Identity and Access Management — SCS-C03 Practice Quiz

Question 1

A security engineer at a large enterprise must enforce least privilege across 200 AWS accounts in an AWS Organization. Leadership wants an ongoing, automated way to identify IAM roles and users that have permissions they are not actually using (unused access), and to generate refined policies based on observed CloudTrail activity, so that overly broad policies can be tightened. Which approach best meets these requirements with the least custom development?

Accepted Answer

Enable IAM Access Analyzer unused access findings with a delegated administrator account for the organization, and use Access Analyzer policy generation to create least-privilege policies from CloudTrail activity.

Answer

Enable IAM Access Analyzer external access analyzer in each account to detect resources shared outside the organization and manually rewrite the attached identity policies.

Answer

Use the IAM credential report and Access Advisor last-accessed data in each account, then write a Lambda function to parse the reports and email owners about unused permissions.

Answer

Attach a service control policy at the organization root that denies any API action not recorded in the last 90 days of CloudTrail logs.

Question 2

A company runs a KMS-encrypted S3 bucket in account A (111111111111). A data-processing application running on an EC2 instance in account B (222222222222) uses an IAM role to read objects. The security team confirms the S3 bucket policy in account A grants s3:GetObject to the account B role's ARN, and the KMS key policy in account A grants kms:Decrypt to the same role ARN. However, the application receives AccessDenied errors when downloading objects. The IAM role in account B currently has no attached identity-based policy for S3 or KMS. What must be changed to allow the download to succeed?

Accepted Answer

Attach an identity-based policy to the account B role granting s3:GetObject and kms:Decrypt on the relevant resources, in addition to the existing resource-based policies.

Answer

Add a Principal element referencing the account B role to the account A KMS key grant instead of the key policy.

Answer

Configure an SCP in account B that allows s3:GetObject and kms:Decrypt for the role.

Answer

Enable S3 Block Public Access exceptions on the account A bucket so the cross-account role is treated as trusted.

Question 3

A company uses AWS IAM Identity Center integrated with an external SAML 2.0 identity provider (IdP) for workforce single sign-on across multiple AWS accounts. The security team wants each user's home region and cost-center to be passed from the IdP at sign-in so that permission sets can enforce access using policy conditions that reference these values, without creating a separate permission set per cost-center. What is the correct way to achieve this?

Accepted Answer

Configure the IdP to send additional SAML attributes and enable attributes for access control (session tags) in IAM Identity Center, then reference the attributes as aws:PrincipalTag conditions in the permission set policies.

Answer

Create one permission set per cost-center and use SCIM group membership to assign users, since IAM policies cannot evaluate externally supplied attributes.

Answer

Add the cost-center and home region as inline tags on each IAM Identity Center user and reference them with aws:ResourceTag conditions in the permission set policies.

Answer

Store the attributes in an Amazon Cognito user pool and use a pre-token Lambda trigger to inject them into the STS session before assuming the permission set role.

Question 4

A company uses AWS IAM Identity Center (successor to AWS SSO) to manage workforce access across 40 accounts in an organization. The security team wants developers in the 'AppDev' group to receive identical read/write permissions to a specific set of DynamoDB tables in every account, but the exact table ARNs differ per account because they include the account ID. Administrators must be able to update the permission logic in one place and have it propagate to all assigned accounts automatically. Which approach BEST meets these requirements?

Accepted Answer

Create one permission set whose inline policy uses the ${aws:PrincipalAccount} policy variable in the DynamoDB resource ARNs, assign it to the AppDev group for all target accounts, and edit the permission set once to propagate changes.

Answer

Create one permission set with an inline policy that references the DynamoDB tables using a wildcard and the aws:PrincipalAccount condition key, then assign it to the AppDev group across all accounts.

Answer

Create a separate IAM role with an inline policy in each of the 40 accounts and configure IAM Identity Center to assume each role individually per account.

Answer

Attach an AWS managed policy such as AmazonDynamoDBFullAccess to a permission set and assign it to the AppDev group, relying on SCPs to restrict which tables can be accessed.

Question 5

A company uses AWS IAM Identity Center (successor to AWS SSO) with an external SAML 2.0 identity provider for workforce federation. Users are provisioned via SCIM. The security team requires that finance analysts, who assume a permission set into a production account, can only hold active credentials for a maximum of 1 hour, while also ensuring that any employee removed from the finance group in the corporate directory loses access automatically. Which combination of actions BEST meets these requirements?

Accepted Answer

Set the session duration on the finance permission set to 1 hour, and rely on SCIM provisioning to deprovision users automatically when they are removed from the finance group.

