SCS-C02 Identity and Access Management Practice Test 8 — 15 Questions

Question 1

Refer to the exhibit. A developer is trying to list objects in an S3 bucket from an AWS environment. What is the most likely cause of the error?

Accepted Answer

The developer is using the wrong CLI tool (gsutil instead of aws s3).. The most likely cause of the error is that the developer is using the wrong CLI tool. The command shown in the exhibit (implied by the error) is likely 'gsutil', which is the Google Cloud Storage CLI, not the AWS CLI. To list objects in an S3 bucket, the developer must use 'aws s3 ls' or 'aws s3api list-objects'. Using gsutil against an S3 bucket will fail because gsutil does not recognize S3 endpoints or credentials.

Answer

The bucket name is incorrect.

Answer

The IAM role does not have S3 permissions.

Answer

The S3 bucket policy does not allow the user.

Question 2

Refer to the exhibit. This trust policy is attached to an IAM role. What does it allow?

Accepted Answer

The root user of account 123456789012 to assume the role only if MFA is present.. The trust policy specifies the root user of account 123456789012 and includes a condition requiring MFA. Option A is incorrect because the policy applies to the root user, not all IAM users. Option B is incorrect because the policy requires MFA, so the root user cannot assume the role without MFA. Option D is incorrect because the policy does not allow any user and requires MFA.

Answer

All IAM users in account 123456789012 to assume the role with MFA.

Answer

The root user of account 123456789012 to assume the role without MFA.

Answer

Any user in account 123456789012 to assume the role without MFA.

Question 3

A developer needs to allow an IAM user to manage their own password in the AWS Management Console. Which IAM policy should be attached to the user?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"iam:ChangePassword","Resource":"arn:aws:iam::*:user/${aws:username}"}]}. It uses the aws:username policy variable to restrict the iam:ChangePassword action to the user's own ARN, allowing the user to change only their own password. Option A is incorrect because it allows any IAM user to change any password. Option B is incorrect because it only allows the user to list users, not change passwords. Option C is incorrect because it denies the ability to change any password.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"iam:ChangePassword","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"iam:ListUsers","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"iam:ChangePassword","Resource":"*"}]}

Question 4

A security engineer notices that an IAM role allows an EC2 instance to access a DynamoDB table. The instance is compromised. What is the best way to immediately revoke the instance's access without affecting other resources that use the same role?

Accepted Answer

Attach a permissions boundary to the role that denies all DynamoDB actions.. Attaching a permissions boundary to the role that denies all DynamoDB actions immediately revokes the instance's access to DynamoDB without affecting other resources using the same role, provided those resources do not require DynamoDB access. Option B is wrong because stopping the instance does not revoke access; it only stops the instance, and access could resume when it restarts. Option C is wrong because modifying the trust policy to deny the instance's ARN would prevent the instance from assuming the role entirely, but it could take effect only after the current session ends and may not be immediate, and it does not address the compromised instance's ongoing session. Option D is wrong because deleting the role would affect all resources using that role.

Answer

Stop the EC2 instance.

Answer

Modify the trust policy of the role to deny the instance's ARN.

Answer

Delete the IAM role.

Question 5

Which TWO actions are valid ways to grant an IAM user access to an S3 bucket owned by another AWS account? (Choose TWO.)

Accepted Answer

Have the user assume an IAM role in the bucket-owning account with appropriate permissions.. Option A is correct because cross-account access is commonly granted by having the user in the trusted account call sts:AssumeRole to assume an IAM role in the bucket-owning account; the role's identity-based policy (and any bucket policy) then authorizes the S3 actions, and the user temporarily operates with the role's credentials. Option B is correct because an S3 bucket policy is a resource-based policy attached to the bucket in the owning account, and it can explicitly grant permissions to a principal in another AWS account (for example, arn:aws:iam::111122223333:user/Alice or the account root), which is a standard cross-account grant mechanism. Option C is not sufficient by itself because an identity-based IAM policy in the user's own account cannot grant access to a resource owned by a different account; the bucket-owning account must also allow the access via a bucket policy, ACL, or role trust/permissions. Option D is not valid for this purpose because S3 ACLs grant permissions only to AWS accounts or predefined groups, not to individual IAM user ARNs, so you cannot add a specific user's ARN to a bucket ACL. Option E is not a valid standalone cross-account grant because an S3 access point policy is evaluated together with the underlying bucket policy, so the bucket policy in the owning account must still permit the cross-account access.

Answer

Attach an IAM policy to the user in their own account allowing access to the bucket.

Answer

Add the user's ARN to the bucket's ACL.

Answer

Use an S3 access point with a policy that allows the user.

Question 6

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that any new account created in the organization automatically has an S3 bucket policy that blocks public access. What is the most efficient way to enforce this requirement?

