SCS-C02 Identity and Access Management Practice Test 6 — 15 Questions

Question 1

An IAM policy attached to a user contains the above statements. The user attempts to download an object from 'example-bucket/confidential/report.pdf'. What is the result?

Accepted Answer

The download fails because the deny statement applies to the object.. The explicit deny on the 'confidential' folder overrides the allow from the first statement, causing the download to fail. Option A is incorrect because deny overrides, not requiring admin. Option B is incorrect because the ability to access other objects does not apply here. Option C is incorrect because the first statement allows GetObject generally, but the explicit deny on the specific path overrides it. Option D is correct because the deny applies to the object's path.

Answer

The download fails because the user is not an administrator.

Answer

The download succeeds because the user can access other objects.

Answer

The download succeeds because the first statement allows GetObject.

Question 2

A security engineer runs the IAM policy simulator with a custom policy. The output shows the above. Which statement is true about the policy?

Accepted Answer

The policy contains a statement that explicitly denies iam:DeleteUser.. The policy simulator shows an explicit deny for iam:DeleteUser, confirming that a deny statement exists in the policy. Option C is correct because the explicit deny means the policy explicitly denies iam:DeleteUser. Option A is incorrect because the simulator does not indicate that iam:CreateUser is denied. Option B is incorrect because the explicit deny overrides any default allow. Option D is incorrect because the simulator returned an explicit deny, not errors.

Answer

The policy allows iam:DeleteUser but denies iam:CreateUser.

Answer

The policy allows all actions by default.

Answer

The policy has no effect because the simulator returned errors.

Question 3

An IAM role has the above trust policy. Users from account 123456789012 try to assume the role. What is required for the AssumeRole API call to succeed?

Accepted Answer

The user must have MFA enabled and present the MFA token.. The trust policy includes a condition requiring MFA (e.g., aws:MultiFactorAuthPresent: true). Therefore, users must have MFA enabled and provide the MFA token when calling AssumeRole. Option A is incorrect because the role can be assumed by users from another account, but MFA is still required. Option B is incorrect because the user does not need an IAM policy allowing sts:AssumeRole; the trust policy grants the permission. Option D is incorrect because the condition is about MFA, not IP address.

Answer

The user must be an IAM user in the same account as the role.

Answer

The user must have an IAM policy that allows sts:AssumeRole.

Answer

The request must originate from a specific IP address range.

Question 4

A security engineer needs to grant cross-account access to an S3 bucket in Account A to a role in Account B. Which combination of IAM entities must be configured?

Accepted Answer

IAM role in Account A with trust policy for Account B. Cross-account access requires an IAM role in the trusting account (Account A) with a trust policy that allows the trusted account (Account B) to assume it, and an IAM policy in Account B that allows the user or role to call sts:AssumeRole. Option C is correct. Option A is wrong because the bucket policy alone is not sufficient; the role must also allow the action. Option B is wrong because the role is in Account A, not Account B. Option D is wrong because an IAM user in Account B cannot directly access a role in Account A without assuming it.

Answer

Bucket policy in Account A and IAM user policy in Account B

Answer

IAM role in Account B with trust policy for Account A

Answer

IAM user in Account B with permissions to the bucket

Question 5

A company has a policy that requires all IAM users to use multi-factor authentication (MFA) to access the AWS Management Console. A user reports that they are unable to sign in even after configuring MFA. What is the most likely cause?

Accepted Answer

The MFA device is not properly synchronized with AWS.. The most likely cause is that the MFA device is not properly synchronized with AWS. When an IAM user configures MFA, the device must be synchronized with AWS to generate valid tokens. If synchronization fails, the token entered during sign-in will be rejected, preventing console access. Option A is unlikely because if the policy explicitly denied console access, the user would not be able to sign in at all regardless of MFA, but the user specifically reported having configured MFA and still fails. Option B is incorrect because the root account does not require MFA for console access by default, and the user stated they are an IAM user. Option C is incorrect because MFA tokens do not expire; they are time-based and change every 30 seconds, but the token itself does not become permanently invalid after a period. The issue is synchronization.

