SCS-C02 Identity and Access Management — Timed 10 Questions

Question 1

An IAM policy includes the following condition: "StringNotEquals": {"aws:SourceArn": "arn:aws:ec2:us-east-1:123456789012:instance/*"}. What is the effect of this condition when attached to an IAM role?

10 minute time limit — choose an answer to begin.

Accepted Answer

Denies requests that do not originate from an EC2 instance in the specified account and region. The condition uses `StringNotEquals` with `aws:SourceArn`, meaning it denies access when the source ARN does NOT match the specified pattern. Since the condition is attached to a role's trust policy, it restricts which principals can assume the role. The correct effect is that requests not originating from an EC2 instance in account 123456789012 and region us-east-1 are denied.

Answer

Denies all requests from EC2 instances

Answer

Allows the role to be assumed only by EC2 instances in the specified account and region

Answer

Allows any request that comes from an EC2 instance regardless of account

Question 2

An IAM user receives an 'AccessDenied' error when trying to list objects in an S3 bucket. The user has the following policy attached: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::example-bucket"}]}. What is the most likely reason?

Accepted Answer

The bucket policy explicitly denies the action. The IAM policy grants the s3:ListBucket action on the bucket, which should allow listing objects. However, an explicit deny in a bucket policy overrides any allow, including those from IAM policies. Since the user receives an 'AccessDenied' error, the most likely cause is that the bucket policy explicitly denies the s3:ListBucket action for this user, as explicit denies take precedence over all allows.

Answer

The policy is missing a condition

Answer

The policy does not include s3:GetObject

Answer

The policy has a syntax error

Question 3

Which TWO are valid ways to authenticate to AWS for API calls? (Choose two.)

Accepted Answer

IAM user access keys. IAM user access keys (option B) are a valid authentication method for programmatic API calls to AWS. They consist of an access key ID and a secret access key, which are used to sign requests using Signature Version 4 (SigV4). This is a standard, long-term credential for IAM users to interact with AWS services via CLI, SDK, or direct API calls.

Answer

SSH key pairs

Answer

Database master password

Answer

Root user access keys

Question 4

Refer to the exhibit. A security engineer runs the command above. Which of the following is true about the role MyRole?

Accepted Answer

The role can be assumed by EC2 instances. The command `aws ec2 associate-iam-instance-profile --instance-id i-1234567890abcdef0 --iam-instance-profile Name=MyRole` attaches an IAM instance profile to an EC2 instance. An instance profile is a container for an IAM role that enables EC2 instances to assume that role and obtain temporary credentials via the EC2 metadata service. Therefore, the role MyRole can be assumed by EC2 instances when associated through an instance profile.

Answer

The role has a resource-based policy attached

Answer

The role can be assumed by any IAM user in account 123456789012

Answer

The role can be assumed by any AWS service

Question 5

A company has a multi-account AWS Organization with three accounts: Management, Development, and Production. The Security team uses the Management account to manage IAM policies centrally. They have created a service control policy (SCP) named 'RestrictRootAccess' that denies all actions for the root user in all accounts. The SCP is attached to the root organizational unit. The Development account has an IAM role 'DevAdmin' with full administrator access via an IAM policy. The role's trust policy allows the Management account's 'SecurityAudit' role to assume it. A security engineer in the Management account assumes the 'SecurityAudit' role and then tries to assume the 'DevAdmin' role in the Development account. The assumption fails with an 'AccessDenied' error. What is the most likely cause?

Accepted Answer

The trust policy of the 'DevAdmin' role does not grant sts:AssumeRole to the 'SecurityAudit' role. The error 'AccessDenied' occurs because the trust policy of the 'DevAdmin' role in the Development account does not explicitly grant the 'sts:AssumeRole' action to the 'SecurityAudit' role from the Management account. Even though the 'SecurityAudit' role has permission to call sts:AssumeRole via its IAM policy, the target role's trust policy acts as a resource-based policy that must allow the incoming principal. Without that allow, the assumption fails regardless of permissions in the source account.

Answer

The SCP is attached to the root OU and overrides any allow in the member accounts

Answer

The SCP 'RestrictRootAccess' denies the sts:AssumeRole action for all principals except root

Answer

The 'SecurityAudit' role requires MFA to assume the 'DevAdmin' role

Question 6

A developer is trying to upload an object to an S3 bucket named 'my-bucket' using the AWS CLI. The developer has an IAM user with a policy that includes 's3:PutObject' for 'arn:aws:s3:::my-bucket/*'. However, the upload fails with an 'Access Denied' error. The bucket policy is set to allow all principals from the same AWS account to perform 's3:PutObject'. What is the most likely cause of this failure?

