SCS-C02 Identity and Access Management Practice Test 7 — 15 Questions

Question 1

A security engineer is analyzing an IAM policy that is attached to a group. The policy is intended to allow users to manage their own credentials. However, users are reporting that they cannot change their password. The policy is: 
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["iam:ChangePassword", "iam:GetAccountPasswordPolicy"],
      "Resource": "*"
    }
  ]
}
What is the issue?

Accepted Answer

The policy resource is set to "*", but ChangePassword requires the resource to be the specific user ARN.. The ChangePassword action requires the resource ARN to be the specific user's ARN (e.g., arn:aws:iam::account-id:user/${aws:username}). Using a wildcard '*' causes the policy to fail because IAM validates the resource ARN against the user's own ARN. Options A and C are incorrect because the required action is iam:ChangePassword, not UpdateLoginProfile or CreateLoginProfile. Option B is incorrect because the policy attachment to the group is not the issue; the resource restriction is the problem.

Answer

The policy does not include the iam:UpdateLoginProfile action.

Answer

The policy should be attached to the user instead of the group.

Answer

The policy is missing the iam:CreateLoginProfile action.

Question 2

A company needs to implement a cross-account access strategy where users in Account A can assume a role in Account B. Which TWO steps are necessary? (Choose TWO.)

Accepted Answer

Attach an IAM policy to the users or groups in Account A that allows sts:AssumeRole targeting the role ARN in Account B.. Option E is correct because cross-account role assumption requires an IAM role in the trusting account (Account B) whose trust policy (AssumeRolePolicyDocument) explicitly lists Account A's principal (e.g., arn:aws:iam::<AccountA-ID>:root or specific users) as an allowed sts:AssumeRole principal. Option A is correct because the calling identity in Account A must have an identity-based IAM policy granting sts:AssumeRole on the target role ARN in Account B; without this permission, the AssumeRole call is denied even if the trust policy allows it. Option B is wrong because cross-account access uses role assumption, not duplicated IAM users, and matching usernames across accounts grant no permissions. Option C is wrong because MFA is not a required step for cross-account AssumeRole, though it can be enforced via a condition if desired. Option D is wrong because an IAM role's permissions are defined by its identity-based policy and trust policy; resource-based policies apply to resources like S3 buckets or KMS keys, not to IAM roles for the AssumeRole trust relationship.

Answer

Create an IAM user in Account B with the same name as the users in Account A.

Answer

Enable MFA for all users in Account A.

Answer

Attach a resource-based policy to the IAM role in Account B.

Question 3

A company has an S3 bucket that stores sensitive data. The security team requires that all access to the bucket be logged in AWS CloudTrail and that all requests must be authenticated using IAM credentials. Which S3 bucket policy statement should be added to enforce these requirements?

Accepted Answer

"Deny" effect with "Null" condition on "aws:PrincipalArn". A Deny effect with a Null condition on aws:PrincipalArn blocks any request where the principal ARN is missing, which effectively denies anonymous (unauthenticated) requests. This enforces that all requests must be authenticated using IAM credentials. Combined with CloudTrail data events logging, this satisfies the requirement. The Null condition is the standard way to require that a key is present in the request context.

Answer

"Deny" effect with "StringNotEquals" on "aws:SourceIdentity"

Answer

"Deny" effect with "aws:SourceIp" condition

Answer

"Allow" effect with "Referer" condition

Question 4

An AWS administrator needs to allow an IAM user to manage their own password and access keys. Which IAM policy action should be included?

Accepted Answer

iam:ChangePassword and iam:UpdateAccessKey. The IAM user needs to manage their own password and access keys. The action iam:ChangePassword allows the user to change their own password, and iam:UpdateAccessKey allows updating their own access keys. Option A (iam:CreateGroup) is for managing groups, not user credentials. Option B (iam:CreateUser) is for creating new users, not self-management. Option C (iam:DeleteLoginProfile) removes a login profile, which is the opposite of what is needed.

Answer

iam:CreateGroup

Answer

iam:CreateUser

Answer

iam:DeleteLoginProfile

Question 5

A security engineer is troubleshooting an issue where an EC2 instance cannot access an S3 bucket even though the IAM role attached to the instance has an Allow policy for s3:GetObject. The S3 bucket policy includes a Deny statement with the condition 'aws:SourceIp': ['10.0.0.0/8']. What is the likely cause of the failure?

Accepted Answer

The Deny statement in the bucket policy is blocking the request because the EC2 instance’s IP falls within the 10.0.0.0/8 range.. The S3 bucket policy includes a Deny statement with the condition 'aws:SourceIp': ['10.0.0.0/8']. This Deny overrides any Allow from the IAM role because explicit Deny takes precedence. Even though the IAM role allows s3:GetObject, the request is denied because the EC2 instance's IP address falls within the 10.0.0.0/8 range. Option A is incorrect because permissions boundaries restrict the maximum permissions but do not affect this specific Deny. Option B is incorrect because an STS trust policy is not required for EC2 to assume a role; the instance profile handles that. Option C is incorrect because cross-region access to S3 is allowed and not the cause of the failure.

