SCS-C02 Identity and Access Management Practice Test 9 — 15 Questions

Question 1

A security engineer is troubleshooting an issue where an IAM policy allows access to S3 but the user is denied access to a specific bucket. The policy has the following statement:

{
  "Effect": "Allow",
  "Action": "s3:*",
  "Resource": "*"
}

What is the most likely cause of the denial?

Accepted Answer

An explicit deny statement in a different policy (e.g., SCP, permissions boundary) is overriding the allow.. Option A is correct because an explicit deny in a separate policy, such as a service control policy (SCP) or a permissions boundary, overrides any allow. Option B is wrong because the user's own policy is an allow. Option C is wrong because S3 bucket policies are resource-based and can deny access. Option D is wrong because IAM policies are evaluated as a whole; there is no implicit deny for specific buckets unless a deny exists.

Answer

The policy statement is too broad and AWS automatically denies access to specific buckets.

Answer

The S3 bucket has a bucket policy that denies access to the user.

Answer

The policy is attached to the user but the user is assuming a role that does not have S3 permissions.

Question 2

A company wants to allow cross-account access to an S3 bucket in Account A for a user in Account B. What is the correct combination of steps?

Accepted Answer

Add a bucket policy in Account A allowing access to Account B, and attach an IAM policy to the user in Account B allowing access to the bucket.. Option D is correct because cross-account access requires both a bucket policy allowing the user and an IAM user policy allowing access to the bucket. Option A is wrong because only the bucket policy is not sufficient; the user also needs permissions. Option B is wrong because the bucket policy needs to specify the user ARN, not just the account. Option C is wrong because a role needs to be assumed, but the question asks for user access.

Answer

Add a bucket policy in Account A allowing access to the user in Account B, and attach an IAM policy to the user in Account B allowing access to the bucket.

Answer

Create an IAM role in Account A with access to the bucket, and have the user in Account B assume that role.

Answer

Add a bucket policy in Account A allowing access to Account B, and no action is needed in Account B because the user already has permissions.

Question 3

An application running on an EC2 instance needs to access an S3 bucket. What is the most secure way to grant the EC2 instance the necessary permissions?

Accepted Answer

Create an IAM role with the necessary S3 permissions and attach it to the EC2 instance as an instance profile.. Option B is correct because an IAM instance profile is the recommended way to grant permissions to EC2 instances. Option A is wrong because storing credentials in the code is insecure. Option C is wrong because storing credentials in an encrypted file still requires managing keys. Option D is wrong because S3 bucket policies are not designed to grant permissions to EC2 instances directly.

Answer

Store the credentials in an encrypted file on the EC2 instance and decrypt them at runtime.

Answer

Store the AWS access key and secret key in the application code.

Answer

Use an S3 bucket policy that allows access from the EC2 instance's public IP address.

Question 4

A security team needs to audit all changes to IAM resources in their AWS account. Which AWS service should they use?

Accepted Answer

AWS CloudTrail. Option C is correct because AWS CloudTrail records API calls, including IAM changes. Option A is wrong because AWS Config records resource configurations but not all API calls. Option B is wrong because CloudWatch Logs stores logs but does not capture API calls by default. Option D is wrong because VPC Flow Logs capture network traffic, not IAM changes.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 5

An IAM user reports that they are unable to launch an EC2 instance in a specific VPC. The user has an IAM policy that allows ec2:RunInstances for all resources. The VPC has a network ACL that allows all inbound and outbound traffic. What is the most likely cause of the failure?

Accepted Answer

The IAM policy does not grant permission to use the subnet.. Option D is correct because the user needs to specify a subnet when launching an instance, and the IAM policy may not grant permission for the specific subnet if it has a condition. However, the more likely cause is that the user does not have permission to use the subnet resource. Option A is wrong because the VPC is not a resource that requires IAM permissions for the instance launch; the instance is launched into a subnet. Option B is wrong because security groups do not affect the ability to launch instances. Option C is wrong because network ACLs do not affect the ability to launch instances.

Answer

The IAM policy does not grant permission to use the VPC.

Answer

The security group associated with the instance is blocking the launch.

Answer

The network ACL is blocking the launch request.

Question 6

A company wants to grant an IAM user the ability to rotate their own access keys. What is the least privileged IAM policy that allows this?

Accepted Answer

A policy with Action: 'iam:CreateAccessKey', 'iam:DeleteAccessKey', 'iam:UpdateAccessKey' and Resource: 'arn:aws:iam::*:user/${aws:username}'. Option B is correct because it allows the user to manage their own access keys. Option A is wrong because it grants full IAM access. Option C is wrong because it does not allow deleting or creating keys. Option D is wrong because it requires a specific resource ARN with a wildcard, which is not necessary for self-management.

