AWS Certified Security - Specialty (SCS-
C02)
Domain 1: Identity and Access Management (IAM)
Practice Exam
Total Questions: 77 | Target Certification: AWS Certified
Security - Specialty
Exam Overview & Overview of Domain 1
Domain 1 of the AWS Certified Security Specialty exam evaluates your ability to design,
implement, and troubleshoot identity and access management solutions across single and multi-
account AWS environments. Key concepts tested include IAM policy evaluation logic, cross-
account access patterns, AWS Organizations Service Control Policies (SCPs), IAM Identity
Center (AWS SSO), Attribute-Based Access Control (ABAC), identity federation (SAML/OIDC),
temporary security credentials (AWS STS), and security auditing tools like IAM Access
Analyzer.
Practice Questions
1. Which IAM Policy element explicitly defines whether an action is permitted or
blocked, and takes absolute precedence in policy evaluation logic regardless of
other statements?
A. Allow
B. Explicit Deny
C. Implicit Deny
D. NotAction
Correct Answer: B. Explicit Deny
Explanation: In AWS IAM policy evaluation, an explicit deny in any applicable policy
(identity-based, resource-based, SCP, or boundary) overrides any explicit allows.
2. A Security Engineer needs to ensure that developers can only launch EC2
instances if they apply a tag with Key="Environment" and Value="Development".
Which IAM policy condition key should be used?
A. aws:ResourceTag/Environment
B. aws:RequestTag/Environment
C. aws:PrincipalTag/Environment
D. aws:TagKeys
Correct Answer: B. aws:RequestTag/Environment
Explanation: aws:RequestTag tests the tag key-value pairs being passed in the request
when creating or tagging a resource. aws:ResourceTag evaluates tags that already exist
on the resource.
3. Which parameter must be included when assuming an IAM role across different
AWS accounts owned by third-party vendors to prevent the "confused deputy"
, problem?
A. ExternalId
B. RoleSessionName
C. PolicyArns
D. DurationSeconds
Correct Answer: A. ExternalId
Explanation: The ExternalId is a unique string agreed upon between the customer and
the third party. It prevents another party from using the third party's ARN to assume roles
in victim accounts.
4. An organization wants to centrally manage user access to multiple AWS accounts
and cloud applications using Azure AD as an identity provider. Which AWS service
provides native integration for single sign-on across accounts?
A. AWS Directory Service AD Connector
B. AWS IAM Identity Center (successor to AWS Single Sign-On)
C. AWS STS Web Identity Federation
D. Amazon Cognito Identity Pools
Correct Answer: B. AWS IAM Identity Center (successor to AWS Single Sign-On)
Explanation: AWS IAM Identity Center simplifies multi-account access management by
connecting to external IDPs like Azure AD via SAML 2.0 and SCIM for automated user
and group provisioning.
5. A security auditor needs to list all inactive IAM users who haven't logged in for over
90 days. Which IAM feature provides a downloadable CSV containing full password
and access key usage data for all users in an account?
A. IAM Access Advisor
B. IAM Credential Report
C. IAM Access Analyzer
D. AWS Config Rules
Correct Answer: B. IAM Credential Report
Explanation: The IAM Credential Report is a downloadable CSV report listing all IAM
users in the account and the status of their passwords, access keys, and MFA devices.
6. What happens when an identity-based policy allows an action, a permissions
boundary allows the action, but a Service Control Policy (SCP) at the
Organizational Unit (OU) level does not mention the action?
A. The action is allowed because the permissions boundary allows it.
B. The action is implicitly denied because SCPs act as guardrails and require an explicit
allow.
C. The action is allowed because SCPs default to full access unless attached explicitly.
D. The action fails due to missing resource-based permissions.
Correct Answer: B. The action is implicitly denied because SCPs act as guardrails and
require an explicit allow.
Explanation: SCPs restrict maximum permissions. If an SCP is attached to an
account/OU, an action must be explicitly allowed by the SCP to be permitted (or inherited
from the default FullAWSAccess SCP).
7. Which AWS STS API call should be used when federating users via OpenID
Connect (OIDC) providers such as Google or Login with Amazon?
A. sts:AssumeRole
B. sts:AssumeRoleWithSAML
C. sts:AssumeRoleWithWebIdentity
D. sts:GetFederationToken
Correct Answer: C. sts:AssumeRoleWithWebIdentity
Explanation: AssumeRoleWithWebIdentity returns temporary security credentials for
, users authenticated through a public web identity provider compatible with OpenID
Connect (OIDC).
8. A Security Engineer needs to restrict access to an S3 bucket so that objects can
only be accessed over encrypted connections (HTTPS). Which condition key in the
S3 bucket policy achieves this?
