SCS-C02 Identity and Access Management Practice Test 9 — 15 Questions

Question 1

A security engineer is troubleshooting an IAM policy that is not working as expected. The policy allows ec2:StartInstances and ec2:StopInstances but the user gets an access denied error when trying to stop an instance. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The user does not have permission to call ec2:DescribeInstances.. ec2:StopInstances requires the caller to also have ec2:DescribeInstances permission in many workflows, because the console and many SDK/CLI flows call DescribeInstances to resolve the instance before issuing the stop. Without DescribeInstances, the API call to StopInstances can fail with AccessDenied even though the stop action itself is allowed. This is a well-known IAM gotcha where the 'supporting' read permission is implicitly required.

Answer

A service control policy is denying the action.

Answer

The policy does not allow stopping instances in all regions.

Answer

There is an explicit deny statement in the policy.

Question 2

A company wants to grant cross-account access to an S3 bucket. The bucket policy allows access from account 111111111111. An IAM user in account 111111111111 has a policy allowing s3:GetObject on that bucket. However, the user gets AccessDenied. What is the most likely reason?

Accepted Answer

The IAM user policy has an explicit deny for s3:GetObject.. In AWS, an explicit Deny in any applicable policy always overrides any Allow, regardless of whether the Allow comes from an identity-based policy, a bucket policy, or both. Even though the bucket policy grants access to account 111111111111 and the IAM user has an Allow for s3:GetObject, an explicit Deny in the IAM user's policy takes precedence and blocks the action. This is the definitive reason for the AccessDenied error in this scenario.

Answer

The S3 bucket is in a different region and requires a VPC endpoint.

Answer

The IAM user policy is attached to a group, not directly to the user.

Answer

The bucket policy grants access to the account, but the IAM user's ARN is not explicitly listed.

Question 3

A company wants to enforce that all IAM users use multi-factor authentication (MFA) to access the AWS Management Console. What is the best way to achieve this?

Accepted Answer

Attach an IAM policy to all users that denies console access without MFA.. The correct approach is to attach an IAM policy that explicitly denies console access unless MFA is present. This is done using the condition keys `aws:MultiFactorAuthPresent` and `aws:MultiFactorAuthAge` in a policy statement with `Effect: Deny`. This policy can be attached to users, groups, or roles, and it enforces MFA at the API level, ensuring that even if a user has a password, they cannot perform actions without MFA. This is the most granular and effective method for enforcing MFA for console access.

Answer

Enable MFA in the account settings.

Answer

Set a password policy that requires MFA.

Answer

Use an SCP to deny access if MFA is not present.

Question 4

A security engineer is troubleshooting an IAM policy that is not working as expected. The policy allows ec2:StartInstances and ec2:StopInstances but the user gets an access denied error when trying to stop an instance. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The user's policy does not specify the resource ARN of the role.. The most likely cause is that the user's policy does not specify the resource ARN of the role they are trying to assume. In IAM, the sts:AssumeRole action requires a Resource element that points to the specific role ARN; if the policy allows sts:AssumeRole on all resources (e.g., "Resource": "*"), it may still fail if the role's trust policy does not allow the user, but the error message indicates the user is not authorized to perform sts:AssumeRole, which points to the identity-based policy missing the correct resource. The trust policy allowing the account is separate from the identity-based policy granting the user permission.

Answer

The role requires an external ID that the user did not provide.

Answer

The user must use multi-factor authentication (MFA).

Answer

The trust policy does not include the user's IAM user ARN.

Question 5

A company wants to enforce that all IAM users use MFA. Which THREE actions should be taken to achieve this?

Accepted Answer

Enable MFA devices for all IAM users.. Option B is correct because enforcing MFA requires that each IAM user actually has an MFA device registered and enabled on their account; without enrolled devices, users cannot satisfy any MFA-based condition. Option C is correct because the enforcement mechanism in IAM is a policy that uses the aws:MultiFactorAuthPresent condition (typically with a Deny effect on all actions when MFA is not present), which blocks API and console access until the user authenticates with MFA. Option E is correct because AWS Single Sign-On (now IAM Identity Center) can enforce MFA at the identity source and federate users into AWS accounts, providing a centralized way to require MFA for access. Option A is incorrect because IAM password policies control password complexity, length, and rotation, not MFA enforcement. Option D is incorrect because IAM Access Analyzer identifies resources shared externally and validates policies for issues; it does not enforce MFA usage.