Accepted Answer

Attach a service control policy (SCP) at the root level that denies the s3:PutBucketPublicAccessBlock action with a condition that the bucket must have public access blocked.. A service control policy (SCP) applied at the root OU can deny the s3:PutBucketPublicAccessBlock action unless the bucket has public access blocked, proactively enforcing the requirement for all accounts. Option A is wrong because manually deploying CloudFormation templates to each new account is not efficient. Option B is wrong because AWS Config rules with auto-remediation are reactive and require per-account setup, making them less efficient than an SCP. Option C is wrong because CloudFormation StackSets can deploy to multiple accounts but do not automatically include new accounts unless explicitly added.

Answer

Create an AWS CloudFormation template that includes the S3 bucket policy and deploy it to each new account manually.

Answer

Use AWS Config rules to detect S3 buckets without public access block and automatically remediate.

Answer

Use AWS CloudFormation StackSets to deploy the bucket policy to all existing and future accounts.

Question 7

A developer needs to access an S3 bucket from an EC2 instance. The developer creates an IAM role with the necessary S3 permissions and attaches it to the instance profile. However, applications running on the instance can still not access the bucket. What is the most likely cause?

Accepted Answer

The IAM role is not attached to the EC2 instance's instance profile.. The IAM role must be associated with the EC2 instance's instance profile. If the role is not attached to the instance profile, the instance cannot assume the role, and applications will not have the necessary permissions to access S3. Option A is incorrect because the instance metadata service is not required to be enabled for IAM roles to work; it is used to retrieve temporary credentials but is often enabled by default. Option C is incorrect because an IAM role can be attached to an existing instance via modifying the instance profile, not just at launch. Option D is incorrect because while a bucket policy can grant access to a specific role, it is not necessary if the role already has S3 permissions via an IAM policy.

Answer

The IAM role cannot be attached after the EC2 instance is launched.

Answer

The instance metadata service is disabled on the EC2 instance.

Answer

The S3 bucket policy does not explicitly grant access to the IAM role.

Question 8

A company wants to allow an external auditor to read all objects in a specific S3 bucket for a limited time. What is the most secure way to grant this access?

Accepted Answer

Generate pre-signed URLs for the objects the auditor needs to read, with an expiration time.. Pre-signed URLs grant time-limited access to specific S3 objects without changing bucket policies or creating IAM users. The auditor receives URLs that expire after a set period, and no long-term credentials or public access are exposed — making this the most secure, least-privilege approach for temporary external read access.

Answer

Use a bucket policy that allows access only from the auditor's IP address.

Answer

Make the bucket public and restrict access via IP address in the bucket policy.

Answer

Create an IAM user for the auditor with read-only access to the bucket and share the access keys.

Question 9

A company uses AWS Organizations with a service control policy (SCP) that denies all IAM actions unless the request comes from a specific IP address range. A security administrator needs to create a new IAM role for a service that runs on-premises, but the request is being denied. What should the administrator do?

Accepted Answer

Modify the SCP to include the on-premises IP address range in the condition.. The SCP denies all IAM actions unless the request comes from a specific IP range. To allow the on-premises environment to perform IAM actions, the administrator should modify the SCP to include the on-premises IP address range in the condition, making option A correct. Option B is incorrect because although the root user of the management account is not affected by SCPs, using the root user for routine tasks is against AWS best practices, and the requirement is to enable the on-premises service to operate, not to bypass the SCP entirely. Option C is incorrect because the SCP applies to all principals in the affected accounts, so creating a new IAM user would still be denied. Option D is incorrect because removing the account from the organization is unnecessary and disruptive; the SCP can be updated instead.

Answer

Use the root user of the management account to create the role, as root is not affected by SCPs.

Answer

Create a new IAM user in the account with full administrator access and use that user to create the role from the on-premises network.

Answer

Remove the account from the organization temporarily, create the role, and re-add the account.

Question 10

A company has a requirement that all IAM users must use multi-factor authentication (MFA) to access the AWS Management Console. Which TWO steps should the company take to enforce this?

Accepted Answer

Enable MFA devices for each IAM user.. Option A is correct because each IAM user must first have an MFA device registered (virtual or hardware) before MFA can be enforced for that user; without an assigned MFA device, the user cannot satisfy any MFA condition. Option C is correct because an IAM policy with a Deny effect and the condition "aws:MultiFactorAuthPresent": "false" (or a BoolIfExists check) blocks all API and console actions unless the user authenticated with MFA, which is the standard way to enforce MFA in IAM. Option B is not correct because SCPs apply only to AWS Organizations accounts and do not govern individual IAM users' MFA status, and the aws:MultiFactorAuthPresent condition is not usable in SCPs. Option D is not correct because enabling MFA only for the root user does not enforce MFA for IAM users. Option E is not correct because an IAM password policy controls password complexity, length, and rotation, not MFA.

