SCS-C02 Identity and Access Management Practice Test 6 — 15 Questions

Question 1

Refer to the exhibit. This is an S3 bucket policy. The CrossAccountRole in account 111111111111 has an IAM policy that allows s3:GetObject on 'my-bucket'. A user in account 111111111111 assumes the role and tries to get an object. What will happen?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Access is allowed because both the bucket policy and the IAM policy allow. For cross-account access to an S3 bucket, both the IAM policy attached to the principal (the assumed role) and the S3 bucket policy must allow the action. In this scenario, the IAM policy allows s3:GetObject on 'my-bucket', and the bucket policy (as shown in the exhibit, though not visible here) must also grant access to the role. When both policies allow, access is granted.

Answer

Access is allowed because the bucket policy allows access to the role

Answer

Access is denied because the IAM policy does not grant access to the bucket

Answer

Access is denied because the bucket policy does not grant access to the user

Question 2

A company needs to provide temporary credentials to mobile app users to access AWS resources. Which AWS service should be used to issue these credentials?

Accepted Answer

AWS Security Token Service (STS). AWS Security Token Service (STS) is the service that issues temporary, limited-privilege credentials (via AssumeRole, GetSessionToken, GetFederationToken, etc.). For mobile app users, the standard pattern is to use Cognito Identity Pools to authenticate the user and then call STS AssumeRoleWithWebIdentity to obtain temporary credentials. STS is the actual credential-issuing service, so it is the correct answer for 'which service issues temporary credentials.'

Answer

AWS IAM

Answer

AWS Cognito

Answer

AWS Key Management Service (KMS)

Question 3

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all IAM users in member accounts must have a password policy that requires a minimum length of 14 characters. How can this be achieved centrally?

Accepted Answer

Use an SCP that denies the UpdateAccountPasswordPolicy action unless the policy has MinimumPasswordLength >= 14.. An SCP that denies the UpdateAccountPasswordPolicy action unless MinimumPasswordLength is at least 14 enforces the requirement centrally across all member accounts in AWS Organizations. SCPs are the only mechanism that can apply a guardrail across an entire organization from the management account, and using a condition on the API call ensures the policy cannot be weakened below the threshold.

Answer

Use a service control policy (SCP) to enforce the password policy across all accounts.

Answer

Use IAM permission boundaries to restrict password policy changes to specific Regions.

Answer

Use AWS Config rules to automatically remediate non-compliant password policies.

Question 4

A company uses cross-account IAM roles to allow a third-party auditor to access a specific S3 bucket. The auditor reports that they are getting 'Access Denied' errors when trying to list objects. The bucket policy allows access to the auditor's account. What additional configuration is needed?

Accepted Answer

Attach an IAM policy to the auditor's IAM user that allows s3:ListBucket on the specific bucket.. For cross-account access to an S3 bucket using a bucket policy, the bucket policy grants access to the entire AWS account (e.g., "AWS": "arn:aws:iam::auditor-account-id:root"). However, the IAM user or role in the auditor account must also have an IAM policy that allows the S3 action (e.g., s3:ListBucket). The auditor's IAM user lacks this identity-based policy, causing an 'Access Denied' error. Option C correctly identifies that an IAM policy must be attached to the auditor's IAM user to allow s3:ListBucket on the specific bucket. Option A is incorrect because modifying the trust policy is relevant for IAM role assumption, not for bucket policy-based access. Option B is incorrect because SCPs apply at the organizational level and are not the typical additional configuration needed for this specific issue; they could cause denial but the question asks for what additional configuration is needed given the bucket policy allows the account. Option D is incorrect because adding a bucket policy granting access to the auditor's IAM user ARN would work, but it is not necessary if the bucket policy already allows the entire account; the missing piece is the user's IAM policy.

Answer

Modify the trust policy of the IAM role to include the auditor's account.

Answer

Ensure the auditor's account does not have a service control policy (SCP) denying S3 actions.