Answer

Set an IAM password policy requiring MFA.

Answer

Use IAM Access Analyzer to validate policies.

Question 6

A security engineer needs to restrict access to an S3 bucket so that only requests from a specific VPC are allowed. Which TWO steps are required?

Accepted Answer

Add a bucket policy that denies access unless the request source VPC endpoint matches the created endpoint.. Option C is correct because to restrict S3 access to a specific VPC, you must first create a VPC endpoint (interface or gateway) for S3 and associate it with that VPC, which gives the VPC a private path to S3 and a unique endpoint ID that can be referenced in policies. Option A is correct because the bucket policy must then explicitly deny (or allow only) requests whose source matches that specific VPC endpoint, typically using the aws:sourceVpce condition key with the endpoint ID, ensuring only traffic through that endpoint can access the bucket. Option B is incorrect because aws:SourceVpc alone is not the precise condition key for endpoint-based restriction and, without the endpoint and matching policy, does not fulfill the requirement. Option D is incorrect because a VPC endpoint policy controls what the endpoint can access, not which VPC can access the bucket, so it is not a required step for this restriction. Option E is incorrect because a bucket policy allowing access by VPC ID alone is insufficient and not the mechanism used to enforce endpoint-scoped access.

Answer

Add a bucket policy with aws:SourceVpc condition.

Answer

Attach a VPC endpoint policy that allows the required actions.

Answer

Create a bucket policy that allows access from the VPC ID.

Question 7

A company has an S3 bucket with a bucket policy that allows access to a specific IAM role. However, users assume the role but still get access denied. Which THREE factors could cause this?

Accepted Answer

A service control policy (SCP) denies the required actions.. Options B, D, and E are correct. B: A service control policy (SCP) acts as an upper permissions boundary and can deny actions even if the bucket policy allows them. D: The role's trust policy must allow the user's account to assume the role; if not, the user cannot obtain the role's permissions. E: The bucket policy must grant access to the role ARN, not an IAM user ARN; granting to a user does not help users who assume the role. Option A is incorrect because the bucket policy does not need to reference the role's trust policy. Option C is incorrect because the aws:RoleSessionName condition is not a common cause and would require explicit configuration.

Answer

The bucket policy does not reference the role's trust policy.

Answer

The bucket policy has a condition on aws:RoleSessionName that does not match.

Question 8

A company uses AWS Organizations with multiple accounts. The security team has created an SCP that denies access to all DynamoDB actions except for the 'prod' account. The SCP is attached to the root OU. The 'prod' account has an IAM role that allows full DynamoDB access. A developer in the 'prod' account tries to create a DynamoDB table but receives an 'AccessDenied' error. The developer has the correct IAM permissions. What is the MOST likely cause and what should be done to resolve the issue?

Accepted Answer

The SCP denies DynamoDB by default; the 'prod' account needs an explicit allow in the SCP.. The SCP is attached to the root OU and applies to all accounts, including 'prod'. SCPs act as a permission boundary that cannot be overridden by IAM policies. Therefore, even though the developer's IAM role allows DynamoDB full access, the SCP deny takes precedence, resulting in the AccessDenied error. To resolve, the SCP should be modified to exclude the 'prod' account (e.g., by adding a condition to the deny statement) or the 'prod' account should be moved to a different OU without the deny SCP. Option C correctly identifies that the SCP cannot be overridden and suggests using a different account as a workaround, making it the most accurate choice among the options.

Answer

The DynamoDB table has a resource-based policy that denies access.

Answer

The SCP is attached to the OU and cannot be overridden; the developer must use a different account.

Answer

The IAM role's permissions boundary is blocking access.

