Design, implement, and troubleshoot authentication for AWS resources.
12 practice questions under this official exam objective (SCS-C02, SCS-C03), each with the answer key, an option-by-option explanation and instant feedback.
Questions under this objective
12 total · page 1 of 1Investigate the exposed key with IAM Access Analyzer and deactivate it to stop further use
An IAM access key was leaked in a public repo. To both find out whether it was misused and stop misuse, deactivate the exposed key immediately (preven
Use IAM Identity Center with the external IdP and permission sets for scalable multi-accou
With over 100 growing accounts and an external corporate IdP, the company needs scalable role-based access. AWS IAM Identity Center integrates with th
Block fraudulent foreign sign-ups with a pre-sign-up Lambda trigger and a Cognito WAF geo
A France-only app sees fraudulent sign-ups from outside France and needs custom accept/deny validation at registration. A pre sign-up AWS Lambda trigg
How to enforce MFA for AWS CLI EC2 commands?
The IAM policy blocks EC2 CLI actions when aws:MultiFactorAuthPresent is false, so long-term access keys cannot satisfy it. The page establishes that
Replace SSH keys with Systems Manager Session Manager for secure admin access
A mixed Linux and Windows fleet in private subnets needs the most secure remote administration. Do not bake SSH-RSA keys into new instances; instead u
Let CLI users satisfy an MFA-required policy with aws sts get-session-token and MFA parame
An IAM group policy denies actions unless the request includes MFA (aws:MultiFactorAuthPresent), so users cannot run EC2 CLI commands with their long-
Use IAM Identity Center with the external IdP and permission sets for org-wide access
The company is creating an AWS Organization and needs to federate its external IdP for user management while centrally controlling access to all AWS a
Alert on root console login via a CloudWatch Logs metric-filter alarm and an EventBridge C
CloudTrail already logs to S3; the engineer wants near-real-time email if the root user signs in to the console. Two actions achieve this: send CloudT
Pass the current credentials as AWS CLI command-line options for highest precedence withou
A developer's workstation has multiple roles configured via env vars and CLI config files, and new calls fail with AccessDenied. To evaluate the curre
Add an aws:MultiFactorAuthPresent condition to the role's trust policy for MFA-gated assum
IAM users in Account B assume a role in Account A to upload documents, and the new rule requires MFA. The trust policy of the role controls who can as
Migrate game authentication to Amazon Cognito user pools federated with third-party IdPs
An online game with hundreds of thousands of users is overwhelmed by password-reset and login-assistance requests. Moving authentication to Amazon Cog
How to Authenticate External Users Across ECS Microservices?
The SCS-C03 hotspot asks you to order the Cognito user pool, Cognito app client, and API Gateway Lambda authorizer steps that authenticate external us