Answer

A policy with Action: 'iam:*AccessKey*' and Resource: 'arn:aws:iam::*:user/*'

Answer

A policy with Action: 'iam:ListAccessKeys' and 'iam:GetAccessKeyLastUsed' and Resource: '*'

Answer

A policy with Action: 'iam:*' and Resource: '*'

Question 7

A company uses AWS Organizations and wants to restrict all IAM users in all accounts from using the AWS Management Console. What is the most effective way to achieve this?

Accepted Answer

Create an SCP with a condition that denies access if the user is signing in using the AWS Management Console.. Option A is correct because an SCP can deny console access for all users across all accounts. Option B is wrong because it only applies to the root user. Option C is wrong because IAM policies are per-account and can be overridden by administrators. Option D is wrong because password policies do not prevent console access if the user has a password.

Answer

Set an IAM password policy that requires strong passwords.

Answer

Create a service control policy (SCP) that denies the 'iam:CreateLoginProfile' action and attach it to all accounts.

Answer

Create an SCP that denies the 'aws:RequestedRegion' condition for us-east-1.

Question 8

Which TWO actions are valid ways to grant an IAM user in Account A access to an S3 bucket in Account B? (Choose 2.)

Accepted Answer

Add a bucket policy in Account B that grants access to the user's ARN in Account A.. Options B and C are correct. B: A bucket policy can grant cross-account access to a specific user. C: A role in Account B can be assumed by the user in Account A. Option A is wrong because IAM users cannot be granted access directly to resources in other accounts via an IAM policy in their own account; the resource account must also grant access. Option D is wrong because the S3 bucket cannot have an IAM policy; it uses bucket policies. Option E is wrong because SCPs are used in AWS Organizations to set permissions boundaries, not to grant access.

Answer

Attach an IAM policy to the user in Account A that allows access to the S3 bucket.

Answer

Use a service control policy (SCP) in Account B to allow access from Account A.

Answer

Add an IAM policy to the S3 bucket in Account B granting access to the user.

Question 9

Which TWO are valid IAM identity-based policies? (Choose 2.)

Accepted Answer

Inline policy. Options B and D are correct. B: An AWS managed policy is a standalone policy that can be attached to IAM identities. D: An inline policy is embedded directly in a user, group, or role. Option A is wrong because a bucket policy is a resource-based policy, not identity-based. Option C is wrong because an SCP is a policy used in AWS Organizations, not an identity-based policy. Option E is wrong because a trust policy is attached to a role to define who can assume it, not an identity-based policy.

Answer

Trust policy

Answer

S3 bucket policy

Answer

Service control policy (SCP)

Question 10

Which THREE are valid ways to restrict access to an S3 bucket using IAM policies? (Choose 3.)

Accepted Answer

Requiring server-side encryption using the 's3:x-amz-server-side-encryption' condition key. Options B, C, and D are correct. B: You can use condition keys like 's3:x-amz-server-side-encryption' in an IAM policy. C: You can limit access to specific IP addresses using the 'aws:SourceIp' condition key. D: You can restrict access to specific VPCs using the 'aws:SourceVpc' condition key. Option A is wrong because IAM policies cannot use the 'aws:PrincipalOrgID' condition key to restrict access to an S3 bucket; that key is used in resource-based policies. Option E is wrong because restricting access to a specific bucket is done by specifying the bucket ARN in the Resource element, not by a condition key.

Answer

Using the 'aws:PrincipalOrgID' condition key

Answer

Using the 's3:ResourceAccount' condition key to restrict access to a specific bucket

Question 11

Which TWO are characteristics of an IAM role? (Choose 2.)

Accepted Answer

It does not have long-term access keys.. Options A and C are correct. A: Roles are assumed by entities and provide temporary credentials. C: Roles do not have long-term credentials; they use temporary security credentials. Option B is wrong because roles can have a trust policy that specifies who can assume the role. Option D is wrong because roles are not associated with a specific user; they can be assumed by multiple entities. Option E is wrong because roles can have permissions policies attached.

Answer

It can be used to grant permissions to an AWS service without requiring a user.

Answer

It cannot have an attached permissions policy.

Answer

It is associated with a specific IAM user.