A. "aws:SecureTransport": "true" with an Allow statement
B. "aws:SecureTransport": "false" with a Deny statement
C. "s3:x-amz-server-side-encryption": "AES256"
D. "aws:CurrentTime" condition key
Correct Answer: B. "aws:SecureTransport": "false" with a Deny statement
Explanation: Denying requests where aws:SecureTransport is false enforces HTTPS
strictly across all incoming requests to the S3 bucket.
9. An IAM policy contains a Permissions Boundary. What is the effective permission
set granted to an IAM entity assigned this boundary?
A. The union of the Identity-Based policy and the Permissions Boundary.
B. The intersection (overlap) of the Identity-Based policy and the Permissions Boundary.
C. The Permissions Boundary overrides and replaces the Identity-Based policy.
D. The identity receives all permissions except those listed in the Permissions Boundary.
Correct Answer: B. The intersection (overlap) of the Identity-Based policy and the
Permissions Boundary.
Explanation: A permissions boundary sets the maximum permissions an identity-based
policy can grant. Effective permissions are the intersection of both policies.
10. Which service uses formal reasoning to analyze resource policies across your
AWS environment and identify unintended public or cross-account access?
A. AWS Trusted Advisor
B. IAM Access Analyzer
C. AWS Security Hub
D. Amazon GuardDuty
Correct Answer: B. IAM Access Analyzer
Explanation: IAM Access Analyzer uses automated reasoning to analyze resource-
based policies (S3, KMS, IAM Roles, SQS, Lambda) and flag resources shared
externally.
11. Which IAM condition key allows restricting API actions based on the specific
source IP address or range of the requestor?
A. aws:VpcSourceIp
B. aws:SourceIp
C. aws:ClientIp
D. aws:PrincipalIp
Correct Answer: B. aws:SourceIp
Explanation: aws:SourceIp restricts requests based on the requestor's public IP address
or CIDR range.
12. A company wants to enforce Multi-Factor Authentication (MFA) for administrative
operations. Which condition key should be evaluated in IAM policies to verify MFA
authentication?
A. aws:MultiFactorAuthPresent
B. aws:MFAAuthenticated
C. aws:MFAState
D. aws:AuthMethod
Correct Answer: A. aws:MultiFactorAuthPresent
Explanation: aws:MultiFactorAuthPresent checks whether temporary credentials used to
make the request were generated using MFA.
C02)
Domain 1: Identity and Access Management (IAM)
Practice Exam
Total Questions: 77 | Target Certification: AWS Certified
Security - Specialty
Exam Overview & Overview of Domain 1
Domain 1 of the AWS Certified Security Specialty exam evaluates your ability to design,
implement, and troubleshoot identity and access management solutions across single and multi-
account AWS environments. Key concepts tested include IAM policy evaluation logic, cross-
account access patterns, AWS Organizations Service Control Policies (SCPs), IAM Identity
Center (AWS SSO), Attribute-Based Access Control (ABAC), identity federation (SAML/OIDC),
temporary security credentials (AWS STS), and security auditing tools like IAM Access
Analyzer.
Practice Questions
1. Which IAM Policy element explicitly defines whether an action is permitted or
blocked, and takes absolute precedence in policy evaluation logic regardless of
other statements?
A. Allow
B. Explicit Deny
C. Implicit Deny
D. NotAction
Correct Answer: B. Explicit Deny
Explanation: In AWS IAM policy evaluation, an explicit deny in any applicable policy
(identity-based, resource-based, SCP, or boundary) overrides any explicit allows.
2. A Security Engineer needs to ensure that developers can only launch EC2
instances if they apply a tag with Key="Environment" and Value="Development".
Which IAM policy condition key should be used?
A. aws:ResourceTag/Environment
B. aws:RequestTag/Environment
C. aws:PrincipalTag/Environment
D. aws:TagKeys
Correct Answer: B. aws:RequestTag/Environment
Explanation: aws:RequestTag tests the tag key-value pairs being passed in the request
when creating or tagging a resource. aws:ResourceTag evaluates tags that already exist
on the resource.
3. Which parameter must be included when assuming an IAM role across different
AWS accounts owned by third-party vendors to prevent the "confused deputy"
, problem?
A. ExternalId
B. RoleSessionName
C. PolicyArns
D. DurationSeconds
Correct Answer: A. ExternalId
Explanation: The ExternalId is a unique string agreed upon between the customer and
the third party. It prevents another party from using the third party's ARN to assume roles
in victim accounts.
4. An organization wants to centrally manage user access to multiple AWS accounts
and cloud applications using Azure AD as an identity provider. Which AWS service
provides native integration for single sign-on across accounts?
