SCS-C02 Identity and Access Management Practice Test 7 — 15 Questions

Question 1

An organization wants to enforce multi-factor authentication (MFA) for all IAM users accessing the AWS Management Console. Which policy should be used?

Accepted Answer

A policy that denies all actions unless aws:MultiFactorAuthPresent is true.. It uses an IAM policy with a Deny effect on all actions when `aws:MultiFactorAuthPresent` is false (or not true). This ensures that any IAM user attempting to perform any action, including ConsoleLogin, must have authenticated with MFA; otherwise, the request is denied. This is the standard approach to enforce MFA for all AWS Management Console access.

Answer

A policy that allows all actions and denies when aws:MultiFactorAuthPresent is true.

Answer

A policy that allows all actions except ConsoleLogin unless MFA is present.

Answer

A policy that allows all actions when aws:MultiFactorAuthPresent is true.

Question 2

A company uses AWS Organizations and wants to restrict all IAM users in member accounts from using the Amazon EC2 RunInstances API unless they have MFA. What is the most efficient way to enforce this?

Accepted Answer

Create a service control policy (SCP) that denies ec2:RunInstances unless MFA is present, and attach it to the organization root or relevant OUs.. A service control policy (SCP) can centrally enforce restrictions across all accounts in the organization, denying ec2:RunInstances unless MFA is present. Option A is incorrect because managing policies per account is inefficient. Option B is incorrect because security groups only control network traffic, not API calls. Option D is incorrect because the root user policy does not affect member account IAM users.

Answer

Create an IAM policy in each member account and attach it to all IAM users.

Answer

Use a security group to block outbound traffic from EC2 instances unless MFA is used.

Answer

Attach a policy to the root user of the master account.

Question 3

A security team wants to grant a Lambda function access to read from a DynamoDB table in the same account. What is the most secure way to do this?

Accepted Answer

Create an IAM role with a policy that allows only the required DynamoDB actions (e.g., GetItem, Query) on the specific table and assign it to the Lambda function.. The most secure method is D because it follows the principle of least privilege by creating a custom IAM role that grants only the necessary DynamoDB actions (like GetItem, Query) on the specific table. This limits the Lambda function's permissions to only what is required. Option A is incorrect because a VPC endpoint allows network access to DynamoDB but does not grant IAM permissions; the Lambda function still needs an IAM role with appropriate permissions. Option B is incorrect because attaching the managed policy AmazonDynamoDBFullAccess grants full access to all DynamoDB resources, violating least privilege and increasing security risk. Option C is incorrect because storing database access keys in Lambda environment variables exposes credentials and is insecure; the recommended approach is to use an IAM execution role.

Answer

Create a VPC endpoint for DynamoDB and associate it with the Lambda function.

Answer

Attach the AWS managed policy AmazonDynamoDBFullAccess to the Lambda execution role.

Answer

Store the database access keys in the Lambda environment variables.

Question 4

A company wants to allow users to assume a role in another AWS account to access a specific S3 bucket. What must be configured?

Accepted Answer

An IAM role with a trust policy allowing the user's account and a bucket policy granting the role access to the bucket.. Both the trust policy (in the account with the role) and the resource-based policy (on the bucket) must allow access. Option A is wrong because a trust policy alone is insufficient; the bucket policy must also grant access. Option B is wrong because the bucket policy alone is insufficient; the role trust policy must allow the user to assume the role. Option D is wrong because resource-based policies alone cannot grant cross-account role assumption.

Answer

A trust policy on the IAM role that allows the user's account to assume the role.

Answer

An S3 bucket policy that allows the user to access the bucket.

Answer

A resource-based policy on the S3 bucket that allows the user's account.

Question 5

An administrator is troubleshooting an issue where an IAM user cannot launch an EC2 instance in a specific VPC. The user has the AmazonEC2FullAccess policy attached. What is the most likely cause?

Accepted Answer

The user's permissions boundary blocks EC2 actions.. The most likely cause is that the user's permissions boundary blocks EC2 actions, specifically by not allowing ec2:RunInstances for the specified VPC. Permissions boundaries can include conditions that restrict actions to certain resources, such as a specific VPC. Since the user has AmazonEC2FullAccess, which allows all EC2 actions, a permissions boundary can limit these permissions. Option B is incorrect because account limits are not specific to a single VPC. Option C is incorrect because VPCs do not support resource-based IAM policies; IAM policies cannot be attached directly to a VPC. Option D is incorrect because key pair ownership does not affect the ability to launch an instance in a specific VPC.

Answer

The user has exceeded the maximum number of EC2 instances allowed.

