Courseiva

SAP-C02 · topic practice

IAM Policy practice questions

Practise AWS Certified Solutions Architect Professional SAP-C02 IAM Policy practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security
20 questionsDomain: IAM Policy
Practice 10 questionsBrowse domain →

What the exam tests

What to know about IAM Policy

IAM Policy questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common IAM Policy exam traps

  • ▸Answering from memory before reading the full scenario.
  • ▸Missing a constraint such as cost, availability, security, scope or command context.
  • ▸Choosing a broad answer when the question asks for the most specific fix.
  • ▸Ignoring why the wrong options are tempting.

Practice set

IAM Policy questions

20 questions · select your answer, then reveal the explanation

Question 1easymultiple choice
Read the full IAM Policy explanation →

A company wants to provide its developers with access to a shared development environment in AWS. The developers are in different AWS accounts, and they need to assume an IAM role in the development account. What is the secure way to allow cross-account access?

Question 2mediummulti select
Read the full IAM Policy explanation →

A company uses AWS Organizations with multiple OUs. The security team wants to ensure that no account in the 'Production' OU can disable AWS CloudTrail or delete CloudTrail log files. Which two steps should be taken? (Choose TWO.)

Question 3easymultiple choice
Read the full IAM Policy explanation →

A company uses Amazon S3 to store sensitive data. The security team requires that all S3 buckets have server-side encryption enabled. How can the company enforce this across all existing and future buckets?

Question 4easymulti select
Read the full IAM Policy explanation →

A company is using AWS Organizations with multiple accounts. The IT team wants to centrally manage AWS Systems Manager Patch Manager to patch EC2 instances across all accounts. Which TWO actions are required?

Question 5mediummultiple choice
Read the full IAM Policy explanation →

A company has a centralized logging solution using Amazon S3 and AWS CloudTrail across multiple accounts. The logs are delivered to a central S3 bucket. The security team needs to ensure that logs are encrypted at rest and access is limited to only authorized security personnel. Which combination of actions should be taken?

Question 6mediummultiple choice
Read the full IAM Policy explanation →

The above AWS CloudFormation template creates an S3 bucket with a bucket policy. A user from IP 198.51.100.5 tries to access an object in the bucket. What will happen?

Exhibit

Refer to the exhibit.

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Resources": {
    "MyBucket": {
      "Type": "AWS::S3::Bucket",
      "Properties": {
        "BucketName": "my-bucket-12345",
        "VersioningConfiguration": {
          "Status": "Enabled"
        }
      }
    },
    "MyBucketPolicy": {
      "Type": "AWS::S3::BucketPolicy",
      "Properties": {
        "Bucket": {"Ref": "MyBucket"},
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": "*",
              "Action": "s3:GetObject",
              "Resource": "arn:aws:s3:::my-bucket-12345/*",
              "Condition": {
                "IpAddress": {
                  "aws:SourceIp": "203.0.113.0/24"
                }
              }
            }
          ]
        }
      }
    }
  }
}
Question 7easymultiple choice
Read the full IAM Policy explanation →

A company wants to centralize logging from multiple AWS accounts into a single Amazon S3 bucket. The logging accounts are part of an AWS Organization. Which approach should be used to allow CloudTrail to deliver logs from all accounts to the central bucket?

Question 8mediummultiple choice
Read the full IAM Policy explanation →

Refer to the exhibit. A company has an IAM policy that allows s3:GetObject on all objects in 'my-bucket' but denies access to objects in the 'confidential' folder. A user tries to access 's3://my-bucket/confidential/report.pdf'. What will happen?

Exhibit

Refer to the exhibit.
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::my-bucket/*"
        },
        {
            "Effect": "Deny",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::my-bucket/confidential/*"
        }
    ]
}
Question 9hardmultiple choice
Read the full IAM Policy explanation →

A company is using AWS Organizations with a set of member accounts that need to access a shared Amazon S3 bucket in the master account. The bucket policy allows access only from the member accounts' root user. However, developers in member accounts are unable to access the bucket even when they assume an IAM role. What is the most likely cause?

Question 10hardmulti select
Read the full IAM Policy explanation →

A company has a multi-account AWS environment and wants to enforce that all IAM roles in member accounts must include a specific tag (e.g., CostCenter). Which THREE steps should be taken to enforce this policy using AWS Organizations?

Question 11hardmulti select
Read the full IAM Policy explanation →

A company is implementing a data lake on AWS using Amazon S3 as the storage layer. The data lake must support multiple consumer accounts within the organization. The security team requires that data is encrypted at rest using AWS KMS with customer-managed keys (CMKs) and that access to the keys is strictly controlled. Which THREE steps should be taken to meet these requirements?

Question 12hardmultiple choice
Read the full IAM Policy explanation →

A large enterprise uses AWS Organizations with 200 accounts. The central security team has implemented a service control policy (SCP) that denies all actions unless the request comes from a specific set of allowed AWS services. The SCP is attached to the root OU. Recently, the DevOps team reported that they cannot launch Amazon EC2 instances in any account, even though they have full administrator access via IAM roles. The security team verifies that the SCP is correctly configured and that allowed services include EC2. However, the error message states 'Action 'ec2:RunInstances' is not authorized.' The DevOps team is using the AWS Management Console. What is the MOST LIKELY cause?