Question 12

A company has a multi-account AWS Organizations setup with a central security account (Account ID: 111122223333) and several member accounts. The security team uses AWS CloudTrail to log all API calls across accounts and stores the logs in an S3 bucket (my-cloudtrail-bucket) in the security account. The team wants to allow the security team members (IAM users in the security account) to access the CloudTrail logs, while denying access to all other users in the organization, including the root user of the security account. The security team has attached the following IAM policy to the IAM group containing the security team members:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-cloudtrail-bucket/*"
    }
  ]
}

However, a security team member reports that they are receiving an AccessDenied error when trying to download a log file. The bucket policy is as follows:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-cloudtrail-bucket/*",
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "false"
        }
      }
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::111122223333:root"
      },
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-cloudtrail-bucket/*"
    },
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": "arn:aws:s3:::my-cloudtrail-bucket/*",
      "Condition": {
        "StringNotEquals": {
          "aws:PrincipalAccount": "111122223333"
        }
      }
    }
  ]
}

What is the most likely reason for the AccessDenied error?

Accepted Answer

The bucket policy allows only the root user of the security account, not the IAM users.. Option B is correct. The bucket policy allows the root user but does not explicitly allow the IAM users. While the root user is allowed, the Deny statement for non-root users is not present; however, the Allow for root does not extend to IAM users. The IAM users are not the root user, so the Allow statement does not apply to them. The IAM policy allows GetObject, but the bucket policy does not grant access to the IAM users, so the default implicit deny applies. Option A is wrong because the IAM policy does not have a Deny. Option C is wrong because the Deny for non-111122223333 accounts does not affect users in the same account. Option D is wrong because the SecureTransport condition only denies when HTTPS is not used.

Answer

The bucket policy denies access to all principals except those in account 111122223333, but the IAM users are in that account, so they are denied.

Answer

The bucket policy requires secure transport, and the security team member is not using HTTPS.

Answer

The IAM policy has an implicit deny because the security team members are not allowed to access S3.

Question 13

A company has an AWS Lambda function that processes messages from an Amazon SQS queue. The Lambda function is configured with an execution role that has the following IAM policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "sqs:ReceiveMessage",
        "sqs:DeleteMessage",
        "sqs:GetQueueAttributes"
      ],
      "Resource": "arn:aws:sqs:us-east-1:123456789012:MyQueue"
    },
    {
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents"
      ],
      "Resource": "*"
    }
  ]
}

The Lambda function is also configured with an SQS trigger that uses the same queue. The function code tries to send a message to an Amazon SNS topic, but the send fails with an AccessDenied error. What is the most likely cause?

Accepted Answer

The Lambda execution role does not have permissions to publish to SNS.. Option A is correct. The Lambda execution role does not include permissions to publish to SNS. The function can only perform actions that are allowed by the role. Option B is wrong because the SQS trigger does not affect the function's ability to call SNS. Option C is wrong because the SQS policy is not relevant to SNS. Option D is wrong because the SNS topic policy may not exist or may not deny; the error is due to missing IAM permissions.

Answer

The SQS queue has a resource-based policy that denies the Lambda function from sending to SNS.

Answer

The SNS topic has a resource-based policy that denies the Lambda function.

Answer

The SQS queue is not configured to allow the Lambda function to send messages to SNS.

Question 14

A company wants to grant a Lambda function access to write logs to CloudWatch Logs in the same AWS account. What is the BEST practice for granting this permission?

Accepted Answer

Create an IAM role with a policy allowing logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents, and attach it to the Lambda function. Option B is correct because attaching an IAM role with the required permissions to the Lambda function is the standard and secure method. Option A is wrong because embedding credentials in code is insecure. Option C is wrong because resource-based policies are used for cross-account access, not for Lambda to CloudWatch. Option D is wrong because using the root user is insecure and unnecessary.

Answer

Store AWS access keys in the Lambda environment variables

Answer

Add a resource-based policy to the Lambda function to allow CloudWatch Logs to write logs

Answer

Use the AWS account root user credentials directly in the Lambda function

Question 15

A security engineer notices that an IAM user, 'svc-backup', has full S3 access (s3:*) to all buckets. The engineer wants to restrict the user to only put objects into a specific bucket named 'mycompany-backup' and deny all other S3 actions. Which IAM policy should be attached?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:PutObject","Resource":"arn:aws:s3:::mycompany-backup/*"},{"Effect":"Deny","Action":"s3:*","Resource":"*"}]}. Option C is correct because it explicitly allows s3:PutObject on the target bucket and denies all other S3 actions. Option A is wrong because it only allows s3:PutObject but does not deny other actions, so other S3 actions would still be allowed if the user has another policy granting them. Option B is wrong because it allows all S3 actions on the bucket, which is too broad. Option D is wrong because it denies all S3 actions except PutObject, but the Deny effect with NotAction can be confusing; however, the more straightforward approach is Option C.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:PutObject","Resource":"arn:aws:s3:::mycompany-backup/*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","NotAction":"s3:PutObject","Resource":"*","Condition":{...}}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:*","Resource":"arn:aws:s3:::mycompany-backup/*"}]}