SCS-C02 Identity and Access Management Practice Question
A company has an S3 bucket with a bucket policy that grants access to a specific IAM role. However, users who assume that role are unable to list objects in the bucket. The bucket policy includes a Principal element set to the role ARN. What is the MOST likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The IAM role does not have a permissions policy that allows s3:ListBucket.
Bucket policies do not grant permissions to IAM role principals unless the role has an IAM policy that allows the S3 action. Option B is false; ACLs are not the issue here; the role lacks an IAM policy. Option C is false; the scenario does not involve MFA, and even if MFA were required, the role’s inability to list objects is due to missing IAM permissions. Option D is false; the role’s trust policy allows AssumeRole, otherwise the users could not assume the role.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The IAM role does not have a permissions policy that allows s3:ListBucket.
Why this is correct
The IAM role needs a permissions policy that allows s3:ListBucket. A bucket policy alone does not grant access to IAM principals; the role must also have an IAM policy allowing the action.
- ✗
The bucket has an ACL that denies access to the role.
Why it's wrong here
False; ACLs are not the likely cause. The primary issue is that the IAM role lacks a permissions policy for s3:ListBucket, not an ACL denying access.
- ✗
The bucket policy requires MFA, but the role does not enforce MFA.
Why it's wrong here
False; there is no indication of MFA requirements. The common cause of this issue is the missing IAM policy on the role, not MFA enforcement.
- ✗
The role's trust policy does not allow sts:AssumeRole.
Why it's wrong here
False; if the trust policy did not allow sts:AssumeRole, users could not assume the role at all. Since they can assume it, the trust policy is correctly configured.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 376 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has an S3 bucket with a bucket policy that grants access to a specific IAM role. The role is used by an application running on an EC2 instance. The application is unable to access the bucket, but the role can access other resources. What is the most likely cause?
hard- A.A service control policy (SCP) denies access to the bucket
- B.The bucket policy denies access to the role
- ✓ C.The EC2 instance does not have an instance profile associated with the role
- D.The role's trust policy does not allow EC2 to assume the role
Why C: An EC2 instance must have an instance profile associated with the IAM role to grant the role's permissions to applications running on the instance. Without the instance profile, the application cannot inherit the role's permissions, even though the role itself can access other resources. Option A is incorrect because SCPs are not mentioned and would affect all resources in the account, not just the bucket. Option B is incorrect because the bucket policy grants access, not denies. Option D is incorrect because the role's trust policy is likely correct since the role can access other resources.
Variation 2. A company has an S3 bucket with a bucket policy that grants access to an IAM role used by an application running on EC2. The application is unable to read objects from the bucket, even though the IAM role has the necessary permissions. What is the most likely cause?
medium- A.The bucket is in a different AWS account.
- ✓ B.The bucket policy denies access to the IAM role.
- C.The bucket policy does not explicitly allow the IAM role.
- D.The IAM role has an explicit deny statement.
Why B: The most likely cause is that the bucket policy explicitly denies access to the IAM role. Even though the IAM role has the necessary permissions via its attached policies, an explicit deny in the bucket policy overrides any allow, resulting in denied access. Option A is incorrect because cross-account access can be granted with proper permissions. Option C is incorrect because while a missing explicit allow would also deny access by default, the question says the IAM role has the necessary permissions, implying the issue is an explicit deny. Option D is incorrect because if the IAM role had an explicit deny, it would also deny access, but the role is stated to have the necessary permissions.
Variation 3. A developer needs to access an S3 bucket from an EC2 instance. The developer creates an IAM role with the necessary S3 permissions and attaches it to the instance profile. However, applications running on the instance can still not access the bucket. What is the most likely cause?
hard- A.The IAM role cannot be attached after the EC2 instance is launched.
- ✓ B.The IAM role is not attached to the EC2 instance's instance profile.
- C.The instance metadata service is disabled on the EC2 instance.
- D.The S3 bucket policy does not explicitly grant access to the IAM role.
Why B: The IAM role must be associated with the EC2 instance's instance profile. If the role is not attached to the instance profile, the instance cannot assume the role, and applications will not have the necessary permissions to access S3. Option A is incorrect because the instance metadata service is not required to be enabled for IAM roles to work; it is used to retrieve temporary credentials but is often enabled by default. Option C is incorrect because an IAM role can be attached to an existing instance via modifying the instance profile, not just at launch. Option D is incorrect because while a bucket policy can grant access to a specific role, it is not necessary if the role already has S3 permissions via an IAM policy.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.