SCS-C02 Identity and Access Management Practice Test 9 — 15 Questions

Question 1

A company has a requirement to grant cross-account access to an S3 bucket named 'shared-data' in Account A (111111111111) to users in Account B (222222222222). The security team has set up a bucket policy in Account A that grants read-only access to the IAM role 'DataReader' in Account B. The bucket policy is as follows: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::222222222222:role/DataReader"},"Action":["s3:GetObject"],"Resource":"arn:aws:s3:::shared-data/*"}]}. A user in Account B assumes the 'DataReader' role, but when trying to read an object from the bucket, they receive an 'Access Denied' error. What is the MOST likely reason for this error?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The IAM role 'DataReader' does not have an IAM policy that allows s3:GetObject on the bucket.. For cross-account S3 access, both the resource-based policy (bucket policy) in the owning account and the identity-based policy (IAM policy) attached to the IAM role in the accessing account must grant the necessary permissions. The bucket policy in Account A allows the 'DataReader' role to perform s3:GetObject, but the IAM role itself in Account B must also have an IAM policy that allows s3:GetObject on the bucket. Without this identity-based policy, the role lacks permission to perform the action, resulting in 'Access Denied'. Option A is incorrect because the bucket policy can specify an IAM role ARN as principal. Option B is incorrect because s3:ListBucket is not required to read objects; s3:GetObject is sufficient. Option D is incorrect because there is no mention of KMS encryption in the scenario, and even if there were, the issue is the missing IAM policy on the role.

Answer

The bucket policy principal must be the IAM user ARN, not the role ARN.

Answer

The bucket policy is missing the 's3:ListBucket' action, which is required to read objects.

Answer

The bucket objects are encrypted with a KMS key, and the role does not have permission to decrypt.

Question 2

A company runs a serverless application using AWS Lambda functions that access an Amazon DynamoDB table. The Lambda functions are part of a microservices architecture and need to read and write to the DynamoDB table. The security team wants to ensure that the Lambda functions have the minimum required permissions. Initially, the team attached the AWS managed policy 'AWSLambdaDynamoDBExecutionRole' to the Lambda execution role, but later discovered that this policy grants more permissions than needed. The team decides to create a custom policy with only the required actions: GetItem, PutItem, UpdateItem, and DeleteItem. However, after attaching the custom policy, the Lambda functions start failing with 'AccessDeniedException' when trying to access DynamoDB. The CloudWatch logs show that the Lambda function is unable to write logs to CloudWatch Logs. What is the MOST likely cause of the failures?

Accepted Answer

The custom policy does not include permissions for CloudWatch Logs actions (logs:CreateLogGroup, logs:CreateLogStream, logs:PutLogEvents), which are required for Lambda to write logs.. The custom policy only grants DynamoDB permissions but does not include permissions for CloudWatch Logs, which are needed for Lambda to write logs. The managed policy included both DynamoDB and CloudWatch Logs permissions. Option B is wrong because the Lambda function does not need VPC permissions unless it is in a VPC. Option C is wrong because the Lambda function does not need to list tables to perform read/write operations. Option D is wrong because the condition keys are not the issue; the problem is missing permissions.

Answer

The custom policy does not include dynamodb:ListTables, which is required for the DynamoDB SDK to work.

Answer

The DynamoDB table has a resource-based policy that denies access from Lambda functions without a specific condition key.

Answer

The Lambda function is attached to a VPC and requires permissions to create Elastic Network Interfaces (ec2:CreateNetworkInterface).

Question 3

A company is using Amazon API Gateway to expose a set of REST APIs. The APIs are backed by AWS Lambda functions. The security team wants to control access to the APIs using IAM authorization. The team has created an IAM policy for a group of developers that allows them to invoke the APIs only from within the corporate network (IP range 203.0.113.0/24). The policy is attached to an IAM group, and the developers are members of the group. However, when a developer tries to invoke the API from the corporate network, they receive a '403 Forbidden' error. The API Gateway endpoint is configured with IAM authorization. The IAM policy is as follows: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"execute-api:Invoke","Resource":"arn:aws:execute-api:us-east-1:123456789012:api-id/*","Condition":{"IpAddress":{"aws:SourceIp":"203.0.113.0/24"}}}]}. What is the MOST likely reason for the failure?