Answer

The IAM policy explicitly denies console access.

Answer

The user is using the root account instead of an IAM user.

Answer

The MFA token has expired.

Question 6

An organization wants to use AWS Organizations to centrally manage permissions for multiple accounts. Which IAM feature is used to grant cross-account access within the organization?

Accepted Answer

IAM roles. AWS Organizations allows you to centrally manage multiple accounts, but for actual cross-account access, IAM roles are the primary mechanism. You can create an IAM role in one account and allow users from another account (within or outside the organization) to assume that role. Service control policies (SCPs) set permission boundaries but do not grant direct access across accounts. Resource-based policies are used for service-specific cross-account access (e.g., S3 bucket policies), not for general IAM access. IAM groups are confined to a single account and cannot be used for cross-account access. Therefore, option A is correct.

Answer

Service control policies (SCPs)

Answer

Resource-based policies

Answer

IAM groups

Question 7

A developer needs to grant an EC2 instance access to an S3 bucket. Which is the most secure way to provide credentials to the EC2 instance?

Accepted Answer

Create an IAM role and attach it to the EC2 instance profile. It uses an IAM role attached to an EC2 instance profile, which allows the instance to obtain temporary, automatically rotated credentials from the AWS STS service via the instance metadata service (IMDS). This eliminates the need to hardcode, store, or manage long-term access keys, significantly reducing the risk of credential exposure.

Answer

Store AWS access keys in the application code

Answer

Store the keys in an S3 bucket and download them at startup

Answer

Use environment variables to store the keys

Question 8

A security team notices that an IAM user has permissions to launch EC2 instances but should not have access to certain instance types. Which IAM policy condition key should be used to restrict this?

Accepted Answer

ec2:InstanceType. The ec2:InstanceType condition key allows you to restrict IAM users to launching only specific EC2 instance types (e.g., t2.micro, m5.large) by evaluating the instance type value in the RunInstances API call. This is the correct key to enforce a policy that denies access to certain instance types while permitting others.

Answer

ec2:ResourceTag

Answer

ec2:Tenancy

Answer

ec2:InstanceProfile

Question 9

A company has a policy that all IAM users must rotate their access keys every 90 days. How can this be enforced?

Accepted Answer

Use AWS Config to check key age and automatically deactivate old keys. You can use an AWS Config managed rule (e.g., access-keys-rotated) to check whether IAM access keys have been rotated within 90 days. AWS Config can trigger a custom Lambda function to automatically deactivate keys that exceed the threshold, enforcing the policy. Options B, C, and D are not effective for enforcement: B's IAM password policy applies only to passwords, not access keys; C's CloudTrail is for logging, not automated enforcement; D's IAM policy cannot directly enforce key rotation because there is no condition to check key age in IAM policies.

Answer

Use an IAM password policy to set the key rotation period

Answer

Use AWS CloudTrail to monitor key usage and send alerts

Answer

Use an IAM policy with a condition for key age

Question 10

A security architect is designing a system where an S3 bucket must be accessed by users from multiple AWS accounts. The solution must use the principle of least privilege. Which approach should be used?

Accepted Answer

Create an IAM role in the bucket owner account and use a bucket policy that grants access to the role. The recommended approach for cross-account access to an S3 bucket while adhering to least privilege is to create an IAM role in the bucket owner account and attach a bucket policy that grants the necessary permissions to that role. Users from other AWS accounts can then assume this role to access the bucket, ensuring that access is temporary and centrally managed. Option A is correct. Option B is incorrect because granting s3:ListBucket and s3:GetObject to all IAM users violates least privilege. Option C is incorrect because SCPs are used for service control policies at the organization level, not for granting access to specific resources across accounts. Option D is incorrect because creating IAM roles in each account with a bucket policy allowing the role decentralizes permissions and does not enforce the principle of least privilege as effectively as the centralized role approach.