Answer

The VPC has an IAM policy attached that denies the ec2:RunInstances action.

Answer

The key pair specified is not owned by the user.

Question 6

A company uses AWS SSO to manage access to multiple accounts. An employee leaves the company. What is the most efficient way to revoke all AWS access for that employee?

Accepted Answer

Deactivate the user in the connected identity provider (e.g., Active Directory).. The most efficient way to revoke all AWS access for a former employee is to deactivate the user in the connected identity provider (e.g., Active Directory). AWS SSO relies on the external IdP for authentication; once the user is deactivated there, they cannot authenticate to AWS SSO, and all active SSO sessions are invalidated. This single action immediately blocks access across all accounts and applications federated through AWS SSO, without needing to touch individual IAM roles or accounts.

Answer

Delete the corresponding IAM user in every AWS account.

Answer

Remove the user from all groups in AWS SSO.

Answer

Delete the IAM role that the user assumes in each account.

Question 7

A security engineer is designing a system to allow an EC2 instance to write logs to an S3 bucket. Which TWO steps are required?

Accepted Answer

Add a bucket policy that allows the IAM role to perform s3:PutObject.. Options C and D are correct. The EC2 instance needs an IAM role with permissions to write to the bucket (D), and the bucket policy must allow the role to write (C). Option A is incorrect because a security group controls network traffic but does not grant IAM permissions. Option B is incorrect because a VPC endpoint provides private connectivity but is not required for this task. Option E is incorrect because CloudTrail is for API logging, not application logs.

Answer

Configure the security group of the EC2 instance to allow outbound HTTPS traffic to S3.

Answer

Create a VPC endpoint for S3 in the same subnet as the EC2 instance.

Answer

Enable AWS CloudTrail to capture log write events.

Question 8

An organization wants to enforce that all IAM users must use MFA to access the AWS API. Which TWO steps should be taken?

Accepted Answer

Attach the policy to all IAM users or to a group that all users belong to.. Options B and C are correct. An IAM policy with a condition that denies access if MFA is not present (C) must be attached to all users or groups (B). Option A is wrong because rotating access keys does not enforce MFA. Option D is wrong because password policy only affects console login. Option E is wrong because SCPs cannot enforce MFA for IAM users in the same account; they apply to member accounts.

Answer

Rotate all IAM user access keys.

Answer

Configure the account password policy to require MFA.

Answer

Create a service control policy (SCP) that requires MFA for all API calls.

Question 9

A company wants to grant a set of developers the ability to launch EC2 instances but only in a specific subnet. Which THREE steps should be taken?

Accepted Answer

Add a condition to the policy that restricts the subnet ID using ec2:Subnet.. To grant developers the ability to launch EC2 instances only in a specific subnet, you need to create an IAM role with a policy that allows ec2:RunInstances (E) and add a condition to restrict the subnet ID using ec2:Subnet (B). The developers must be allowed to assume this role via an IAM policy or trust relationship (C). Option A is incorrect because a VPC endpoint does not grant IAM permissions; it provides private connectivity. Option D is incorrect because security groups control network traffic, not IAM permissions.

Answer

Create a VPC endpoint for EC2.

Answer

Configure a security group to allow outbound traffic from the subnet.

Question 10

An AWS Lambda function needs to read from a DynamoDB table. What is the best practice for granting the Lambda function the necessary permissions?

Accepted Answer

Create an IAM role with the necessary permissions and attach it as the Lambda function's execution role.. Attaching an IAM role as the Lambda function's execution role is the standard and secure method for granting permissions to AWS services. The Lambda service assumes the role to obtain temporary credentials for accessing DynamoDB. Option A is wrong because resource-based policies are used for services like S3 buckets or SQS queues, not for DynamoDB table access by Lambda. Option B is wrong because IAM users are for human identities, not for service-to-service access; using an execution role is the proper approach. Option D is wrong because embedding credentials in code is insecure and violates best practices.

Answer

Use a resource-based policy on the DynamoDB table to allow the Lambda function.

Answer

Create an IAM user with the necessary permissions and assign it to the Lambda function.

Answer

Embed the IAM user's access key and secret key in the Lambda function code.

Question 11

A security engineer is troubleshooting an issue where an IAM policy allows access to S3 but the user is denied access to a specific bucket. The policy has the following statement:

{
  "Effect": "Allow",
  "Action": "s3:*",
  "Resource": "*"
}

What is the most likely cause of the denial?