A. AWS Directory Service AD Connector
B. AWS IAM Identity Center (successor to AWS Single Sign-On)
C. AWS STS Web Identity Federation
D. Amazon Cognito Identity Pools
Correct Answer: B. AWS IAM Identity Center (successor to AWS Single Sign-On)
Explanation: AWS IAM Identity Center simplifies multi-account access management by
connecting to external IDPs like Azure AD via SAML 2.0 and SCIM for automated user
and group provisioning.
5. A security auditor needs to list all inactive IAM users who haven't logged in for over
90 days. Which IAM feature provides a downloadable CSV containing full password
and access key usage data for all users in an account?
A. IAM Access Advisor
B. IAM Credential Report
C. IAM Access Analyzer
D. AWS Config Rules
Correct Answer: B. IAM Credential Report
Explanation: The IAM Credential Report is a downloadable CSV report listing all IAM
users in the account and the status of their passwords, access keys, and MFA devices.
6. What happens when an identity-based policy allows an action, a permissions
boundary allows the action, but a Service Control Policy (SCP) at the
Organizational Unit (OU) level does not mention the action?
A. The action is allowed because the permissions boundary allows it.
B. The action is implicitly denied because SCPs act as guardrails and require an explicit
allow.
C. The action is allowed because SCPs default to full access unless attached explicitly.
D. The action fails due to missing resource-based permissions.
Correct Answer: B. The action is implicitly denied because SCPs act as guardrails and
require an explicit allow.
Explanation: SCPs restrict maximum permissions. If an SCP is attached to an
account/OU, an action must be explicitly allowed by the SCP to be permitted (or inherited
from the default FullAWSAccess SCP).
7. Which AWS STS API call should be used when federating users via OpenID
Connect (OIDC) providers such as Google or Login with Amazon?
A. sts:AssumeRole
B. sts:AssumeRoleWithSAML
C. sts:AssumeRoleWithWebIdentity
D. sts:GetFederationToken
Correct Answer: C. sts:AssumeRoleWithWebIdentity
Explanation: AssumeRoleWithWebIdentity returns temporary security credentials for
, users authenticated through a public web identity provider compatible with OpenID
Connect (OIDC).
8. A Security Engineer needs to restrict access to an S3 bucket so that objects can
only be accessed over encrypted connections (HTTPS). Which condition key in the
S3 bucket policy achieves this?
A. "aws:SecureTransport": "true" with an Allow statement
B. "aws:SecureTransport": "false" with a Deny statement
C. "s3:x-amz-server-side-encryption": "AES256"
D. "aws:CurrentTime" condition key
Correct Answer: B. "aws:SecureTransport": "false" with a Deny statement
Explanation: Denying requests where aws:SecureTransport is false enforces HTTPS
strictly across all incoming requests to the S3 bucket.
9. An IAM policy contains a Permissions Boundary. What is the effective permission
set granted to an IAM entity assigned this boundary?
A. The union of the Identity-Based policy and the Permissions Boundary.
B. The intersection (overlap) of the Identity-Based policy and the Permissions Boundary.
C. The Permissions Boundary overrides and replaces the Identity-Based policy.
D. The identity receives all permissions except those listed in the Permissions Boundary.
Correct Answer: B. The intersection (overlap) of the Identity-Based policy and the
Permissions Boundary.
Explanation: A permissions boundary sets the maximum permissions an identity-based
policy can grant. Effective permissions are the intersection of both policies.
10. Which service uses formal reasoning to analyze resource policies across your
AWS environment and identify unintended public or cross-account access?
A. AWS Trusted Advisor
B. IAM Access Analyzer
C. AWS Security Hub
D. Amazon GuardDuty
Correct Answer: B. IAM Access Analyzer
Explanation: IAM Access Analyzer uses automated reasoning to analyze resource-
based policies (S3, KMS, IAM Roles, SQS, Lambda) and flag resources shared
externally.
11. Which IAM condition key allows restricting API actions based on the specific
source IP address or range of the requestor?
A. aws:VpcSourceIp
B. aws:SourceIp
C. aws:ClientIp
D. aws:PrincipalIp
Correct Answer: B. aws:SourceIp
Explanation: aws:SourceIp restricts requests based on the requestor's public IP address
or CIDR range.
12. A company wants to enforce Multi-Factor Authentication (MFA) for administrative
operations. Which condition key should be evaluated in IAM policies to verify MFA
authentication?
A. aws:MultiFactorAuthPresent
B. aws:MFAAuthenticated
C. aws:MFAState
D. aws:AuthMethod
Correct Answer: A. aws:MultiFactorAuthPresent
Explanation: aws:MultiFactorAuthPresent checks whether temporary credentials used to
make the request were generated using MFA.