Answer

Add a bucket policy that grants access to the auditor's IAM user ARN.

Question 5

A security administrator needs to ensure that all IAM users in the account use multi-factor authentication (MFA) to access the AWS Management Console. What is the most effective way to enforce this?

Accepted Answer

Create an IAM policy that denies all actions unless MFA is present, and attach it to all users.. The most effective way to enforce MFA for all IAM users accessing the AWS Management Console is to create an IAM policy that denies all actions unless MFA is present (using the aws:MultiFactorAuthPresent condition) and attach it to all users. This ensures that even if a user has permissions, they cannot perform actions without MFA. While SCPs can enforce MFA, they apply at the organization level and are not the standard method for enforcing MFA on IAM users within a single account.

Answer

Set the IAM password policy to require MFA.

Answer

Use an SCP to deny access if MFA is not present, with a condition "aws:MultiFactorAuthPresent":"true".

Answer

Enable MFA for the root user and require all IAM users to use the root user credentials.

Question 6

A company has an IAM policy that allows a user to launch EC2 instances only in a specific Availability Zone (us-east-1a). The user is able to launch instances, but the instances are launched in us-east-1b instead. What is the most likely reason?

Accepted Answer

The policy uses the condition key "aws:RequestedAvailabilityZone" which is not valid; it should be "ec2:AvailabilityZone".. The condition key "aws:RequestedAvailabilityZone" is not a valid AWS condition key for EC2 actions. The proper condition key to restrict an Availability Zone is "ec2:AvailabilityZone". If the policy uses an invalid key, the condition is never evaluated, so the policy effectively allows launching instances in any AZ. Options A, B, and C are less likely because they describe scenarios that would either still allow enforcement or are not as common a mistake.

Answer

The policy is not attached to the user; it is attached to a group.

Answer

The user is using an IAM role that overrides the policy.

Answer

The policy uses a condition with ec2:Region instead of ec2:AvailabilityZone.

Question 7

An organization uses AWS KMS to encrypt S3 objects. They want to allow a developer to decrypt objects only if the request comes from a specific IP address range. Which IAM policy condition should be used?

Accepted Answer

Condition with kms:ViaService and aws:SourceIp.. The [CORRECT] answer is D because kms:ViaService is the KMS condition key that restricts a KMS API call to requests that originate through a specific AWS service (here, S3). When a developer calls kms:Decrypt indirectly via S3 GetObject, the request is evaluated with kms:ViaService set to s3.<region>.amazonaws.com. Combining this with aws:SourceIp ensures the developer can only decrypt through S3 and only from the specified IP range, which is exactly the stated requirement.

Answer

Condition with kms:GrantOperations and aws:SourceIp.

Answer

Condition with kms:CallerAccount and aws:SourceIp.

Answer

Condition with kms:EncryptionContext and aws:SourceIp.

Question 8

A security engineer needs to design a system where an EC2 instance can write logs to a CloudWatch log group. Which TWO steps are required?

Accepted Answer

Attach the IAM role to the EC2 instance profile.. Option B is correct because an EC2 instance obtains AWS credentials for the CloudWatch Logs API calls through an instance profile, so the IAM role granting the required permissions must be attached to that instance profile. Option E is correct because the role's policy must explicitly allow the CloudWatch Logs write actions logs:CreateLogStream and logs:PutLogEvents (and typically logs:CreateLogGroup) for the instance to send log events. Option A is not required: server-side encryption with a KMS key is optional and only needed if logs must be encrypted with a customer-managed key, not for basic log writing. Option C is not required: a CloudWatch Logs resource policy is used for cross-account access or service principals, whereas same-account EC2 access is governed by the instance's IAM role. Option D is not required for the permission design: the CloudWatch agent is a client that must be installed to actually collect and push logs, but the question asks for the IAM/authorization steps needed to allow the instance to write logs.