Question 9

A large enterprise has multiple AWS accounts managed via AWS Organizations. The security team wants to enforce that all IAM roles in all accounts must have a maximum session duration of 1 hour. They create an SCP that denies creating or updating roles if the MaxSessionDuration is greater than 3600 seconds. The SCP is attached to the root OU. After applying the SCP, the development team reports that they cannot create any new IAM roles, even with a session duration of 1 hour. They are using CloudFormation to create roles. What is the MOST likely reason for the failure?

Accepted Answer

The SCP is not effective; the issue is with the IAM permissions boundary.. The most likely reason. The SCP condition only denies role creation when the MaxSessionDuration parameter is explicitly provided and exceeds 3600 seconds. If not specified, the condition does not apply, so the SCP should allow role creation. Therefore, the failure is not caused by the SCP itself but rather by an IAM permissions boundary that restricts the development team's ability to create roles. Option A is incorrect because SCPs can be attached to OUs. Option C is incorrect because the condition does not trigger when MaxSessionDuration is absent. Option D is incorrect because CloudFormation supports creating IAM roles.

Answer

The SCP cannot be attached to the root OU; it must be attached to individual accounts.

Answer

The SCP denies role creation when MaxSessionDuration is not explicitly set, even if it defaults to 1 hour.

Answer

CloudFormation does not support creating IAM roles.

Question 10

A startup company has a single AWS account and a few IAM users. The CEO wants to ensure that no one can delete an S3 bucket that contains critical data. The security engineer creates an IAM policy that denies s3:DeleteBucket for all users. However, the CEO later finds that the bucket was deleted by a user who had full administrator access. Why did the policy fail to prevent the deletion?

Accepted Answer

The deny policy was not attached to the user.. The IAM policy that denies s3:DeleteBucket was created but not attached to any user, group, or role. IAM policies only take effect when they are attached to an identity or resource. Since the policy was not attached, it had no effect, and the user with administrator access was able to delete the bucket.

Answer

The root user deleted the bucket, which bypasses IAM policies.

Answer

A service control policy (SCP) is required to deny actions to all users.

Answer

An explicit deny cannot override an administrator policy.

Question 11

A company uses cross-account roles to allow developers in the 'dev' account to access resources in the 'prod' account. The trust policy in 'prod' allows the 'dev' account to assume the role. The developers have an IAM policy that allows sts:AssumeRole on the role ARN. However, when a developer tries to assume the role via the AWS CLI, they get an error that the role cannot be assumed. The developer can list the role using IAM. What is the MOST likely cause?

Accepted Answer

The developer is not providing the required external ID when calling sts:AssumeRole.. The most likely cause is that the role's trust policy requires an external ID via the sts:ExternalId condition, and the developer is not supplying it. When a trust policy includes a Condition on sts:ExternalId, any AssumeRole call without that value is denied even if the caller's identity policy allows sts:AssumeRole. The fact the developer can list the role confirms identity policy permissions are fine, pointing to the trust policy condition.

Answer

The developer's IAM policy does not include sts:AssumeRole.

Answer

The developer must use MFA to assume the role.

Answer

The role ARN specified in the policy is incorrect.

Question 12

A company has an S3 bucket that stores sensitive data. The bucket policy allows access only from a specific VPC endpoint. A security engineer notices that an EC2 instance in the same VPC can access the bucket, but an instance in a peered VPC cannot. Both instances have the same IAM role attached. The VPC endpoint is in the first VPC and is shared via a transit gateway. What is the MOST likely reason the second instance cannot access the bucket?

Accepted Answer

The bucket policy condition on aws:sourceVpce does not match requests from the peered VPC.. The bucket policy condition on aws:sourceVpce matches only requests originating from the specific VPC endpoint ID. When the second instance accesses S3 through the transit gateway, the request does not carry the same source VPC endpoint context, so the condition fails and access is denied. The IAM role is identical, so permissions are not the differentiator.

Answer

The IAM role does not have permissions for the second instance.

Answer

The VPC endpoint is not accessible from the peered VPC.

Answer

The transit gateway does not support S3 traffic.