Answer

Configure a session policy in the SAML assertion limiting the token to 1 hour, and manually delete the user from IAM Identity Center when they leave the finance group.

Answer

Attach a permission boundary with an aws:CurrentTime condition to the permission set, and configure an EventBridge rule to remove users nightly.

Answer

Set the IAM role maximum session duration to 1 hour in the target account, and use an SCP to deny access outside the finance group.

Question 6

A security engineer manages an S3 bucket that stores audit logs shared across an organization. The bucket resource-based policy must deny all access to the bucket EXCEPT for a specific cross-account IAM role (arn:aws:iam::222222222222:role/AuditReader) and the local account root. The engineer wants the deny to apply to every other principal, including future ones, without having to enumerate them. Which policy construct correctly implements this?

Accepted Answer

A statement with Effect Deny, Action s3:*, Resource the bucket and objects, and NotPrincipal listing the AuditReader role ARN and the account root ARN.

Answer

A statement with Effect Allow, Action s3:*, and Principal set to the AuditReader role, relying on the implicit deny for all other principals.

Answer

A statement with Effect Deny, Action s3:*, and Condition using aws:PrincipalArn with StringNotEquals matching only the AuditReader role ARN.

Answer

A statement with Effect Deny, Action s3:*, and NotPrincipal set to a wildcard '*' to exclude everyone but the AuditReader role.

Question 7

A developer's IAM user has an identity-based policy that allows s3:GetObject and s3:PutObject on all buckets. A permission boundary attached to the same user allows only s3:GetObject on the bucket arn:aws:s3:::reports-data and dynamodb:* on all tables. There are no applicable SCPs or resource-based policies. When the developer attempts s3:PutObject to arn:aws:s3:::reports-data, what is the result and why?

Accepted Answer

Denied, because an action must be allowed by BOTH the identity-based policy and the permission boundary, and the boundary does not permit s3:PutObject.

Answer

Allowed, because the identity-based policy explicitly grants s3:PutObject and permission boundaries only restrict, not grant, so the union is used.

Answer

Allowed, because the permission boundary grants dynamodb:* which broadens the effective permissions to include S3 writes.

Answer

Denied, because the permission boundary contains an explicit Deny for s3:PutObject that overrides the identity-based Allow.

Question 8

A security engineer is designing guardrails for a development team. Developers assume an IAM role that has an identity-based policy granting full access to Amazon S3 and Amazon DynamoDB. The role also has a permissions boundary attached that allows only S3 actions. The account is in an OU whose Service Control Policy (SCP) allows only DynamoDB actions (and denies nothing explicitly). A developer using this role attempts an s3:PutObject call and a dynamodb:PutItem call. What is the result?

Accepted Answer

Both s3:PutObject and dynamodb:PutItem are denied.

Answer

Both s3:PutObject and dynamodb:PutItem succeed because the identity-based policy allows both.

Answer

s3:PutObject succeeds and dynamodb:PutItem is denied.

Answer

dynamodb:PutItem succeeds and s3:PutObject is denied.

Question 9

A company uses AWS Organizations with all features enabled. A developer's IAM user in a member account is attached to an identity-based policy that explicitly allows s3:GetObject on a specific bucket. The bucket's resource-based policy also allows the developer's principal to read objects. However, a Service Control Policy (SCP) attached to the developer's account contains an explicit Deny for all s3:* actions unless the request originates from a specific corporate IP range. The developer, working from home outside that range, receives an AccessDenied error. Which explanation correctly describes the policy evaluation outcome?

Accepted Answer

The SCP explicit deny takes precedence over any Allow in the identity-based or resource-based policies, so the request is denied regardless of the other Allows.

Answer

Because both the identity-based policy and the bucket policy explicitly allow the action, the union of Allows overrides the SCP, so the request should succeed.

Answer

SCPs only affect the root user and management account, so the developer's IAM user should not be blocked by the SCP.

Answer

The resource-based policy grants cross-account access that bypasses SCP evaluation, so the deny must originate from an incorrect bucket policy.

Question 10

A company has thousands of IAM users who each need to manage only their own credentials (access keys, MFA devices, and passwords) without being able to touch any other user's credentials. The security team wants a single reusable managed policy attached to all users rather than per-user policies. Which policy construct allows one policy to scope actions to only the calling user's own IAM resources?

Accepted Answer

Use the policy variable ${aws:username} in the Resource ARN so each user's actions apply only to their own IAM user resource.

Answer

Attach a permissions boundary referencing each user's principal ID to restrict access to their own credentials.

Answer

Create a resource-based policy on each IAM user that grants only that user access to their own credentials.

Answer

Add a condition key aws:PrincipalTag/username that matches the resource tag on each IAM user.