Answer

Enable server-side encryption for the log group.

Answer

Create a CloudWatch log group resource policy that allows the EC2 instance to write logs.

Answer

Install and configure the CloudWatch agent on the EC2 instance.

Question 9

A company wants to enforce that all IAM users in an AWS Organization must have a password policy that includes a minimum length of 12 characters. Which THREE steps are part of implementing this using SCPs?

Accepted Answer

Include a condition in the SCP that checks if the requested minimum password length is less than 12.. Options A, D, and E are correct. Option A is correct because you can use a condition in the SCP to deny changes to the password policy if the minimum length is less than 12; for example, using a condition like `aws:RequestedRegion` is not relevant here. Option D is correct because SCPs can deny the `iam:UpdateAccountPasswordPolicy` action, effectively preventing users from modifying the policy. Option E is correct because attaching the SCP to the root OU ensures it applies to all accounts in the organization. Option B is incorrect because IAM is a global service and cannot be restricted to a specific Region via SCPs. Option C is incorrect because SCPs cannot directly set a password policy; they only allow or deny actions.

Answer

Use an SCP condition to restrict password policy changes to a specific Region.

Answer

Write an SCP that sets the password policy to require minimum length 12.

Question 10

An IAM administrator ran the simulate-custom-policy command shown in the exhibit. The result shows an 'explicitDeny' for s3:ListBucket. What is the most likely reason?

Accepted Answer

The policy does not include an action that allows s3:ListBucket, so it is implicitly denied.. The policy does not allow s3:ListBucket, so it is implicitly denied; but the simulator shows 'explicitDeny' because there might be an attached policy that denies it. However, in this simulation, the policy only allows s3:GetObject, so ListBucket is not allowed. The 'explicitDeny' could be due to an SCP or a different policy attached to the user. Option A is wrong because the resource ARN is correct. Option B is wrong because the policy does not include ListBucket. Option D is wrong because the action is spelled correctly.

Answer

The simulation incorrectly evaluates the policy due to a syntax error.

Answer

The resource ARN for ListBucket is incorrect; it should include a wildcard.

Answer

The s3:ListBucket action is not valid for S3.

Question 11

A security engineer is designing an IAM policy to allow an application running on an EC2 instance to read objects from a specific S3 bucket (my-bucket) and write objects to a different S3 bucket (my-other-bucket). The application uses an IAM role with the following trust policy. Which additional policy should be attached to the role to meet the requirements with least privilege?

Accepted Answer

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject"],
      "Resource": "arn:aws:s3:::my-bucket/*"
    },
    {
      "Effect": "Allow",
      "Action": ["s3:PutObject"],
      "Resource": "arn:aws:s3:::my-other-bucket/*"
    }
  ]
}. The correct answer because it grants only the necessary actions (s3:GetObject and s3:PutObject) on the specific buckets (my-bucket for read, my-other-bucket for write), adhering to the principle of least privilege. Option A is incorrect because it allows both GetObject and PutObject on all buckets (*/*), which is too permissive. Option B grants full S3 access (*) to all resources, violating least privilege. Option D only allows PutObject on my-bucket instead of my-other-bucket, failing to meet the write requirement.

Answer

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:PutObject"],
      "Resource": "arn:aws:s3:::*/*"
    }
  ]
}

Answer

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:*",
      "Resource": "*"
    }
  ]
}

Answer

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:PutObject"],
      "Resource": "arn:aws:s3:::my-bucket/*"
    }
  ]
}

Question 12

A developer needs to grant an IAM user the ability to manage their own password and access keys, but not any other IAM users. Which IAM policy should be used?

