SCS-C02 Identity and Access Management — Timed 25 Questions

Question 1

A developer needs to grant an IAM user read-only access to an S3 bucket named 'my-bucket'. Which policy should be attached to the IAM user?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::my-bucket/*"}]}. Option D grants s3:GetObject, which allows the IAM user to read (download) objects from the bucket. Although full read-only access typically includes s3:ListBucket to list objects, the question asks for read access, and s3:GetObject is the essential read action. Option A only allows listing, not reading object data. Option B grants full access, and option C grants write access. Thus, D is the best choice for read-only access.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::my-bucket"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:*","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:PutObject","Resource":"arn:aws:s3:::my-bucket/*"}]}

Question 2

An IAM policy includes the following condition: "StringNotEquals": {"aws:SourceArn": "arn:aws:ec2:us-east-1:123456789012:instance/*"}. What is the effect of this condition when attached to an IAM role?

Accepted Answer

Denies requests that do not originate from an EC2 instance in the specified account and region. The condition uses `StringNotEquals` with `aws:SourceArn`, meaning it denies access when the source ARN does NOT match the specified pattern. Since the condition is attached to a role's trust policy, it restricts which principals can assume the role. The correct effect is that requests not originating from an EC2 instance in account 123456789012 and region us-east-1 are denied.

Answer

Denies all requests from EC2 instances

Answer

Allows the role to be assumed only by EC2 instances in the specified account and region

Answer

Allows any request that comes from an EC2 instance regardless of account

Question 3

A company wants to allow users from its corporate Active Directory to access AWS resources. The company has set up an IAM identity provider for SAML. What must be created in IAM to map users to permissions?

Accepted Answer

An IAM role with a trust policy for the SAML provider. A is correct because when using SAML-based federation, IAM roles are the mechanism to grant permissions to federated users. The role must have a trust policy that specifies the SAML identity provider as the principal, allowing users authenticated by the corporate Active Directory to assume the role and obtain temporary AWS credentials. This maps the SAML assertion attributes (such as the user's group or role) to IAM permissions via the role's permissions policy.

Answer

An OIDC identity provider

Answer

An IAM user for each Active Directory user

Answer

A federation role type

Question 4

An IAM policy has the following statement: {"Effect":"Deny","Action":"*","Resource":"*","Condition":{"Bool":{"aws:SecureTransport":"false"}}}. What does this policy achieve?

Accepted Answer

Denies all actions that are not made over HTTPS. This policy statement uses the `aws:SecureTransport` condition key with a `Bool` condition set to `false`. When the condition evaluates to true (i.e., the request is not using HTTPS/TLS), the `Deny` effect applies to all actions on all resources. This effectively denies any API call made over HTTP (non-secure transport), ensuring that only HTTPS requests are allowed. The policy does not explicitly allow anything; it only denies non-HTTPS traffic, so all actions are implicitly allowed when made over HTTPS.

Answer

Allows all actions only when using HTTPS

Answer

Enforces HTTPS for S3 bucket policies only

Answer

Blocks all actions for a specific AWS service

Question 5

A solutions architect needs to design a system where an EC2 instance can write logs to CloudWatch Logs. Which IAM entity should be used to grant permissions to the EC2 instance?

Accepted Answer

An IAM role with an instance profile. An IAM role with an instance profile is the correct approach because it allows the EC2 instance to assume temporary, rotated credentials via the AWS Security Token Service (STS). The instance profile is attached to the EC2 instance, and the AWS SDK or CLI automatically retrieves credentials from the instance metadata service (IMDS) to authenticate API calls to CloudWatch Logs. This eliminates the need to store long-term credentials on the instance and follows the principle of least privilege.

Answer

A resource-based policy on the EC2 instance

Answer

An IAM user with access keys stored on the instance

Answer

An IAM group

Question 6

A security administrator discovers that an IAM user has been deleted accidentally. What is the correct way to restore the user's access?

Accepted Answer

Create a new IAM user with the same name and attach the same policies. IAM does not support undeletion or restoration of deleted users. When an IAM user is deleted, all associated credentials, permissions, and metadata are permanently removed. The only way to restore access is to create a new IAM user with the same name and manually reattach the same policies, groups, and tags, and then regenerate access keys and passwords as needed.

Answer

Contact AWS Support to undo the deletion

Answer

Use the AWS IAM console to undelete the user

Answer

Restore the user from a backup of IAM

Question 7

Which TWO actions can be performed using AWS IAM? (Choose two.)

Accepted Answer

Define a password policy for IAM users. AWS IAM allows you to define a password policy for IAM users, which enforces complexity requirements, rotation periods, and reuse prevention. This is a core IAM feature that helps secure user credentials without relying on external identity providers.

Answer

Change the instance type of an RDS database

Answer

Create a CloudFront distribution

Answer

Configure a VPC peering connection

Question 8

Which THREE factors should be considered when designing IAM policies for cross-account access? (Choose three.)