Answer

Grant s3:ListBucket and s3:GetObject to all IAM users in the account

Answer

Use an SCP to allow access to the bucket for all accounts in the organization

Answer

Use an IAM role in each account with a bucket policy allowing the role

Question 11

Which THREE statements about IAM roles are correct? (Choose THREE.)

Accepted Answer

IAM roles can be used by federated users.. The correct answers are A, D, and E. IAM roles can be used by federated users (A), can be assumed by AWS services (D), and are global entities not tied to a specific region (E). Option B is incorrect because IAM roles are commonly used for cross-account access. Option C is incorrect because roles are not attached to IAM users directly; instead, users assume roles.

Answer

IAM roles cannot be used for cross-account access.

Answer

IAM roles can be attached to an IAM user.

Question 12

Which TWO IAM policy conditions can be used to enforce that API calls originate from a specific AWS region? (Choose TWO.)

Accepted Answer

aws:SourceIp. The correct answers are C and D. aws:SourceIp can be used with known IP address ranges for a specific AWS region to restrict API calls to that region, effectively enforcing region-based access. aws:RequestedRegion directly checks the AWS region specified in the API request, providing a straightforward condition for region enforcement. Option A (ec2:Region) is specific to EC2 resources and not a general IAM condition for request origin. Option B (aws:UserAgent) checks the user agent string, not the region. Option E (aws:Region) checks the region of the resource, not the request origin.

Answer

ec2:Region

Answer

aws:UserAgent

Answer

aws:Region

Question 13

A company wants to allow a third-party auditor to read objects in an S3 bucket for a limited time. The auditor does not have an AWS account. What is the most secure way to grant this access?

Accepted Answer

Generate presigned URLs for all objects in the bucket and share them with the auditor.. Presigned URLs grant time-limited access to individual objects without requiring the auditor to have an AWS account or long-term credentials. This is the most secure method for a third party without an AWS account. Option C is incorrect because the auditor does not have an AWS account, so they cannot assume a cross-account IAM role. Option A is wrong because the auditor has no AWS account. Option D is wrong because sharing IAM user credentials is a security risk and not recommended.

Answer

Use a bucket policy that grants read access to the auditor's AWS account (if they have one).

Answer

Create a cross-account IAM role with an external ID and allow the auditor to assume the role using AWS STS.

Answer

Create an IAM user with read-only access and share the credentials with the auditor.

Question 14

A developer needs to allow an EC2 instance to access an S3 bucket. Which is the best practice for granting permissions?

Accepted Answer

Create an IAM role with S3 access and attach it to the EC2 instance profile.. An IAM role with S3 access attached to the EC2 instance profile provides temporary credentials via the instance metadata service, eliminating the need for long-term access keys. Option A is wrong because storing IAM user access keys on the instance is insecure and violates best practices. Option B is wrong because security groups control network traffic, not IAM permissions. Option C is wrong because an S3 bucket policy cannot grant access based on an EC2 instance ID; the principal must be an IAM user, role, or AWS account.

Answer

Store IAM user access keys in a configuration file on the EC2 instance.

Answer

Use a security group to allow the EC2 instance to access S3.

Answer

Attach an S3 bucket policy that grants access to the EC2 instance ID.

Question 15

A security engineer notices that an IAM user has permissions to create new IAM users and attach policies. What is the most effective way to detect if this user created a backdoor user?

Accepted Answer

Enable AWS CloudTrail and monitor IAM events using Amazon CloudWatch Logs and create a metric filter for CreateUser and AttachUserPolicy events.. AWS CloudTrail logs all IAM API calls, enabling detection of user creation and policy attachment. Option A is wrong because S3 access logs track object-level access, not IAM actions. Option B is wrong because IAM Access Analyzer focuses on resource policies, not user actions. Option C is wrong because AWS Config rules evaluate resource configurations (compliance), not API calls.

Answer

Review S3 access logs for any PutObject calls from the IAM user.

Answer

Use IAM Access Analyzer to review all IAM policies for potential backdoor access.

Answer

Configure an AWS Config rule to check for IAM users with administrative policies.