Question 13hardmultiple choice
Read the full IAM Policy explanation →

A company has a management account in AWS Organizations and several member accounts. The security team wants to ensure that any IAM user created in any member account must have a password policy that enforces a minimum length of 14 characters. The team wants a preventive control that is enforced automatically. Which approach should be used?

Question 14easymultiple choice
Read the full IAM Policy explanation →

A company uses AWS Organizations with multiple OUs. The security team wants to enforce that no resources can be created outside of approved AWS Regions. Which policy should be used, and how should it be attached?

Question 15easymultiple choice
Read the full IAM Policy explanation →

A company uses AWS Organizations with a single OU for all accounts. The security team wants to prevent any account from leaving the organization without approval. What should they do?

Question 16mediummultiple choice
Read the full IAM Policy explanation →

Refer to the exhibit. An IAM policy is attached to a group. A user in the group tries to stop an EC2 instance with the tag 'Environment=production'. The action fails. What is the MOST likely reason?

Exhibit

Refer to the exhibit.
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeInstances",
        "ec2:StartInstances",
        "ec2:StopInstances"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "ec2:ResourceTag/Environment": "production"
        }
      }
    }
  ]
}
Question 17hardmultiple choice
Read the full IAM Policy explanation →

A migration engineer is setting up an AWS DMS task to migrate data from an on-premises Oracle database to Amazon RDS for PostgreSQL. The engineer attaches this IAM policy to the DMS service role. The DMS task fails with an error indicating insufficient privileges. What is the most likely cause?

Exhibit

Refer to the exhibit.

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "dms:CreateReplicationTask",
                "dms:StartReplicationTask"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "rds:DescribeDBInstances",
                "rds:DescribeDBSnapshots"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:PutObject"
            ],
            "Resource": "arn:aws:s3:::my-migration-bucket/*"
        }
    ]
}
```
Question 18mediummultiple choice
Read the full IAM Policy explanation →

A company has a multi-account AWS environment and wants to centralize the management of IAM roles. The security team needs to ensure that all IAM roles across all accounts trust the same identity provider (IdP) for federated access. The company uses AWS IAM Identity Center (successor to AWS SSO) for user management. Which solution should be implemented?

Question 19mediummultiple choice
Read the full IAM Policy explanation →

A company is migrating an application that uses an S3 bucket to store user uploads. The IAM policy above is attached to the application's IAM role. The application is experiencing permission errors when trying to list objects in the bucket. What is the most likely cause?

Exhibit

Refer to the exhibit.
```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject"
      ],
      "Resource": "arn:aws:s3:::example-bucket/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket"
      ],
      "Resource": "arn:aws:s3:::example-bucket"
    }
  ]
}
```
Question 20mediummultiple choice
Read the full IAM Policy explanation →

An IAM policy is attached to an IAM user. The user tries to download an object from S3 bucket 'example-bucket' from an IP address 10.0.1.5. What will happen?

Exhibit

Refer to the exhibit.

IAM Policy:
```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::example-bucket/*",
            "Condition": {
                "IpAddress": {
                    "aws:SourceIp": "10.0.0.0/16"
                }
            }
        }
    ]
}
```
Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Sign up freeLog in

Focused IAM Policy sessions

Start a IAM Policy only practice session

Every question in these sessions is drawn from the IAM Policy domain — nothing else.

10 questions20 questions30 questions50 questions
Browse all IAM Policy questions →Mixed SAP-C02 session

Related practice questions

Related SAP-C02 topic practice pages

Move into related areas when this topic feels solid.

Design Solutions for Organizational Complexity practice questions

Design Solutions for Organizational Complexity practice questions for SAP-C02.

Design for New Solutions practice questions

Design for New Solutions practice questions for SAP-C02.

Continuous Improvement for Existing Solutions practice questions

Work through SAP-C02 questions on Continuous Improvement for Existing Solutions.

Accelerate Workload Migration and Modernization practice questions

Sharpen your SAP-C02 knowledge of Accelerate Workload Migration and Modernization.

SAA-C03 VPC practice questions

Work through SAP-C02 questions on SAA-C03 VPC.

SAA-C03 S3 lifecycle policy questions

Practise SAP-C02 questions linked to SAA-C03 S3 lifecycle policy questions.

SAA-C03 RDS Multi-AZ questions

SAA-C03 RDS Multi-AZ questions practice questions for SAP-C02.

SAA-C03 IAM policy practice questions

Sharpen your SAP-C02 knowledge of SAA-C03 IAM policy.

SAA-C03 Route 53 failover questions

Targeted SAP-C02 practice covering SAA-C03 Route 53 failover questions.

SAA-C03 CloudFront practice questions

Practise SAP-C02 questions linked to SAA-C03 CloudFront.

SAA-C03 NAT gateway questions

Work through SAP-C02 questions on SAA-C03 NAT gateway questions.

SAA-C03 VPC endpoint questions

SAA-C03 VPC endpoint questions practice questions for SAP-C02.

Frequently asked questions

What does the SAP-C02 exam test about IAM Policy?
IAM Policy questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?
Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just IAM Policy questions in a focused session?
Yes — the session launcher on this page draws every question from the IAM Policy domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other SAP-C02 topics?
Use the topic links above to move to related areas, or go back to the SAP-C02 question bank to see all topics.
Are these real exam questions or dumps?
These are original practice questions written to test the same concepts the SAP-C02 exam covers. They are not copied from any real exam or dump site.