SCS-C03 Data Protection Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Only update the IAM policy in Account A to allow 'kms:Decrypt'.

  Why it's wrong here

  IAM policies only define the permissions an identity has. They do not override the KMS key policy, which is the resource-based policy that acts as a gatekeeper. If the key policy in Account B does not explicitly trust the IAM role from Account A, the access will be denied.

• ✗

  Only update the KMS key policy in Account B to allow the role from Account A.

  Why it's wrong here

  While the key policy in Account B is necessary, the IAM identity in Account A must also have the corresponding permissions in its own IAM policy. AWS requires both identity-based and resource-based policies to 'allow' an action for cross-account access to succeed.

• ✓

  Update the IAM policy in Account A and the KMS key policy in Account B.

  Why this is correct

  This dual-policy configuration is required for cross-account access. The key policy grants permission to the external account's role, and the IAM policy ensures the role has permission to exercise that grant. This combination follows the principle of least privilege while enabling necessary cross-account functionality.

• ✗

  Create an IAM user in Account B and provide credentials to the application.

  Why it's wrong here

  Creating cross-account IAM users is a major security anti-pattern. It violates security best practices and increases administrative burden. Role assumption is the secure, standard mechanism for cross-account access, providing temporary credentials and avoiding the management of long-term credentials like access keys.