Accepted Answer

The resource ARN in the policy does not include the stage and method; it should be 'arn:aws:execute-api:us-east-1:123456789012:api-id/stage/GET/resource'.. The resource ARN in the IAM policy must include the stage and HTTP method to match the API Gateway endpoint. The current policy uses 'api-id/*', which is a wildcard but may not cover all paths correctly if the stage and method are not specified. In this case, the developers receive a 403 error because the policy's resource ARN does not match the actual API resource path. Option B is incorrect because IAM policies can be attached to groups, and the developers inherit them. Option C is incorrect because the 'aws:SourceIp' condition works with API Gateway IAM authorization. Option D is incorrect because API Gateway IAM authorization supports resource-level conditions; the issue is the resource ARN format.

Answer

The IAM policy must be attached directly to the IAM user, not to a group.

Answer

The condition key aws:SourceIp does not work for API Gateway; you must use a custom header.

Answer

API Gateway IAM authorization does not support resource-level conditions; you must use a Lambda authorizer.

Question 4

A company manages a multi-account AWS environment using AWS Organizations. The security team wants to enforce that all Amazon S3 buckets in the organization are encrypted with AWS KMS customer managed keys (CMKs) and that no unencrypted buckets can be created. They also want to ensure that the encryption settings cannot be changed by account administrators. The team uses AWS CloudTrail to log all S3 API calls and wants to detect any attempts to create unencrypted buckets. The security team creates a service control policy (SCP) that denies s3:PutBucketEncryption and s3:PutBucketPolicy unless the request includes a specific encryption setting. However, they find that a developer in a member account was able to create an unencrypted bucket using the AWS Management Console. The CloudTrail logs show that the bucket was created with the s3:CreateBucket API call without specifying any encryption parameters. What should the security team do to prevent this from happening?

Accepted Answer

Modify the SCP to deny s3:CreateBucket unless the request includes the x-amz-server-side-encryption-aws-kms-key-id header.. A is correct. The SCP should deny s3:CreateBucket unless the request includes the x-amz-server-side-encryption-aws-kms-key-id header. This prevents creation of unencrypted buckets because the CreateBucket API call does not include encryption parameters by default; the SCP blocks such requests. B is incorrect: CloudTrail Insights detects unusual activity but does not prevent the action. C is incorrect: IAM permissions boundary cannot override SCP; the root issue is that the SCP did not deny CreateBucket. D is incorrect: S3 Block Public Access does not enforce encryption.

Answer

Enable CloudTrail Insights to detect unusual S3 activity and create a CloudWatch alarm.

Answer

Attach an IAM permissions boundary to all IAM roles used by developers that denies s3:CreateBucket.

Answer

Enable S3 Block Public Access at the account level to prevent unencrypted bucket creation.

Question 5

A company has an AWS Lambda function that processes sensitive data stored in an Amazon S3 bucket. The Lambda function needs to read objects from the S3 bucket and write results to a different S3 bucket. The security engineer is configuring IAM permissions for the Lambda execution role. The engineer wants to follow the principle of least privilege. The Lambda function is triggered by S3 events from the source bucket. The engineer creates an IAM policy that grants s3:GetObject on the source bucket and s3:PutObject on the destination bucket. However, when testing, the Lambda function fails with an access denied error when trying to process an object. The error message indicates that the Lambda function does not have permission to list the objects in the source bucket. The engineer checks the S3 event notification configuration and confirms that the event is configured correctly. What should the engineer do to resolve the issue?

Accepted Answer

Add s3:ListBucket permission for the source bucket to the Lambda execution role.. The error occurs because the Lambda function, when triggered by an S3 event, receives the object key but may still need s3:ListBucket permission for certain SDK operations (e.g., to verify bucket existence or for batch processing). Option A is correct: adding s3:ListBucket for the source bucket allows the function to list objects, resolving the access denied error while following least privilege. Option B is incorrect because the destination bucket already has s3:PutObject; adding s3:GetObject there is unnecessary and does not address the listing issue. Option C violates least privilege by granting full S3 access, which is excessive. Option D adds s3:PutObject to the source bucket, which is not needed and does not solve the list permission error.

Answer

Add s3:GetObject permission for the destination bucket to the Lambda execution role.

Answer

Add s3:* permission for both buckets to the Lambda execution role.

Answer

Add s3:PutObject permission for the source bucket to the Lambda execution role.