Accepted Answer

An explicit deny statement in a different policy (e.g., SCP, permissions boundary) is overriding the allow.. An explicit deny in a separate policy (e.g., service control policy, permissions boundary, or another IAM policy) overrides any allow. Even though the user's policy allows s3:* on all resources, an explicit deny for that specific bucket will deny access. Option A is incorrect because AWS does not automatically deny access to specific buckets based on broad policies. Option C is incorrect because the bucket policy could deny access, but that is not the 'most likely' cause given the IAM allow; an explicit deny in an SCP or permissions boundary is more common in troubleshooting. Option D is incorrect because assuming a role would replace the user's permissions, but the scenario does not indicate role assumption.

Answer

The policy statement is too broad and AWS automatically denies access to specific buckets.

Answer

The S3 bucket has a bucket policy that denies access to the user.

Answer

The policy is attached to the user but the user is assuming a role that does not have S3 permissions.

Question 12

An application running on an EC2 instance needs to access an S3 bucket. What is the most secure way to grant the EC2 instance the necessary permissions?

Accepted Answer

Create an IAM role with the necessary S3 permissions and attach it to the EC2 instance as an instance profile.. The most secure way to grant permissions to an EC2 instance is to use an IAM role attached as an instance profile. This avoids hardcoding credentials in the instance, which is a security risk. Option A correctly describes this approach. Option B is less secure because encrypted files still require managing encryption keys. Option C is insecure because credentials in code can be exposed. Option D is not suitable because bucket policies based on IP can be spoofed and do not provide fine-grained access control.

Answer

Store the credentials in an encrypted file on the EC2 instance and decrypt them at runtime.

Answer

Store the AWS access key and secret key in the application code.

Answer

Use an S3 bucket policy that allows access from the EC2 instance's public IP address.

Question 13

An IAM user reports that they are unable to launch an EC2 instance in a specific VPC. The user has an IAM policy that allows ec2:RunInstances but does not grant permission for the subnet resource. The VPC has a network ACL that allows all inbound and outbound traffic. What is the most likely cause of the failure?

Accepted Answer

The IAM policy does not grant permission to use the subnet.. To launch an instance into a specific subnet, the IAM user needs permission for the subnet resource (ec2:Subnet) in addition to the ec2:RunInstances action. Even though the policy allows ec2:RunInstances for all resources, if the policy does not also grant permission for the subnet, the launch will fail. Option A is incorrect because the VPC itself is not a resource that requires IAM permission for RunInstances; the subnet is the resource. Option B is incorrect because security groups do not affect the ability to launch an instance; they only control traffic to/from the instance after launch. Option D is incorrect because network ACLs operate at the subnet level and do not prevent the launch request; they filter traffic after the instance is running.

Answer

The IAM policy does not grant permission to use the VPC.

Answer

The security group associated with the instance is blocking the launch.

Answer

The network ACL is blocking the launch request.

Question 14

A company wants to grant an IAM user the ability to rotate their own access keys. What is the least privileged IAM policy that allows this?

Accepted Answer

A policy with Action: 'iam:CreateAccessKey', 'iam:DeleteAccessKey', 'iam:UpdateAccessKey' and Resource: 'arn:aws:iam::*:user/${aws:username}'. It grants only the specific actions required to rotate access keys (CreateAccessKey, DeleteAccessKey, UpdateAccessKey) and restricts the resource to the user's own path using the ${aws:username} variable. This ensures the IAM user can only manage their own keys, adhering to the least privilege principle.

Answer

A policy with Action: 'iam:*AccessKey*' and Resource: 'arn:aws:iam::*:user/*'

Answer

A policy with Action: 'iam:ListAccessKeys' and 'iam:GetAccessKeyLastUsed' and Resource: '*'

Answer

A policy with Action: 'iam:*' and Resource: '*'

Question 15

A company uses AWS Organizations and wants to restrict all IAM users in all accounts from using the AWS Management Console. What is the most effective way to achieve this?

Accepted Answer

Create an SCP with a condition that denies access if the user is signing in using the AWS Management Console.. A service control policy (SCP) with a condition that denies access when the user is signing in via the AWS Management Console can be applied at the organizational level to restrict all IAM users across all accounts. Option B is incorrect because an IAM password policy only sets password requirements; it does not prevent users from signing in to the console. Option C is incorrect because an SCP that denies iam:CreateLoginProfile would only stop new login profile creation; existing users with login profiles could still access the console. Additionally, SCPs cannot be overridden by account administrators. Option D is incorrect because restricting a region does not block console access; users could still sign in to the console in other regions.

Answer

Set an IAM password policy that requires strong passwords.

Answer

Create a service control policy (SCP) that denies the 'iam:CreateLoginProfile' action and attach it to all accounts.

Answer

Create an SCP that denies the 'aws:RequestedRegion' condition for us-east-1.