Question 11

A company has an S3 bucket in Account A (the resource owner). A role in Account B needs to read objects from this bucket. The security team configures the following: the bucket policy in Account A grants s3:GetObject to the Account B role's ARN; the role in Account B has an identity-based policy allowing s3:GetObject on the bucket; and Account B is in an AWS Organization with an SCP that denies all s3:* actions except s3:ListBucket. When the role in Account B attempts to download an object, the request is denied. What is the cause?

Accepted Answer

The SCP attached to Account B contains an explicit deny for s3:GetObject, and SCPs restrict the maximum permissions of principals in Account B regardless of resource-based or identity-based allows.

Answer

Cross-account access always requires an IAM role assumption via STS; a bucket policy cannot directly grant access to a role in another account.

Answer

The bucket policy in Account A must also be approved by an SCP in Account A before it can take effect for cross-account principals.

Answer

Because both the identity-based policy and the resource-based policy allow the action, access should be granted; the denial indicates an S3 Block Public Access misconfiguration.

Question 12

A security engineer configures an automation pipeline where an EC2 instance profile role (RoleA) assumes a cross-account role (RoleB) in a partner account to run a long batch job. RoleB has a maximum session duration set to 4 hours. However, when the pipeline calls sts:AssumeRole from RoleA to obtain RoleB credentials, the returned credentials always expire after 1 hour regardless of the DurationSeconds value requested. What is the cause of this behavior?

Accepted Answer

Role chaining limits the assumed-role session to a maximum of 1 hour, and DurationSeconds values above 3600 are rejected or capped.

Answer

The maximum session duration on RoleB must be increased to match the DurationSeconds requested by RoleA.

Answer

STS enforces a hard 1-hour limit on all cross-account AssumeRole calls, so a different mechanism such as SAML federation is required.

Answer

The EC2 instance profile credentials expire after 1 hour, which transitively caps any role assumed from them.

Question 13

A company runs a data-processing application on EC2 instances that must read objects from an S3 bucket. A security engineer creates an IAM role with an S3 read policy and attaches it to an instance profile, but the EC2 instances cannot assume the role and receive an error. The role's trust policy currently lists the AWS account root as the trusted principal. What change to the trust policy will allow the EC2 instances to assume the role?

Accepted Answer

Set the Principal to the Service "ec2.amazonaws.com" so the EC2 service can assume the role via the instance profile.

Answer

Set the Principal to the Service "s3.amazonaws.com" because the role is used to access S3.

Answer

Add each EC2 instance ID as an AWS principal in the trust policy's Principal element.

Answer

Attach the S3 read policy as a resource-based policy on the bucket instead of using a trust policy.

Question 14

A company uses a custom identity broker that authenticates employees against an on-premises Active Directory and then calls AWS STS AssumeRole to grant temporary credentials. All employees assume the same IAM role, DataAnalystRole, which has permissions to read all objects in a large S3 data lake. Compliance now requires that each analyst session be dynamically scoped so a user can only access the S3 prefix for their assigned business unit, WITHOUT creating a separate IAM role per business unit and WITHOUT modifying the DataAnalystRole's attached identity policy. What should the identity broker do when calling STS?

Accepted Answer

Pass an inline session policy in the AssumeRole call that limits S3 access to the user's business-unit prefix; effective permissions become the intersection of the role policy and the session policy.

Answer

Attach a permissions boundary to DataAnalystRole for each business unit before calling AssumeRole so the boundary caps the session to the correct prefix.

Answer

Add the business-unit prefix restriction as a Deny statement in the S3 bucket resource policy keyed on the role's ARN.

Answer

Call GetFederationToken instead of AssumeRole so the broker can embed the user identity directly in the credentials.

Question 15

A company runs hundreds of projects, each with its own set of EC2 instances, S3 buckets, and DynamoDB tables. Every resource is tagged with a 'project' key. The security team wants developers to be able to manage only the resources belonging to their assigned project, without writing a separate IAM policy per project. Each developer's IAM principal is tagged with the project they belong to. Which approach best implements least privilege at scale?

Accepted Answer

Write a single ABAC policy that grants actions with a condition requiring aws:ResourceTag/project to equal aws:PrincipalTag/project.

Answer

Create one IAM policy per project that lists each resource ARN explicitly, and attach the correct policy to each developer group.

Answer

Grant developers full administrative access and rely on AWS Config rules to detect and remediate any cross-project access after the fact.

Answer

Use a permissions boundary on each developer that references the project name in a hardcoded aws:RequestedRegion condition.

Question 16

A company uses AWS IAM Identity Center (successor to AWS SSO) federated with an external SAML identity provider. The security team wants users to access only the AWS resources tagged with the same cost center as the user, without creating a separate permission set per cost center. Each user's cost center is stored as an attribute in the corporate IdP. Which approach BEST meets this requirement while minimizing the number of permission sets to maintain?