Question 6

A company runs a critical application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application processes financial transactions and must store transaction logs in an Amazon S3 bucket. The security team requires that all API calls to AWS services are logged and that the logs are stored in a secure, tamper-proof manner. The team enables AWS CloudTrail to log management events and Amazon S3 server access logs for the S3 bucket. They also enable AWS Config to track resource changes. The compliance team wants to ensure that no one can disable CloudTrail logging or delete the CloudTrail log files. The security engineer proposes a solution using an SCP in AWS Organizations to deny actions that would disable CloudTrail or delete log files. However, the engineer is concerned that the SCP might be applied too broadly and affect legitimate administrative actions. The engineer wants to ensure that only the security team’s IAM role (SecurityAdminRole) can perform these restricted actions, while all other principals (including IAM users, roles, and the root user) are denied. The engineer creates an SCP that denies cloudtrail:StopLogging, cloudtrail:DeleteTrail, and s3:DeleteObject on the CloudTrail S3 bucket. The SCP includes a condition that allows the action if the principal is SecurityAdminRole. However, after applying the SCP, the security team finds that even SecurityAdminRole is unable to stop CloudTrail logging. What is the most likely cause of this issue?

Accepted Answer

The condition in the SCP is incorrectly scoped, causing the deny to apply to all principals including SecurityAdminRole.. The most likely cause is that the condition in the SCP is incorrectly scoped. SCPs deny by default; to allow only a specific role, you must explicitly exclude that role from the deny using a condition key like `aws:PrincipalArn` with a `StringNotEquals` operator. If the condition is misconfigured (e.g., using `StringEquals` instead of `StringNotEquals`, or incorrectly formatting the ARN), the deny will apply to the SecurityAdminRole as well. Option B is incorrect because SCPs applied to the root OU affect all accounts, including the management account except the root user, but that doesn't explain why SecurityAdminRole is blocked. Option C is incorrect because even if SecurityAdminRole has the necessary IAM permissions, SCP denies override them. Option D is incorrect because if the SCP denies the action, the S3 bucket policy is irrelevant for this issue.

Answer

The SCP is applied to the root organizational unit (OU), which includes the management account where the root user is not affected by SCPs.

Answer

The SecurityAdminRole does not have the necessary IAM permissions to stop CloudTrail logging.

Answer

The S3 bucket policy on the CloudTrail bucket denies access to the SecurityAdminRole.

Question 7

A company wants to allow its development team to have full access to Amazon S3 buckets that are tagged with 'Environment: Dev'. Which IAM policy element should be used to restrict access based on tags?

Accepted Answer

Use 'aws:ResourceTag' in the Condition element. IAM policies can use 'aws:ResourceTag' in the Condition element to restrict access based on tags attached to the S3 bucket. Option A ('aws:PrincipalTag') is used to restrict based on tags attached to the principal (user/role), not the resource. Option B ('aws:SourceTag') is not a valid condition key in IAM. Option C ('aws:RequestTag') is used to require specific tags on the request itself, not on the resource.

Answer

Use 'aws:PrincipalTag' in the Condition element

Answer

Use 'aws:SourceTag' in the Condition element

Answer

Use 'aws:RequestTag' in the Condition element

Question 8

A company has multiple AWS accounts managed through AWS Organizations. The security team wants to enforce that all users must use multi-factor authentication (MFA) to access the AWS Management Console. Which combination of actions should the security team take to enforce this requirement?

Accepted Answer

Apply a service control policy (SCP) at the organization root that denies actions unless MFA is present. A service control policy (SCP) at the organization root can deny access to all AWS actions unless MFA is present, enforcing MFA across all accounts. Option A is incorrect because IAM policies in individual accounts can be overridden by account administrators. Option B is incorrect because enabling MFA through the Account Management console does not enforce its use. Option C is incorrect because an IAM policy in each account can be bypassed by account administrators who can modify or remove it.

Answer

Use AWS CloudTrail to monitor and alert on console logins without MFA

Answer

Enable MFA through the AWS Account Management console for each account

Answer

Create an IAM policy in each account that denies access without MFA

Question 9

A company is designing an IAM policy to grant a group of developers access to manage EC2 instances and RDS databases. Which TWO actions should be included to follow the principle of least privilege?

Accepted Answer

ec2:StartInstances. Options B and D are correct because they specify the minimum actions needed to manage EC2 instances and RDS databases while following the principle of least privilege. Option B (ec2:StartInstances) allows starting stopped EC2 instances. Option D (rds:StartDBInstance) allows starting stopped RDS databases. Option A (rds:CreateDBInstance) grants the ability to create new databases, which is broader than necessary. Option C (ec2:CreateInstances) allows creating new instances, which is also broader than needed. Option E (ec2:*) grants all EC2 actions, violating least privilege.

Answer

rds:CreateDBInstance

Answer

ec2:CreateInstances

Answer

ec2:*

Question 10

A security engineer is reviewing an IAM policy that allows access to an S3 bucket. The policy includes a condition that checks 'aws:SourceIp'. However, users report they can still access the bucket from IP addresses not in the allowed list. Which THREE possible reasons could explain this behavior?

