SCS-C02 Identity and Access Management Practice Question
A large enterprise uses AWS Organizations to manage multiple accounts. The security team has implemented a Service Control Policy (SCP) at the root level that denies all actions unless the request originates from the corporate IP range (10.0.0.0/8). Recently, a developer in a member account tried to launch an EC2 instance from the AWS Management Console while connected via a VPN that provides an IP address within the corporate range. However, the launch failed with an 'AccessDenied' error. The developer is using an IAM user with full EC2 permissions (ec2:*). The SCP is as follows: {"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"*","Resource":"*","Condition":{"NotIpAddress":{"aws:SourceIp":"10.0.0.0/8"}}}]}. What is the MOST likely reason for the failure?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The aws:SourceIp condition key does not work correctly for requests made via the AWS Management Console because the console may use a different IP.
The SCP uses the aws:SourceIp condition, but when accessing the Management Console, the IP address seen by AWS is the console's IP, which may not be the same as the developer's VPN IP if the console uses a proxy or if the VPN is configured incorrectly. Option A is wrong because SCPs affect all principals, including the root user. Option B is wrong because the SCP denies actions, not allows them; an explicit deny overrides allows. Option D is wrong because the SCP denies all actions, so even if the developer has permissions, the SCP denies them.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The SCP allows actions only from the specified IP range, but the developer's IP is not in that range.
Why it's wrong here
The SCP denies actions from outside the range; it does not allow actions from inside. However, the developer's IP should be in range, so this is not the issue.
- ✗
The SCP does not apply to IAM users in member accounts; it only applies to the root user.
Why it's wrong here
SCPs apply to all principals in the affected accounts, including IAM users.
- ✓
The aws:SourceIp condition key does not work correctly for requests made via the AWS Management Console because the console may use a different IP.
Why this is correct
The console may use intermediary IPs; the source IP condition is not reliable for console access.
- ✗
The IAM user does not have the necessary permissions because the SCP explicitly denies all actions.
Why it's wrong here
The SCP denies actions from outside the IP range, but the developer is inside the range, so the SCP should not deny.
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 376-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.