Question 13

A company uses IAM roles for EC2 instances to access DynamoDB. The security team wants to ensure that the instances can only access specific DynamoDB tables. They create an IAM policy that allows dynamodb:GetItem and dynamodb:PutItem on the specific table ARN. The policy is attached to the instance role. However, when an application on the instance tries to read from the table, it receives an 'AccessDeniedException'. The application is using the correct table name. What is the MOST likely cause?

Accepted Answer

The policy does not include dynamodb:DescribeTable action.. The most likely cause is that the IAM policy does not include the `dynamodb:DescribeTable` action. Many AWS SDKs and applications call DescribeTable before performing GetItem or PutItem to validate the table's existence and schema. Without this permission, the application receives an AccessDeniedException even though GetItem and PutItem are allowed. The other options are less likely because the scenario states the policy is attached to the instance role and the application uses the correct table name.

Answer

The IAM policy is not attached to the instance profile.

Answer

The DynamoDB table is encrypted with a customer managed key that the role does not have access to.

Answer

The instance does not have the required instance profile associated.

Question 14

A company has a multi-account AWS organization with centralized logging in a Security account. The Security account contains an S3 bucket that stores CloudTrail logs from all member accounts. The bucket policy allows CloudTrail from member accounts to deliver logs. Recently, a security audit revealed that the bucket is publicly accessible. The security engineer must ensure that only authorized accounts can access the logs. The engineer updates the bucket policy to include a condition that restricts access to specific AWS accounts. However, after the change, member accounts report that CloudTrail is failing to deliver logs to the bucket. The bucket policy currently includes the following statement: { "Effect": "Allow", "Principal": "*", "Action": "s3:PutObject", "Resource": "arn:aws:s3:::central-logs/*", "Condition": { "StringEquals": { "aws:SourceAccount": "111111111111" } } } The Security account ID is 222222222222. What is the MOST likely cause of the delivery failure, and what should the engineer do to fix it?

Accepted Answer

Change the Principal from "*" to the CloudTrail service principal to restrict access more tightly.. The bucket policy's condition using `aws:SourceAccount` is not appropriate for CloudTrail. CloudTrail uses the service principal (`cloudtrail.amazonaws.com`) and the `aws:SourceAccount` key is not evaluated for service principals. The condition does not match, causing log delivery failures. Changing the Principal from `*` to the CloudTrail service principal is a necessary step to properly scope the policy. However, the condition should also be changed to use `aws:SourceArn` or removed entirely. Among the options, option C is the most direct fix, while option B is incorrect because CloudTrail does not require bucket ACLs. Options A and D are irrelevant to the issue.

Answer

Modify the KMS key policy to allow CloudTrail to decrypt and re-encrypt logs if SSE-KMS is enabled.

Answer

Update the bucket ACL to grant the CloudTrail service write access, as CloudTrail requires both bucket policy and ACL permissions.

Answer

Create an IAM role in the Security account and configure member accounts to use that role for log delivery.

Question 15

A developer is creating an AWS Lambda function that needs to read items from a DynamoDB table named 'Orders' in the same AWS account. The developer attaches an IAM policy to the Lambda execution role that includes the following statement: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "dynamodb:GetItem", "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/Orders" } ] } When testing the Lambda function, it fails with an access denied error when trying to read from the table. The developer checks the Lambda function's code and confirms it is calling DynamoDB correctly. What is the MOST likely reason for the access denied error?

Accepted Answer

The DynamoDB table has a resource-based policy that denies access to the Lambda execution role.. The IAM policy attached to the Lambda execution role grants dynamodb:GetItem on the table ARN, but if the DynamoDB table has a resource-based policy that explicitly denies access to the Lambda execution role, that denial overrides the allow. In IAM policy evaluation, an explicit Deny always wins, even if there is an Allow from an identity-based policy. Therefore, the most likely reason for the access denied error is that the table's resource-based policy contains a Deny statement targeting the Lambda execution role. This is a common scenario when resource-based policies are used to restrict access to specific principals.

Answer

The Lambda function is in a VPC without a VPC endpoint for DynamoDB, so network connectivity fails.

Answer

The IAM policy does not include the dynamodb:Scan action, which is required for reading items.

Answer

The DynamoDB table has an identity-based policy that restricts access to specific IAM users.