Answer

The IAM role’s permissions boundary is blocking the action.

Answer

The IAM role does not have an STS trust policy.

Answer

The S3 bucket is in a different region.

Question 6

An organization is using IAM roles for EC2 instances. The security team needs to ensure that each EC2 instance can only assume a specific role based on tags. Which feature should be used?

Accepted Answer

Role trust policy with 'aws:ResourceTag' condition. The role trust policy can use the 'aws:ResourceTag' condition key to restrict which EC2 instances can assume the role based on the instance's tags. This ensures that only instances with specific tags (e.g., 'Environment=Production') are allowed to assume the IAM role, meeting the security team's requirement for tag-based role assumption.

Answer

Service Control Policy (SCP)

Answer

IAM policy with 'aws:SourceIp' condition

Answer

IAM permissions boundary

Question 7

A developer is trying to upload a file to an S3 bucket using the AWS CLI, but receives an 'AccessDenied' error. The IAM policy attached to the user includes 's3:PutObject' on the bucket. The bucket policy has a Deny statement with the condition 'aws:Referer': ['example.com']. The CLI command does not include a referer header. What is the cause of the error?

Accepted Answer

The bucket policy denies requests that do not include the required referer header.. The Deny statement with a condition that does not match the request (no referer header) still denies the request if the condition is not met? Actually, the Deny statement with a condition only denies if the condition evaluates to true. Since the request has no referer, the condition 'StringNotEquals'? Wait, typical bucket policy is: Deny unless referer equals example.com. But if the request has no referer, the condition fails, so the Deny does not apply. However, the error persists. Possibly the bucket policy has an explicit Deny for all requests without the referer. In that case, the Deny applies. So Option B is correct: the Deny is blocking requests without the referer. Option A is wrong because CLI uses HTTPS. Option C is irrelevant. Option D is not the cause.

Answer

The user’s access keys are expired.

Answer

The IAM policy does not include s3:PutObjectAcl.

Answer

The CLI is not using HTTPS.

Question 8

A company needs to allow an external auditor to access a specific S3 bucket for 30 days. The auditor does not have an AWS account. What is the MOST secure way to grant temporary access?

Accepted Answer

Use AWS STS to issue temporary credentials via a custom identity broker.. Using AWS STS to issue temporary credentials via a custom identity broker is the most secure way to grant temporary access to an external auditor without an AWS account. The broker can authenticate the auditor through an existing identity system and then call STS to assume a role and return temporary credentials.

Answer

Create an IAM user with long-term credentials and share them with the auditor.

Answer

Grant access via a bucket policy using the auditor's email address as a condition.

Answer

Create an IAM role and allow the auditor to assume it using SAML federation.

Question 9

A security engineer is designing a solution to allow a Lambda function to write logs to CloudWatch Logs. Which TWO actions are required in the IAM execution role? (Choose TWO.)

Accepted Answer

logs:PutLogEvents. The correct options are B and E. To allow a Lambda function to write logs to CloudWatch Logs, the IAM execution role must include permissions to create a log group (logs:CreateLogGroup) if it does not already exist and to put log events (logs:PutLogEvents). While logs:CreateLogStream is also typically required, the question asks for TWO actions, and of the given options, B and E are the necessary ones. Option A (logs:GetLogEvents) is for reading logs, C (logs:CreateLogStream) is also needed but not listed as a correct choice in this two-answer scenario, and D (logs:PutRetentionPolicy) configures retention, not writing.

Answer

logs:GetLogEvents

Answer

logs:CreateLogStream

Answer

logs:PutRetentionPolicy

Question 10

A company is using AWS Organizations with multiple accounts. The security team wants to enforce that all IAM users must have MFA enabled. Which TWO methods can be used to enforce this? (Choose TWO.)

Accepted Answer

Attach an IAM policy that denies all actions unless MFA is present.. Option A is correct because an IAM policy with a Deny statement conditioned on aws:MultiFactorAuthPresent being false (or a BoolIfExists condition) can block all API actions for IAM users who have not authenticated with MFA, directly enforcing MFA at the identity/permission level. Option D is correct because AWS Organizations Service Control Policies can include a Deny with the aws:MultiFactorAuthPresent condition, applying the MFA requirement across all accounts in the organization and preventing non-MFA principals from performing actions regardless of their IAM permissions. Option B is wrong because an account password policy controls password complexity, length, and rotation—it has no setting to require MFA. Option C is wrong because requiring MFA for IAM roles is not a valid enforcement mechanism for IAM users; roles use temporary credentials and trust policies, not the user MFA requirement described. Option E is wrong because S3 MFA Delete only protects specific S3 versioning operations (permanently deleting object versions or changing versioning state) and does not enforce MFA for IAM users generally.