Accepted Answer

Enable attributes for access control (ABAC) in IAM Identity Center, map the IdP cost-center attribute to a session tag, and write a permission set policy that uses a condition matching the resource tag to the aws:PrincipalTag/costcenter key.

Answer

Create one permission set per cost center and assign each user to the matching permission set based on their group membership in the external IdP.

Answer

Configure a permission boundary on each permission set that denies access unless the user's IAM user name matches the resource cost-center tag.

Answer

Use an SCP at the organization root that denies access to resources whose tags do not match a hardcoded list of cost centers.

Question 17

A security team wants to let application developers create and manage IAM roles for their own workloads without being able to grant those roles more permissions than the developers themselves are allowed. Developers currently have an identity policy that allows iam:CreateRole, iam:AttachRolePolicy, and iam:PutRolePolicy. The security team is concerned developers could create a role with AdministratorAccess and then assume it to escalate privileges. Which approach enforces this restriction with least operational overhead?

Accepted Answer

Attach a permissions boundary managed policy that defines the maximum permissions, and add a condition to the developers' identity policy requiring that any role they create or modify must have that permissions boundary attached (iam:PermissionsBoundary).

Answer

Create an SCP in the organization that denies iam:CreateRole for all developer accounts and have the security team create roles on the developers' behalf.

Answer

Attach a resource-based policy to each newly created role that denies any action not explicitly approved by the security team.

Answer

Enable AWS IAM Access Analyzer to automatically remove any AdministratorAccess policy that a developer attaches to a role.

Question 18

A SaaS monitoring vendor needs read access to objects in your company's S3 buckets. The vendor asks you to create an IAM role that their AWS account can assume via sts:AssumeRole. Your security team is concerned that another customer of the same vendor could trick the vendor's software into accessing your buckets (a confused deputy attack). Which configuration in your role's trust policy most directly mitigates this risk?

Accepted Answer

Add a Condition that requires sts:ExternalId to match a unique value that you and the vendor agree upon

Answer

Restrict the Principal in the trust policy to the vendor's root account ARN only

Answer

Attach a permissions boundary to the role limiting it to s3:GetObject

Answer

Add an aws:SourceIp condition that limits assumption to the vendor's published NAT gateway IP ranges

Question 19

A company's data-analytics account (111111111111) needs read-only access to a specific prefix (reports/) in an S3 bucket owned by the reporting account (222222222222). Security requires that access be granted with least privilege and that credentials never leave AWS. The bucket has no public access and object ownership is set to bucket-owner-enforced (ACLs disabled). Which combination of policies correctly grants this access?

Accepted Answer

Add an S3 bucket policy in account 222222222222 that allows s3:GetObject on arn:aws:s3:::bucket/reports/* to the principal arn:aws:iam::111111111111:role/AnalyticsRole, and attach an identity policy to AnalyticsRole allowing s3:GetObject on the same resource.

Answer

Attach an identity policy to AnalyticsRole in account 111111111111 allowing s3:GetObject on the bucket; no changes are needed in account 222222222222 because IAM identity policies work across accounts.

Answer

Add a bucket policy in account 222222222222 granting s3:* to Principal "*" with a condition restricting aws:PrincipalOrgID, so any principal in the organization can read the reports.

Answer

Configure an S3 access control list (ACL) on the reports/ objects granting READ to the canonical ID of account 111111111111, and attach an identity policy to AnalyticsRole.

Question 20

A security engineer manages an AWS Organization with 200 accounts. Developers in member accounts have broad IAM permissions, including iam:CreateRole and iam:AttachRolePolicy. The security team wants to prevent any developer from creating or modifying roles that could grant themselves administrative access, while still allowing developers to create service roles for their applications. The team has defined that all developer-created roles MUST have a permissions boundary policy named 'DeveloperBoundary' attached. Which Service Control Policy (SCP) approach best enforces this requirement across all member accounts?

Accepted Answer

Attach an SCP that denies iam:CreateRole and iam:PutRolePolicy unless the request includes a condition matching the permissions boundary ARN via the iam:PermissionsBoundary condition key.

Answer

Attach an SCP that allows iam:CreateRole only for roles tagged with a specific project tag, relying on ABAC to constrain the role's effective permissions.

Answer

Attach the DeveloperBoundary policy directly as an SCP to each member account's organizational unit so it applies to all principals automatically.

Answer

Create an identity-based policy in each account that grants iam:CreateRole and use a resource-based policy on the IAM service to require the boundary.

More SCS-C03 practice