Design, implement, and troubleshoot authorization for AWS resources.
15 practice questions under this official exam objective (SCS-C02, SCS-C03), each with the answer key, an option-by-option explanation and instant feedback.
Questions under this objective
15 total · page 1 of 1CloudWatch agent fails to publish logs because the IAM policy grants cloudwatch: instead o
An EC2 Auto Scaling group launches Amazon Linux instances that run the CloudWatch agent to ship logs to CloudWatch Logs. The agent runs and networking
Grant the report Lambda Security Hub read-only access because findings are already in Secu
A Lambda builds a daily report from Amazon Inspector findings that are stored in AWS Security Hub. Because the data already resides in Security Hub, t
Alice can access both buckets because either an IAM or a bucket policy allows each with no
bucket1 has a bucket policy that explicitly allows user alice access to bucket1/*, and bucket2 has no bucket policy but alice's IAM policy allows acce
Fix encrypted-S3 AccessDenied by attaching an inline kms:Decrypt policy to the instance ro
An EC2 instance profile uses the AWS managed ReadOnlyAccess policy and gets AccessDenied reading a file from an encrypted S3 bucket, even though the b
How to enforce MFA for AWS CLI EC2 commands?
The IAM policy blocks EC2 CLI actions when aws:MultiFactorAuthPresent is false, so long-term access keys cannot satisfy it. The page establishes that
Let CLI users satisfy an MFA-required policy with aws sts get-session-token and MFA parame
An IAM group policy denies actions unless the request includes MFA (aws:MultiFactorAuthPresent), so users cannot run EC2 CLI commands with their long-
Eliminate post-CreateGrant AccessDenied errors by passing the returned grant token to encr
A grant created with CreateGrant may not be effective immediately because KMS is eventually consistent, causing intermittent AccessDeniedException on
Use Amazon Verified Permissions with Cognito as the identity source for fine-grained autho
For fine-grained authorization based on Cognito user attributes, create a policy store in Amazon Verified Permissions, configure Cognito (the existing
Let the business-unit IAM user assume the top-level account role via an sts:AssumeRole pol
Centralized CloudTrail logs sit in a top-level account S3 bucket, with a per-business-unit IAM role (and prefix-scoped read policy) created there. To
Enable IAM Access Analyzer for the organization with a zone of trust and filter by account
To discover which external principals have access to which accounts across a large organization, enable IAM Access Analyzer for the organization and d
Scope the CMK key policy to S3/DynamoDB/Lambda/EKS and deny unencrypted S3/DynamoDB via SC
To encrypt all data at rest (S3, DynamoDB, Lambda, EKS) and enforce least privilege, create a CMK whose key policy allows kms:Decrypt only for those s
Attach an SCP that denies service access to the member-account root user
To protect member accounts even if root credentials are compromised, attach an SCP to the OU that uses an explicit deny on the root user's actions (e.
Verify the SQS resource policy does not deny the role and that the role allows queue acces
EC2 instances stopped retrieving SQS messages after IAM changes. While keeping least privilege, troubleshoot by confirming the SQS queue resource poli
Log script activity in CloudTrail and use IAM Access Analyzer policy generation for least
To replace three AWS managed full-access policies with a least-privilege policy most efficiently, record the script's actual API calls in a CloudTrail
Edit the root SCP to add a Condition excluding the marketing account from the external-sha
An SCP at the organization root denies sharing resources with external accounts for all members of one OU, and only the marketing account needs an exc