Accepted Answer

The resource-based policy must allow the external account. For cross-account access using resource-based policies (e.g., S3 bucket policies, KMS key policies), the resource-based policy must explicitly grant access to the external AWS account. This allows the external account's IAM principals to access the resource, provided the external account's IAM policy also permits the action. Without this allowance in the resource-based policy, the external account cannot access the resource, even if its own IAM policies allow it.

Answer

Permission boundaries must be used

Answer

Service control policies (SCPs) must allow the action

Question 9

Which TWO are valid ways to authenticate to AWS for API calls? (Choose two.)

Accepted Answer

IAM user access keys. IAM user access keys (option B) are a valid authentication method for programmatic API calls to AWS. They consist of an access key ID and a secret access key, which are used to sign requests using Signature Version 4 (SigV4). This is a standard, long-term credential for IAM users to interact with AWS services via CLI, SDK, or direct API calls.

Answer

SSH key pairs

Answer

Database master password

Answer

Root user access keys

Question 10

Refer to the exhibit. A security engineer runs the command above. Which of the following is true about the role MyRole?

Accepted Answer

The role can be assumed by EC2 instances. The command `aws ec2 associate-iam-instance-profile --instance-id i-1234567890abcdef0 --iam-instance-profile Name=MyRole` attaches an IAM instance profile to an EC2 instance. An instance profile is a container for an IAM role that enables EC2 instances to assume that role and obtain temporary credentials via the EC2 metadata service. Therefore, the role MyRole can be assumed by EC2 instances when associated through an instance profile.

Answer

The role has a resource-based policy attached

Answer

The role can be assumed by any IAM user in account 123456789012

Answer

The role can be assumed by any AWS service

Question 11

A company has a multi-account AWS Organization with three accounts: Management, Development, and Production. The Security team uses the Management account to manage IAM policies centrally. They have created a service control policy (SCP) named 'RestrictRootAccess' that denies all actions for the root user in all accounts. The SCP is attached to the root organizational unit. The Development account has an IAM role 'DevAdmin' with full administrator access via an IAM policy. The role's trust policy allows the Management account's 'SecurityAudit' role to assume it. A security engineer in the Management account assumes the 'SecurityAudit' role and then tries to assume the 'DevAdmin' role in the Development account. The assumption fails with an 'AccessDenied' error. What is the most likely cause?

Accepted Answer

The trust policy of the 'DevAdmin' role does not grant sts:AssumeRole to the 'SecurityAudit' role. The error 'AccessDenied' occurs because the trust policy of the 'DevAdmin' role in the Development account does not explicitly grant the 'sts:AssumeRole' action to the 'SecurityAudit' role from the Management account. Even though the 'SecurityAudit' role has permission to call sts:AssumeRole via its IAM policy, the target role's trust policy acts as a resource-based policy that must allow the incoming principal. Without that allow, the assumption fails regardless of permissions in the source account.

Answer

The SCP is attached to the root OU and overrides any allow in the member accounts

Answer

The SCP 'RestrictRootAccess' denies the sts:AssumeRole action for all principals except root

Answer

The 'SecurityAudit' role requires MFA to assume the 'DevAdmin' role

Question 12

A developer is trying to upload an object to an S3 bucket named 'my-bucket' using the AWS CLI. The developer has an IAM user with a policy that includes 's3:PutObject' for 'arn:aws:s3:::my-bucket/*'. However, the upload fails with an 'Access Denied' error. The bucket policy is set to allow all principals from the same AWS account to perform 's3:PutObject'. What is the most likely cause of this failure?

Accepted Answer

The bucket policy denies access because the principal is not explicitly listed.. The IAM user has s3:PutObject permission on the bucket's objects (/*), so option A is incorrect. Option C is incorrect because s3:PutObject is always applied to the object resource (e.g., bucket-name/*); no upload operation requires the same permission on the bucket itself. Option D is incorrect because a region mismatch would result in a NoSuchBucket error, not Access Denied. Option B is correct because the bucket policy, though intended to allow all principals from the same AWS account, typically specifies the AWS account root principal (e.g., "arn:aws:iam::account-id:root"). This principal only grants access to the root user, not to IAM users. Since the IAM user is not an explicitly listed principal, the request is implicitly denied, resulting in the Access Denied error.

Answer

The IAM user is not authorized to perform 's3:PutObject' on the bucket 'my-bucket'.

Answer

The IAM policy grants 's3:PutObject' only on objects (/*), but the request may also require 's3:PutObject' on the bucket itself for some operations.

Answer

The bucket 'my-bucket' does not exist in the same region as the CLI request.

Question 13

A security administrator is designing a cross-account access strategy. The administrator needs to allow users in Account A to assume an IAM role in Account B to access an S3 bucket. Which TWO of the following statements are true regarding this configuration?

Accepted Answer

The IAM users in Account A must have an IAM policy that allows the sts:AssumeRole action for the role ARN in Account B.. For an IAM user in Account A to assume a role in Account B, the user must be explicitly granted permission to call the sts:AssumeRole API action against the role's Amazon Resource Name (ARN). This is done by attaching an IAM policy to the user (or a group/role the user belongs to) that includes the sts:AssumeRole action and specifies the target role ARN as the resource. Without this permission, the user cannot initiate the cross-account role assumption, even if the role's trust policy allows it.

