3:* on 'vendor-bucket'. Also create a bucket policy that allows the role.. The correct approach is to define a permissions boundary on the role that only allows access to the specific bucket, and also ensure the bucket policy allows the role.

Answer

Create an IAM user for the vendor and attach a policy that allows access to 'vendor-bucket'.

Answer

Use an SCP to deny access to all S3 buckets except 'vendor-bucket'.

Answer

Create a new AWS account for the vendor and use VPC peering.

Question 4

A security engineer notices that an IAM user has been using an access key that was not rotated for over 90 days. What is the BEST action to take?

Accepted Answer

Disable the user's access key and create a new one.. Rotating access keys regularly is a security best practice to reduce the risk of compromised keys.

Answer

Do nothing; 90 days is acceptable.

Answer

Delete the IAM user and create a new one.

Answer

Notify the user and ask them to rotate the key.

Question 5

Which TWO of the following are valid ways to grant an IAM user permissions to access an S3 bucket? (Choose 2.)

Accepted Answer

Attach an IAM policy to the user.. IAM policies can be attached to users, and S3 bucket policies can grant access to specific users.

Answer

Assign an instance profile to the user.

Answer

Create a VPC endpoint policy.

Answer

Use an SCP to allow access.

Question 6

Which THREE of the following are characteristics of IAM roles? (Choose 3.)

Accepted Answer

Roles can be assumed by IAM users in another AWS account.. Roles are assumed by trusted entities, provide temporary credentials, and can be used by AWS services.

Answer

Roles have long-term credentials like access keys.

Answer

Roles require a password for assumption.

Question 7

Which TWO of the following are AWS best practices for managing access keys? (Choose 2.)

Accepted Answer

Delete unused access keys.. Rotating keys regularly and not embedding them in code are standard security practices.

Answer

Use the same access key for multiple users.

Answer

Share access keys via email.

Answer

Embed access keys directly in application code.

Question 8

A company wants to allow an IAM user to list objects in an S3 bucket named 'my-bucket'. Which IAM policy statement grants the minimum required permissions?

Accepted Answer

{"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::my-bucket"}. Option B is correct because it grants only the s3:ListBucket action on the specified bucket. Option A is wrong because it grants s3:* which is excessive. Option C is wrong because it uses s3:GetObject which is not needed for listing. Option D is wrong because it grants s3:PutObject which is not needed.

Answer

{"Effect":"Allow","Action":"s3:PutObject","Resource":"arn:aws:s3:::my-bucket/*"}

Answer

{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::my-bucket/*"}

Answer

{"Effect":"Allow","Action":"s3:*","Resource":"arn:aws:s3:::my-bucket"}

Question 9

A security engineer needs to enforce that all IAM users in an AWS account use multi-factor authentication (MFA) when making API calls. What is the MOST effective way to enforce this?

Accepted Answer

Use an AWS Organizations service control policy (SCP) that denies all actions unless MFA is present.. Option C is correct because a service control policy (SCP) can be applied at the account level to deny all actions if MFA is not present. Option A is wrong because it only applies to the root user. Option B is wrong because IAM policies can be attached to users but can be overridden. Option D is wrong because CloudTrail logs do not enforce MFA.

Answer

Enable MFA for the root user.

Answer

Enable CloudTrail to log MFA usage.

Answer

Attach an IAM policy that denies all actions unless MFA is present.

Question 10

A company uses an IAM role to allow an EC2 instance to access an S3 bucket. The role has an attached policy that grants s3:GetObject on the bucket. However, the application on the EC2 instance is unable to read objects. What is the MOST likely cause?

Accepted Answer

The EC2 instance does not have an IAM instance profile configured.. Option D is correct because the instance profile must be associated with the EC2 instance for the role to be used. Option A is wrong because the policy is attached to the role, not the instance. Option B is wrong because the bucket policy may be blocking access. Option C is wrong because the user data script does not affect IAM permissions.

Answer

The S3 bucket policy denies access to the IAM role.

Answer

The policy is attached to the EC2 instance instead of the role.

Answer

The EC2 instance is not running the latest user data script.

Question 11

A developer needs to allow a Lambda function to write logs to CloudWatch Logs. What is the MINIMUM IAM policy that should be attached to the Lambda execution role?

Accepted Answer

{"Effect":"Allow","Action":["logs:CreateLogGroup","logs:CreateLogStream","logs:PutLogEvents"],"Resource":"*"}. Option A is correct because it grants the minimum required actions: CreateLogGroup, CreateLogStream, and PutLogEvents. Option B is wrong because it is too permissive. Option C is wrong because it grants actions not needed. Option D is wrong because it grants only specific log group permissions but not the stream creation.

Answer

{"Effect":"Allow","Action":"logs:PutLogEvents","Resource":"arn:aws:logs:us-east-1:123456789012:log-group:my-log-group:*"}

Answer

{"Effect":"Allow","Action":"logs:*","Resource":"*"}

Answer

{"Effect":"Allow","Action":["logs:DescribeLogGroups","logs:DescribeLogStreams"],"Resource":"*"}

Question 12

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that no IAM user in any account can create new IAM users. Which approach should be used?

Accepted Answer

Apply a service control policy (SCP) at the root organizational unit that denies IAM:CreateUser.. Option B is correct because an SCP can deny the IAM:CreateUser action across all accounts. Option A is wrong because it only applies to the root user. Option C is wrong because it affects only one account. Option D is wrong because SCPs cannot be attached to IAM users.

Answer

Apply an IAM policy to the root user of each account.

Answer

Use an SCP attached to each IAM user.

Answer

Use an IAM permissions boundary on each IAM user.

Question 13

A company has an IAM policy that allows s3:GetObject on all buckets. However, a specific S3 bucket policy explicitly denies s3:GetObject to all principals. An IAM user with the IAM policy tries to read an object from that bucket. What is the result?

Accepted Answer

The request is denied because the explicit deny in the bucket policy overrides the allow in the IAM policy.. Option A is correct because an explicit deny in a bucket policy overrides any allow. Option B is wrong because explicit deny overrides allow. Option C is wrong because the bucket policy deny applies to all principals. Option D is wrong because the IAM policy allows the action but the bucket policy denies it.

Answer

The request is allowed because the IAM policy is more specific.

Answer

The request is allowed because the IAM policy allows the action.

Answer

The request is denied because the bucket policy applies only to IAM users.

Question 14

A company needs to grant cross-account access to an S3 bucket. Which IAM feature should be used?

Accepted Answer

Use an S3 bucket policy that grants access to the external account's IAM users.. Option B is correct because a bucket policy can grant access to principals in another account. Option A is wrong because IAM users are within the same account. Option C is wrong because a role can be used but requires the external account to assume the role, not directly access the bucket. Option D is wrong because SCPs apply within an organization.

Answer

Create an IAM user in the source account and share the credentials.

Answer

Use a service control policy (SCP) to allow cross-account access.

Answer

Use an IAM role in the source account that the external account can assume.

Question 15

A security engineer notices that an IAM role has a trust policy that allows 'sts:AssumeRole' from any AWS account. What is the security risk?

Accepted Answer

Any IAM user in any AWS account can assume the role and gain its permissions.. Option A is correct because any user from any account can assume the role. Option B is wrong because the risk is not just about resources outside the account. Option C is wrong because the trust policy allows assumption, not just viewing. Option D is wrong because the risk is that anyone can assume the role, not just malicious users.

Answer

The role can be assumed by any AWS service.

Answer

The role's permissions are exposed to all AWS accounts.

Answer

The role can be used to access resources in other accounts.