SCS-C03 Security Foundations and Governance Practice Question
Which AWS IAM best practice ensures that users have only the permissions necessary to perform their specific business roles?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply the Principle of Least Privilege.
The 'Principle of Least Privilege' is the foundational concept in security governance. By ensuring that identities are granted the minimum level of access required to complete their tasks, organizations significantly reduce the blast radius if an account is compromised. This strategy prevents lateral movement and unauthorized data access, creating a much more resilient environment where security controls are proportional to the user's operational needs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign the 'AdministratorAccess' policy to all users.
Why it's wrong here
Assigning 'AdministratorAccess' to all users violates the principle of least privilege. It gives users excessive, unnecessary permissions, which increases the risk of accidental resource destruction or malicious insider threats. Effective security requires granular control where permissions are tailored to individual job functions and business needs.
- ✓
Apply the Principle of Least Privilege.
Why this is correct
This principle is the cornerstone of IAM security. By granting only the specific permissions needed for a job, you limit the potential for error and malicious activity. This approach is standard for all security governance frameworks, ensuring that every identity is constrained to its legitimate scope of operation.
- ✗
Use only root account credentials for all tasks.
Why it's wrong here
Using the root account is a major security violation. The root account has full access to everything in the account, including billing and account closure, and should never be used for daily tasks. IAM best practices mandate the creation of specific users or roles for every unique identity.
- ✗
Allow all traffic in Security Groups.
Why it's wrong here
Allowing all traffic in Security Groups is a network security failure. Governance requires that network ports and protocols are strictly limited to the absolute minimum necessary for application functionality, preventing unauthorized access to instances and databases. This is a network-level application of the least-privilege principle.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
About these practice questions
Courseiva writes every SCS-C03 question from scratch — 99 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C03 exam.