SCS-C02 Identity and Access Management Practice Question
A company wants to allow cross-account access to an S3 bucket in Account A for a user in Account B. What is the correct combination of steps?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a bucket policy in Account A allowing access to the user in Account B, and attach an IAM policy to the user in Account B allowing access to the bucket.
Cross-account access to an S3 bucket requires two key permissions: a resource-based policy (bucket policy) in the owning account (Account A) that grants access to the specific IAM user in Account B, and an identity-based policy (IAM policy) attached to that user in Account B that permits the necessary S3 actions. Option A correctly describes this combination. Option D grants the bucket policy to the entire Account B, which may work but is less secure and not the recommended least-privilege approach; furthermore, the bucket policy to 'Account B' alone does not grant access to a specific user unless accompanied by the correct IAM policy, but the phrasing is ambiguous and not as precise as Option A. Option B suggests using an IAM role in Account A, which would require the user to assume the role, a different pattern not matching the question's scenario. Option C is incorrect because the user in Account B must have an explicit IAM policy; the bucket policy alone is insufficient.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Add a bucket policy in Account A allowing access to the user in Account B, and attach an IAM policy to the user in Account B allowing access to the bucket.
Why this is correct
Correct: Both a bucket policy granting access to the specific user and an IAM policy for that user are required for cross-account access.
- ✗
Create an IAM role in Account A with access to the bucket, and have the user in Account B assume that role.
Why it's wrong here
Incorrect: A role in Account A would require the user to assume the role, not direct access via IAM policy.
- ✗
Add a bucket policy in Account A allowing access to Account B, and no action is needed in Account B because the user already has permissions.
Why it's wrong here
Incorrect: The user in Account B needs an IAM policy; the bucket policy alone does not grant access.
- ✗
Add a bucket policy in Account A allowing access to Account B, and attach an IAM policy to the user in Account B allowing access to the bucket.
Why it's wrong here
Incorrect: While granting access to the entire account is possible, the recommended practice is to grant access directly to the specific IAM user, making Option A more accurate.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 376 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.