SCS-C03 Identity and Access Management Practice Question
A security engineer is troubleshooting an IAM policy evaluation issue where an explicit deny statement inside a permissions boundary is failing to restrict permissions as expected for a developer role. Which TWO factors must the engineer verify during the evaluation process?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Confirm that the evaluated request is not using AWS account root user credentials, as permissions boundaries do not apply to the root user.
Understanding IAM evaluation logic is critical for debugging complex access control models. Permissions boundaries limit the maximum permissions an IAM entity can have, but they do not grant permissions on their own. Explicit denies anywhere in the evaluation chain will always take precedence over allows.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Verify whether the attached identity-based policy contains an explicit deny that overrides the permissions boundary constraints.
Why it's wrong here
An explicit deny inside an identity-based policy does not override a permissions boundary. Instead, both permissions boundaries and identity-based policies must allow an action, and any explicit deny from either construct will result in access being denied.
- ✓
Confirm that the evaluated request is not using AWS account root user credentials, as permissions boundaries do not apply to the root user.
Why this is correct
Permissions boundaries can be applied to IAM users and roles, but they cannot restrict the AWS account root user. If testing is inadvertently performed using root credentials, permissions boundaries and their contained denies will be completely ignored.
- ✗
Check if an active service control policy in the organization enables permissions boundaries to be bypassed for trusted administrative roles.
Why it's wrong here
Service control policies establish maximum permissions for accounts in an organization, but they do not provide a mechanism to bypass permissions boundaries. Permissions boundaries are evaluated independently as part of the local account IAM evaluation workflow.
- ✗
Ensure that the principal is not performing an action that is exempted from permissions boundaries, such as setting up specific IAM policies.
Why it's wrong here
Permissions boundaries restrict all actions attempted by the IAM entity unless specifically evaluated otherwise. There is no built-in exemption mechanism that causes standard identity actions to inherently bypass an applied permissions boundary constraint.
- ✓
Verify that the request is not originating from a trusted service making service-linked role calls that inherently bypass permissions boundaries.
Why this is correct
Service-linked roles are managed by AWS services and are designed to perform actions on behalf of the service. These specialized roles are not constrained by standard user or role permissions boundaries, which can cause unexpected access if not accounted for.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
About these practice questions
Courseiva writes every SCS-C03 question from scratch — 99 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C03 exam.