SCS-C03 Identity and Access Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  aws iam list-user-policies --user-name <username>

  Why it's wrong here

  This command only lists inline policies, not managed policies. If a user has managed policies attached, this command will return an incomplete view of the user's permissions, leading to an inaccurate audit. You must use the 'list-attached-user-policies' command to see the full scope of managed policy attachments.

• ✓

  aws iam list-attached-user-policies --user-name <username>

  Why this is correct

  This is the correct CLI command to list all managed policies attached to an IAM user. Managed policies are the most common way to grant permissions, so listing them is the first step in assessing a user's permission set. This command provides a clear, concise list for audit reporting.

• ✗

  aws iam get-user-policy --user-name <username>

  Why it's wrong here

  This command requires a specific policy name as an argument. It is used to retrieve the contents of a specific inline policy rather than listing all policies attached to a user. Without knowing the policy name in advance, this command is ineffective for conducting a general audit of user permissions.

• ✗

  aws iam describe-user --user-name <username>

  Why it's wrong here

  The 'describe-user' command returns metadata about the IAM user, such as the ARN, creation date, and path. It does not provide information regarding the policies attached to the user. To view permissions, you must use the policy-specific list or get commands within the IAM namespace.