Accepted Answer

The bucket policy denies access because the principal is not explicitly listed.. The IAM user has s3:PutObject permission on the bucket's objects (/*), so option A is incorrect. Option C is incorrect because s3:PutObject is always applied to the object resource (e.g., bucket-name/*); no upload operation requires the same permission on the bucket itself. Option D is incorrect because a region mismatch would result in a NoSuchBucket error, not Access Denied. Option B is correct because the bucket policy, though intended to allow all principals from the same AWS account, typically specifies the AWS account root principal (e.g., "arn:aws:iam::account-id:root"). This principal only grants access to the root user, not to IAM users. Since the IAM user is not an explicitly listed principal, the request is implicitly denied, resulting in the Access Denied error.

Answer

The IAM user is not authorized to perform 's3:PutObject' on the bucket 'my-bucket'.

Answer

The IAM policy grants 's3:PutObject' only on objects (/*), but the request may also require 's3:PutObject' on the bucket itself for some operations.

Answer

The bucket 'my-bucket' does not exist in the same region as the CLI request.

Question 7

An IAM policy is attached to a user. The user is trying to change their own password in the IAM console but receives an 'Access Denied' error. The user has an MFA device configured and is logged in with MFA. Why is the password change failing?

Accepted Answer

The Deny statement uses 'BoolIfExists' which evaluates to true if the condition key is not present. In the IAM console, the 'aws:MultiFactorAuthPresent' key may not be set, causing the Deny to apply even when the user has MFA.. The Deny statement uses the `BoolIfExists` condition operator with the `aws:MultiFactorAuthPresent` key. In the IAM console, the `aws:MultiFactorAuthPresent` key may not be present in the request context (e.g., during the initial password change flow before MFA is re-validated), causing `BoolIfExists` to evaluate to true when the key is absent. This triggers the Deny even though the user has an MFA device and is logged in with MFA, blocking the `iam:ChangePassword` action.

Answer

The Allow statement for iam:ChangePassword is not sufficient because the Deny statement explicitly denies all actions.

Answer

The Deny statement denies all actions unconditionally, so the Allow statement cannot override it.

Answer

The user does not have permission to change their own password because the Allow statement is not specific enough.

Question 8

A security engineer is designing a solution to allow an external auditor to access logs in an S3 bucket in the company's AWS account. The auditor does not have an AWS account. The engineer needs to grant read-only access to the specific bucket for a limited time. Which TWO actions should the engineer take? (Choose two.)

Accepted Answer

Use AWS STS to issue temporary credentials that the auditor can use to access the bucket.. Option C is correct because AWS STS (Security Token Service) can issue temporary, time-limited credentials (e.g., via AssumeRole, GetSessionToken, or federation) that grant read-only S3 access without requiring the auditor to have an AWS account, and the credentials automatically expire after the defined duration. Option D is correct because S3 pre-signed URLs embed the creator's credentials in a signed request, allowing an unauthenticated party such as the auditor to perform a specific read (GET) on individual log objects for a limited validity period, which fits the read-only, time-bound requirement. Option A is not appropriate because S3 Access Analyzer generates findings about bucket access policies and does not itself grant access to the auditor. Option B is not appropriate because a cross-account IAM role requires the auditor to have an AWS account with an identity that can assume the role, which the scenario explicitly rules out. Option E is not appropriate because a bucket policy granting Principal '*' with only an IP condition is not a secure or time-limited mechanism for granting read-only access to a specific external auditor.

Answer

Enable S3 Access Analyzer on the bucket to generate findings for the auditor.

Answer

Create a cross-account IAM role in the company's account and share the role ARN with the auditor.

Answer

Configure the bucket policy to grant access to 'Principal': '*' with a condition that limits access to the auditor's IP address.

Question 9

Drag and drop the steps to configure AWS CloudTrail for logging across all regions and accounts in the correct order.

Accepted Answer

Create an S3 bucket, then create a CloudTrail trail, then configure the trail to apply to all regions, then enable log file integrity validation, then create an organization trail.. CloudTrail setup requires S3 bucket, trail creation, multi-region selection, integrity validation, and organization trail.

Answer

Create a CloudTrail trail, then create an S3 bucket, then configure the trail to apply to all regions, then enable log file integrity validation, then create an organization trail.

Answer

Create an S3 bucket, then create a CloudTrail trail, then enable log file integrity validation, then configure the trail to apply to all regions, then create an organization trail.

Answer

Create an S3 bucket, then create an organization trail, then create a CloudTrail trail, then configure the trail to apply to all regions, then enable log file integrity validation.

Question 10

Match each AWS KMS key type to its description.

Accepted Answer

Customer managed key: You create, manage, and control the key lifecycle, including rotation, deletion, and policies.. Customer managed keys give you full control over the key lifecycle and policies. AWS managed keys are created and managed by AWS but allow you to view and audit usage. AWS owned keys are fully managed by AWS and used across many accounts. Custom key store keys are stored in a CloudHSM cluster under your control. Distractors swap the definitions of customer and AWS managed keys.

Answer

Customer managed key: AWS creates and manages the key, but you can view it and audit its usage.

Answer

AWS managed key: You create, manage, and control the key lifecycle.