Answer

The trust policy for the role must be defined in Account A.

Answer

The S3 bucket policy must grant access to the IAM users in Account A.

Answer

The IAM users in Account A must have cross-account permissions on the S3 bucket in Account B.

Question 14

Drag and drop the steps to implement AWS KMS key rotation in the correct order.

Accepted Answer

Create a CMK, then enable automatic key rotation, then perform manual key rotation (if needed), then update applications to use the new key, then verify decryption.. Key rotation starts with creating a CMK, enabling auto-rotation, manual rotation if needed, updating apps, and verifying decryption.

Answer

Create a CMK, then perform manual key rotation, then enable automatic key rotation, then update applications to use the new key, then verify decryption.

Answer

Enable automatic key rotation, then create a CMK, then perform manual key rotation, then update applications, then verify decryption.

Answer

Create a CMK, then enable automatic key rotation, then update applications to use the new key, then perform manual key rotation, then verify decryption.

Question 15

Drag and drop the steps to configure AWS CloudTrail for logging across all regions and accounts in the correct order.

Accepted Answer

Create an S3 bucket, then create a CloudTrail trail, then configure the trail to apply to all regions, then enable log file integrity validation, then create an organization trail.. CloudTrail setup requires S3 bucket, trail creation, multi-region selection, integrity validation, and organization trail.

Answer

Create a CloudTrail trail, then create an S3 bucket, then configure the trail to apply to all regions, then enable log file integrity validation, then create an organization trail.

Answer

Create an S3 bucket, then create a CloudTrail trail, then enable log file integrity validation, then configure the trail to apply to all regions, then create an organization trail.

Answer

Create an S3 bucket, then create an organization trail, then create a CloudTrail trail, then configure the trail to apply to all regions, then enable log file integrity validation.

Question 16

Match each AWS KMS key type to its description.

Accepted Answer

Customer managed key: You create, manage, and control the key lifecycle, including rotation, deletion, and policies.. Customer managed keys give you full control over the key lifecycle and policies. AWS managed keys are created and managed by AWS but allow you to view and audit usage. AWS owned keys are fully managed by AWS and used across many accounts. Custom key store keys are stored in a CloudHSM cluster under your control. Distractors swap the definitions of customer and AWS managed keys.

Answer

Customer managed key: AWS creates and manages the key, but you can view it and audit its usage.

Answer

AWS managed key: You create, manage, and control the key lifecycle.

Question 17

Match each AWS CloudHSM feature to its description.

Accepted Answer

Dedicated HSM: Each customer gets exclusive access to a hardware security module.. CloudHSM provides dedicated hardware security modules that are FIPS 140-2 Level 3 validated and support automatic key replication across clusters. Common confusions include mistaking single-tenant as multi-tenant or assuming a software emulator is used.

Answer

Multi-tenant: Multiple customers share the same HSM.

Answer

HSM client: CloudHSM provides a software-based HSM emulator.

Question 18

A company wants to allow an IAM user to manage only their own access keys. Which IAM policy should be attached to the user?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"iam:*AccessKey*","Resource":"arn:aws:iam::*:user/${aws:username}"}]}. The IAM policy uses the ${aws:username} variable in the Resource element. When this policy is attached to a user, ${aws:username} resolves to that user's username, thereby restricting the actions to only that user's own access keys. Option A allows access to all users' keys. Option B denies all AccessKey actions. Option D allows all AccessKey actions without restriction.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"iam:*AccessKey*","Resource":"arn:aws:iam::*:user/*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"iam:*AccessKey*","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"iam:*AccessKey*","Resource":"*"}]}

Question 19

A security engineer must ensure that cross-account access to an S3 bucket is restricted to only accounts that are part of a specific AWS organization. Which IAM policy condition key should be used in the bucket policy?

Accepted Answer

aws:PrincipalOrgID. The `aws:PrincipalOrgID` condition key allows you to restrict access to only principals (accounts) that belong to a specific AWS organization. By specifying the organization ID in the bucket policy, you ensure that only accounts within that organization can access the S3 bucket, regardless of whether they are from the same account or cross-account. This key is evaluated against the organization ID of the principal's account, making it ideal for cross-account access control based on organizational membership.

Answer

aws:SourceIp

Answer

aws:MultiFactorAuthPresent

Answer

aws:SourceVpce

Question 20

An IAM user reports that they are unable to launch an EC2 instance in us-east-1. The IAM policy attached to the user allows ec2:RunInstances but with a condition that the instance type must be t2.micro. What could be the reason for the failure?

Accepted Answer

The user is trying to launch an instance type other than t2.micro.. The condition likely specifies 'ec2:InstanceType' equals 't2.micro', so if the user tries to launch any other type, the action is denied. Option B is irrelevant because the policy allows the action. Option C is not a common condition. Option D is unrelated.

Answer

The user has not attached a security group to the instance.

Answer

The IAM policy does not include ec2:RunInstances for us-east-1.

Answer

The user's account has reached the EC2 instance limit.