Accepted Answer

The policy is attached to an IAM role that is used by an AWS service, and the condition does not apply to service principals. When an IAM role is assumed by an AWS service (e.g., AWS Lambda, EC2), the `aws:SourceIp` condition key does not apply to requests made by the service principal. The source IP address in such cases is the service's internal IP, not the end user's IP, and the condition is evaluated against the service's principal context, which does not include a source IP. This means the condition is effectively ignored for service-invoked actions, allowing access from any IP.

Answer

The policy is attached to an IAM group, but the user is not a member of that group

Answer

The 'aws:SourceIp' condition key is not supported for S3 actions

Question 11

A company wants to allow a Lambda function to read messages from an SQS queue and write logs to CloudWatch Logs. Which TWO IAM actions should be included in the Lambda execution role?

Accepted Answer

sqs:ReceiveMessage. Options B and D are correct because they provide the specific actions needed: sqs:ReceiveMessage to read from SQS and logs:CreateLogStream and logs:PutLogEvents to write logs to CloudWatch Logs. Option A (logs:DeleteLogGroup) is not required for writing logs. Option C (cloudwatch:*) is overly broad and CloudWatch Logs actions are under the logs: prefix, not cloudwatch:* which covers other CloudWatch services. Option E (sqs:SendMessage) is for sending messages, not reading.

Answer

logs:DeleteLogGroup

Answer

cloudwatch:*

Answer

sqs:SendMessage

Question 12

Refer to the exhibit. An IAM policy is attached to a user. The user is trying to download an object from 'example-bucket' from an IP address of 10.1.1.1. What will happen?

Accepted Answer

Access is denied because the IP address is not in the allowed range. The condition restricts access to the IP range 10.0.0.0/16, and the user's IP is outside that range, so access is denied. Option A is incorrect because the policy does not need an explicit deny; the condition fails, resulting in an implicit deny. Option B is incorrect because the condition key is valid and misspelling would not cause this behavior. Option D is incorrect because the policy allows s3:GetObject only if the condition is met, which it is not.

Answer

Access is denied because the policy does not include an explicit deny

Answer

Access is allowed because the condition key is misspelled

Answer

Access is allowed because the policy allows s3:GetObject

Question 13

Refer to the exhibit. This IAM policy is attached to a user. The user attempts to assume the AdminRole without using MFA. What is the result?

Accepted Answer

The user cannot assume the role because the Deny statement blocks all actions when MFA is not present. The Deny statement explicitly denies all actions when MFA is not present, overriding the Allow statement. Since the user is not using MFA, sts:AssumeRole is denied. Option A is incorrect because the Deny overrides the Allow. Option C is incorrect because the Deny applies to all actions, including sts:AssumeRole. Option D is incorrect because the Deny, not the Allow, imposes the MFA requirement.

Answer

The user can assume the role because the Allow statement grants it

Answer

The user can assume the role because the Deny statement does not apply to sts:AssumeRole

Answer

The user cannot assume the role because the Allow statement requires MFA

Question 14

A company uses AWS Organizations and wants to delegate administration of IAM Access Analyzer to a member account. Which AWS service should be used to enable this delegation?

Accepted Answer

AWS Organizations. AWS Organizations. AWS Organizations allows you to register a member account as a delegated administrator for IAM Access Analyzer. This enables the member account to manage Access Analyzer settings and findings across the organization. Option A is incorrect because AWS Service Catalog is used for creating and managing catalogs of IT services, not for delegation. Option C is incorrect because AWS CloudTrail is used for logging API activity, not delegation. Option D is incorrect because AWS Config is used for resource compliance and configuration tracking, not delegation.

Answer

AWS Service Catalog

Answer

AWS CloudTrail

Answer

AWS Config

Question 15

A security engineer needs to ensure that an IAM role can only be assumed by a specific EC2 instance. The instance has a tag 'Environment=Production'. Which condition key should be used in the trust policy of the role?

Accepted Answer

ec2:ResourceTag. The 'ec2:ResourceTag' condition key can be used in an IAM role trust policy to check the tags of the EC2 instance making the AssumeRole request. This allows the security engineer to restrict the role assumption to only instances with the tag 'Environment=Production'. Option A is incorrect because 'aws:SourceArn' is used to check the ARN of the source resource, typically for services like Lambda or SNS, not for EC2 instances. Option B is incorrect because 'aws:UserAgent' checks the user agent string of the request, which is not relevant for EC2 instance tags. Option C is incorrect because 'aws:SourceAccount' checks the AWS account ID of the source, which does not filter by instance tags.

Answer

aws:SourceArn

Answer

aws:UserAgent

Answer

aws:SourceAccount