SCS-C02 Identity and Access Management Practice Question
A security engineer notices that an IAM role has a trust policy that allows 'sts:AssumeRole' from any AWS account. What is the security risk?
⚠ Common exam trap
SCS-C02 often tests the misconception that a wildcard Principal in a trust policy grants service access or exposes permissions, when the actual risk is that any external IAM principal can assume the role and exercise its permissions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Any IAM user in any AWS account can assume the role and gain its permissions.
A trust policy with a Principal of "*" (or an account root without conditions) allows sts:AssumeRole from any AWS account, meaning any IAM principal in any account that knows the role ARN can call AssumeRole and obtain temporary credentials scoped to that role's permissions. This is a classic cross-account confused-deputy vulnerability: the role's identity-based policies determine what the assumer can do, so the blast radius is exactly the role's permissions. The risk is not that permissions are 'exposed' in a read sense, but that they can be actively exercised by untrusted external principals.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The role can be assumed by any AWS service.
Why it's wrong here
The trust policy in question uses an AWS account or IAM principal wildcard ('AWS': '*'), which authorizes any IAM user or role to call sts:AssumeRole. AWS services assume roles via service principals (e.g., ec2.amazonaws.com) declared explicitly in the trust relationship. Since no service principal is listed, the statement is incorrect; the role is not automatically assumable by services.
- ✗
The role's permissions are exposed to all AWS accounts.
Why it's wrong here
The role’s permissions are attached to the role and only become effective in a session after successful sts:AssumeRole; they are never 'exposed' to other accounts. The trust policy governs who can request temporary security credentials, not what those credentials can access once issued. Even if an account can assume the role, the permissions themselves remain confined to the role's own policy and are not directly visible or usable by the account.
- ✓
Any IAM user in any AWS account can assume the role and gain its permissions.
Why this is correct
Because the trust policy allows 'sts:AssumeRole' from any principal (often expressed as 'Principal': '*'), any IAM user in any AWS account can call the STS API to assume this role. Upon successful assumption, AWS returns temporary credentials bound to the role's permission policy, so the user gains whatever access that policy grants. This is precisely the overly permissive condition that makes the role dangerous.
- ✗
The role can be used to access resources in other accounts.
Why it's wrong here
A role's trust policy is about authentication (who can assume it), not authorization to specific resources. Whether the role can access resources in other accounts depends entirely on its permission policy and the resource policies of those target accounts. An overly permissive trust policy does not automatically extend cross-account access; the role might still only be able to reach resources in its own account.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
One of 1,205 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.