Accepted Answer

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["iam:CreateAccessKey", "iam:UpdateAccessKey", "iam:DeleteAccessKey", "iam:UpdateLoginProfile"],
      "Resource": "arn:aws:iam::*:user/${aws:username}"
    }
  ]
}. The correct policy uses the `${aws:username}` variable in the Resource ARN to scope permissions to the current IAM user only, and includes `iam:UpdateLoginProfile` to allow password changes. This satisfies the requirement that the user can manage their own password and access keys but not those of other IAM users. The `${aws:username}` policy variable is replaced at evaluation time with the friendly name of the requesting user, ensuring least privilege.

Answer

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["iam:CreateAccessKey", "iam:UpdateAccessKey", "iam:DeleteAccessKey", "iam:UpdateLoginProfile"],
      "Resource": "arn:aws:iam::*:user/*"
    }
  ]
}

Answer

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "iam:*",
      "Resource": "*"
    }
  ]
}

Answer

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["iam:CreateAccessKey", "iam:UpdateAccessKey", "iam:DeleteAccessKey"],
      "Resource": "arn:aws:iam::*:user/${aws:username}"
    }
  ]
}

Question 13

A security engineer needs to design an IAM policy that allows an IAM user to launch EC2 instances only if they specify a specific security group ID (sg-12345) and a specific instance type (t2.micro). Which policy achieves this?

Accepted Answer

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:RunInstances",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "ec2:InstanceType": "t2.micro",
          "ec2:SecurityGroup": "sg-12345"
        }
      }
    }
  ]
}. It uses the condition keys 'ec2:InstanceType' and 'ec2:SecurityGroup' to restrict the RunInstances action to only allow launching t2.micro instances into the security group sg-12345. Option A incorrectly specifies the security group as a resource ARN, but security groups cannot be specified as resources in RunInstances; they are specified via condition keys. Option B uses 'aws:RequestTag/security-group' which is not a valid condition key for security groups; security groups are identified by 'ec2:SecurityGroup'. Option C only restricts instance type but does not restrict the security group. Therefore, only D correctly enforces both constraints.

Answer

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:RunInstances",
      "Resource": "arn:aws:ec2:*:*:security-group/sg-12345",
      "Condition": {
        "StringEquals": { "ec2:InstanceType": "t2.micro" }
      }
    }
  ]
}

Answer

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:RunInstances",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "ec2:InstanceType": "t2.micro",
          "aws:RequestTag/security-group": "sg-12345"
        }
      }
    }
  ]
}

Answer

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:RunInstances",
      "Resource": "*",
      "Condition": {
        "StringEquals": { "ec2:InstanceType": "t2.micro" }
      }
    }
  ]
}

Question 14

A company has an S3 bucket with a bucket policy that grants access to a specific IAM role. However, users who assume that role are unable to list objects in the bucket. The bucket policy includes a Principal element set to the role ARN. What is the MOST likely cause?

Accepted Answer

The IAM role does not have a permissions policy that allows s3:ListBucket.. In AWS, access to an S3 bucket requires both identity-based permissions (attached to the IAM role) and resource-based permissions (the bucket policy). The bucket policy grants the role access, but the role itself must also have an IAM policy that explicitly allows s3:ListBucket. Without that identity-based permission, the request is implicitly denied, even though the bucket policy allows it. Therefore, the most likely cause is that the role lacks the necessary permissions policy.

Answer

The bucket has an ACL that denies access to the role.

Answer

The bucket policy requires MFA, but the role does not enforce MFA.

Answer

The role's trust policy does not allow sts:AssumeRole.

Question 15

A company is using AWS Organizations and wants to delegate administrative tasks for a specific OU to another account. Which feature should be used?

Accepted Answer

Delegated administrator for AWS Organizations. Delegated administrator for AWS Organizations. This feature allows a member account to manage specified services across the organization, enabling administrative delegation for an OU. Option A (AWS Resource Access Manager) is for sharing resources. Option B (AWS CloudTrail) is for logging API activity. Option C (AWS SSO) provides single sign-on access but not delegation of administrative tasks.

Answer

AWS Resource Access Manager

Answer

AWS CloudTrail

Answer

AWS SSO