SCS-C03 Identity and Access Management Practice Question
A developer in Account A needs to use an AWS KMS customer managed key (CMK) located in Account B to encrypt data. Which TWO configuration steps are necessary to allow this cross-account access?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The KMS key policy in Account B must grant the developer's IAM ARN in Account A permission to use the key.
Accessing a KMS key in a different account requires coordination between the IAM policy in the calling account and the key policy in the owning account. KMS is unique because the key policy must explicitly allow the use of the key even if an IAM policy provides permission. This double-check mechanism ensures that key owners maintain strict control over who can decrypt data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The KMS key policy in Account B must grant the developer's IAM ARN in Account A permission to use the key.
Why this is correct
KMS key policies are the primary way to control access to keys. For cross-account access, the policy in the account that owns the key (Account B) must specifically list the external IAM principal from Account A and grant it the necessary actions like 'kms:Encrypt' or 'kms:GenerateDataKey'.
- ✓
The developer's IAM policy in Account A must grant permission to use the KMS key ARN from Account B.
Why this is correct
In addition to the key policy, the identity making the request must have an identity-based policy in its own account (Account A) that allows it to perform the KMS actions on the specific resource ARN of the key located in Account B. Both policies must permit the action.
- ✗
The developer must assume a role in Account B that has permissions to the KMS key.
Why it's wrong here
While assuming a role is one way to gain access to resources in another account, it is not strictly necessary for KMS. KMS supports direct cross-account access via key policies and IAM policies, which is often preferred for simple encryption tasks to avoid the overhead of role switching.
- ✗
The KMS key in Account B must be converted to a multi-Region key to be accessible from Account A.
Why it's wrong here
Multi-Region keys are used to replicate keys across different AWS Regions, not for cross-account access within the same region. A standard regional CMK can be used across different accounts as long as the key policy and identity policies are correctly configured to allow the interaction.
- ✗
An IAM Peering Connection must be established between Account A and Account B.
Why it's wrong here
There is no such thing as an 'IAM Peering Connection.' Networking features like VPC Peering are used for private network traffic but have no bearing on the IAM and KMS policy evaluation logic required to grant an identity in one account permission to use a resource in another.
About these practice questions
Courseiva writes every SCS-C03 question from scratch — 99 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C03 exam.