Answer

Use a service control policy (SCP) to require MFA for all users.

Answer

Enable MFA for the root user only.

Answer

Configure an IAM password policy that requires MFA.

Question 11

A company wants to allow an IAM role from Account A to access an S3 bucket in Account B. Which THREE conditions must be met?

Accepted Answer

The S3 bucket policy in Account B must grant access to the IAM role in Account A.. Option A is correct because in cross-account access, the resource-based policy (the S3 bucket policy in Account B) must explicitly grant the IAM role in Account A permission to perform the required S3 actions; without this, Account B's bucket denies access by default. Option D is correct because an IAM role is not a principal that can act on its own — it must be assumed by an IAM user, application, or AWS service in Account A (via sts:AssumeRole), which then receives temporary credentials to access the bucket. Option E is correct because the identity-based permissions policy attached to the IAM role in Account A must also allow the required S3 actions; in cross-account access, both the identity policy and the resource policy must permit the request. Option B is incorrect because the role's trust policy governs who can assume the role (e.g., Account A principals), not the S3 bucket's account, so it does not need to trust Account B. Option C is incorrect because SCPs are optional guardrails that only apply within AWS Organizations and are not a mandatory condition for cross-account S3 access.

Answer

The IAM role in Account A must have a trust policy that allows the S3 bucket's account to assume the role.

Answer

A service control policy (SCP) must allow the cross-account access.

Question 12

Refer to the exhibit. An IAM user has this policy attached. The user tries to download an object from the S3 bucket using the AWS CLI from an on-premises server with IP address 198.51.100.50. What will happen?

Accepted Answer

The request will fail because the user's IP is not in the allowed range.. The policy includes an IP-based condition (aws:SourceIp) restricting access to a specific CIDR range, and the on-premises server's IP 198.51.100.50 falls outside that allowed range. Even though s3:GetObject is granted, the condition is not satisfied, so the request is denied. AWS evaluates all statements and conditions before allowing an action.

Answer

The request will succeed because the policy allows s3:GetObject.

Answer

The request will fail because the user must use HTTPS.

Answer

The request will fail because the user must use MFA.

Question 13

Refer to the exhibit. An EC2 instance is launched with an instance profile that references this role. The application on the instance tries to list objects in 'my-bucket' but receives an AccessDenied error. What is the most likely cause?

Accepted Answer

The S3 bucket has a bucket policy that denies access.. Even if the IAM role allows s3:ListBucket on the bucket, an explicit deny in the S3 bucket policy will override any allow, resulting in an AccessDenied error. This is a common scenario where both IAM and bucket policies are evaluated, and a deny in either causes denial of access. Option A is incorrect because the trust policy must allow EC2 for the instance profile to work; if it were wrong, the instance wouldn't be able to assume the role at all. Option B is incorrect because the action required to list objects is s3:ListBucket, not s3:GetObject; the error is for listing, not retrieving. Option D is incorrect because the role has a permissions policy attached (as shown in the exhibit); the issue is the bucket policy denying the request.

Answer

The trust policy does not allow the EC2 service to assume the role.

Answer

The policy does not grant s3:GetObject permission.

Answer

The role does not have any permissions policy attached.

Question 14

Refer to the exhibit. An IAM user 'ExternalUser' from account 111111111111 tries to assume the role 'MyRole' in account 123456789012 but receives an error. The user has a policy that allows sts:AssumeRole. What is the most likely reason for the failure?

Accepted Answer

The user's AWS account has a service control policy (SCP) that denies sts:AssumeRole.. Even though the user's identity-based policy allows sts:AssumeRole and the role's trust policy presumably permits the external account, an SCP attached at the AWS Organizations level in the user's account can explicitly deny sts:AssumeRole, which overrides all identity-based Allows. SCPs are evaluated as part of the authorization chain and an explicit Deny in an SCP blocks the action regardless of other policies. This is the most likely cause when the user's own policy looks correct.

Answer

The role does not exist in the target account.

Answer

The user must have MFA enabled to assume the role.

Answer

The trust policy does not specify a principal.

Question 15

An IAM policy has the following statement: { "Effect": "Deny", "Action": "s3:*", "Resource": "*", "Condition": { "BoolIfExists": { "aws:SecureTransport": "false" } } }. What does this policy do?

Accepted Answer

Denies all S3 access if the request is not using HTTPS.. The policy statement uses a Deny effect with a condition that checks if 'aws:SecureTransport' is false. The 'BoolIfExists' operator evaluates the condition only if the key exists; if the key is missing, it defaults to false, meaning the condition is not met and the Deny does not apply. Therefore, the policy denies all S3 access only when the request is not using HTTPS (i.e., SecureTransport is false).

Answer

Denies all S3 access for any request.

Answer

Requires MFA for all S3 access.

Answer

Allows all S3 access only if using HTTPS.