SCS-C02 Identity and Access Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  The user has not been assigned to any AWS accounts in IAM Identity Center.

  Why this is correct

  This is correct because the user successfully authenticated to IAM Identity Center (the portal loaded and they can log in), but the portal only displays AWS accounts to which the user has been explicitly granted access. In IAM Identity Center, administrators must create an account assignment that pairs a principal (user or group) with a permission set for a specific AWS account. If no such assignment exists for this user, the login succeeds but the account list is empty, so the user sees no accounts to choose from.

• ✗

  The user's identity source (e.g., Active Directory) is not synchronized correctly.

  Why it's wrong here

  This is incorrect because a synchronization problem with the identity source would typically prevent the user from authenticating at all—the user would not exist or would fail password validation against Active Directory or another IdP. Since the user can log in, their identity was successfully resolved from the source, which proves synchronization is working. A stale or mis-synchronized directory might cause missing group memberships or stale attributes, but it would not produce an empty account list while still allowing login.

• ✗

  The user's session token has expired.

  Why it's wrong here

  This is incorrect because the user is already logged in and can access the IAM Identity Center portal, which means their current session token was valid at the time of login and is still active enough to render the portal. In IAM Identity Center, session tokens (created after SSO authentication) control access to the portal and downstream accounts; if the token had expired, the user would be prompted to re-authenticate or would receive an authentication error, not an empty account list. An expired session token would prevent the portal from loading or would show a 'session expired' message, but it would never present a successfully authenticated logged-in view with no accounts.

• ✗

  The permission set assigned to the user does not grant any permissions.

  Why it's wrong here

  This is incorrect because a permission set defines what a user can do inside an account after they access it (e.g., which IAM policies are applied to the temporary session), not whether the account appears in the portal. To see an account in IAM Identity Center, the user must have an account assignment—a binding of the user or their group to a permission set for that account. Without that assignment, no account is visible regardless of what permissions any permission set might contain. If the user were assigned an account with an insufficient permission set, they would see the account but then encounter authorization errors when trying to use it.

Go deeper

Related to this question