Answer

Configure a password policy that requires MFA.

Answer

Require MFA for all IAM roles.

Answer

Enable MFA delete on S3 buckets.

Question 11

Refer to the exhibit. A user has this IAM policy attached. They attempt to download an object from example-bucket using the AWS CLI without specifying server-side encryption. Will the request succeed?

Accepted Answer

No, because the condition is not satisfied.. The IAM policy includes a condition that requires server-side encryption (for example, s3:x-amz-server-side-encryption to equal AES256 or aws:kms) for the s3:GetObject action. Because the CLI request was made without specifying server-side encryption headers, the condition evaluates to false, the Allow statement does not apply, and the request is denied by default. The condition is a hard gate on the Allow, not an optional hint.

Answer

Yes, because the bucket policy may override the condition.

Answer

No, because S3 requires encryption for all requests.

Answer

Yes, because the Allow statement grants s3:GetObject.

Question 12

Refer to the exhibit. An IAM user has this policy attached. Can the user create a new IAM user in the us-east-1 region?

Accepted Answer

No, because the Deny statement blocks all IAM actions in us-east-1.. An explicit Deny in IAM always overrides any Allow, and the Deny statement in the policy blocks all IAM actions in us-east-1. Even though the Allow statement permits CreateUser, the Deny takes precedence, so the user cannot create a new IAM user in that region. This is the fundamental IAM policy evaluation logic: explicit deny wins.

Answer

Yes, because the Allow statement explicitly permits CreateUser.

Answer

No, because IAM is a global service and region conditions do not apply.

Answer

Yes, because the Deny only applies to us-east-1.

Question 13

A security engineer is designing a cross-account IAM role to allow users in Account A to access resources in Account B. The engineer wants to restrict access to only users who have authenticated with multi-factor authentication (MFA) in Account A. What condition key should the engineer use in the trust policy of the IAM role in Account B?

Accepted Answer

aws:MultiFactorAuthPresent. The aws:MultiFactorAuthPresent condition key evaluates to true when the principal authenticated with MFA, so it can be used in the trust policy of the cross-account role in Account B to require MFA. Combined with a condition like 'aws:MultiFactorAuthPresent': 'true', the role can only be assumed by users in Account A who presented an MFA token. This is the canonical way to enforce MFA on cross-account role assumption.

Answer

aws:SourceIp

Answer

aws:RequestedRegion

Answer

aws:UserAgent

Question 14

A developer is trying to push an image to Amazon ECR but receives an 'AccessDeniedException' error. The developer's IAM user has the 'AmazonEC2ContainerRegistryPowerUser' managed policy attached. What is the most likely reason for the failure?

Accepted Answer

The developer needs to call 'ecr:GetAuthorizationToken' and authenticate to the registry.. The 'AmazonEC2ContainerRegistryPowerUser' managed policy includes permissions for pushing and pulling images but does not include 'ecr:GetAuthorizationToken', which is required to authenticate Docker to the registry. Without a valid token, the push request is denied with 'AccessDeniedException'. Option B is incorrect because the error is about authentication, not region support; ECR is available in all commercial regions. Option C is incorrect because a resource policy would cause 'AccessDeniedException' if it explicitly denies, but the PowerUser policy already lacks the necessary auth permission, which is the more direct cause. Option D is incorrect because ECR has a size limit (5 GB for default layers), but that would yield a different error message, not 'AccessDeniedException'.

Answer

The developer is pushing from an unsupported region.

Answer

The ECR repository has a resource policy that denies the push.

Answer

The image is too large for ECR.

Question 15

A security auditor notices that an IAM role has a policy that grants 'iam:PassRole' to a specific EC2 instance profile. What is the security implication of this permission?

Accepted Answer

It could allow privilege escalation if the role passes a role with more permissions to an EC2 instance.. 'iam:PassRole' allows an IAM entity to pass an existing role to an AWS service such as EC2. If the passed role has more permissions than the entity's own role, this can lead to privilege escalation by granting the EC2 instance (and thus the user who accesses it) those elevated permissions. Option B is incorrect because 'iam:PassRole' does not grant permission to delete IAM roles; that requires the 'iam:DeleteRole' action. Option C is incorrect because creating IAM policies requires 'iam:CreatePolicy'. Option D is incorrect because creating IAM users requires 'iam:CreateUser'.

Answer

It allows the role to delete IAM roles.

Answer

It allows the role to create new IAM policies.

Answer

It allows the role to create new IAM users.