Identity and Access Management (20%)

SCS-C03 · 60 questions

• A regional hospital runs clinician portals on AWS with 400 staff using corporate Microsoft Entra ID, plus a patient mobile app needing social sign-up and MFA. Policy requires workforce SSO with short-lived AWS access and separate customer identities with adaptive auth. Which authentication solution meets both human identity needs with least custom code?
• A regional bank federates on-premises AD through AWS Directory Service to IAM Identity Center, and tellers suddenly receive access-denied errors when requesting AWS access via permission sets. Group memberships look correct in AD, and the issue started after an AD trust change. Which troubleshooting approach should the engineer use first to isolate the authentication failure?
• A SaaS company runs 200 project environments where engineers change teams monthly, each project uses resources tagged ProjectID, and engineers carry matching job-project attributes from Identity Center. Which authorization strategy should the IAM architect implement to grant project access without updating policies on every transfer?
• A retailer has 2,000 corporate staff federated in Okta and 500,000 shoppers using a new mobile app with social logins. Staff need AWS console access by department, shoppers need scoped API access, and security forbids long-lived keys. Which identity design satisfies both human and customer authentication needs?
• Helpdesk reports finance users get AccessDenied when assuming an IAM Identity Center permission set to reach a production account, while CloudTrail shows no AssumeRole events. SSO logins succeed and other teams work. Which authentication troubleshooting check should the engineer perform first to diagnose the missing permission set assignment?
• Developers report an EC2 application role gets AccessDenied when calling kms:Decrypt, though the identity policy allows it. The role was recently refactored with SCPs and permission boundaries. Which authorization analysis method pinpoints the cause of the failure?
• A SaaS company needs fine-grained tenant authorization for a document API, with developers defining policies in code, plus temporary on-premises build agents accessing S3 without stored long-term keys. The design must separate policy management from application code. Which authorization approach should the architect evaluate for human, application, and system access?
• An audit finds a marketing S3 bucket policy grants s3:GetObject to an unknown external account and several IAM roles have unused EC2 and IAM permissions. The CISO wants prioritized fixes for external and unused access. Which authorization review method best corrects the unintended privileges?
• A media firm lets external editors upload 5-GB raw videos directly to S3 without AWS credentials, with uploads limited to one prefix, content-type, and 15 minutes. The app runs on EC2 and must avoid proxying bytes or sharing long-lived keys. Which temporary credential mechanism grants scoped direct upload access?
• A media studio hires freelance editors who need project- and rating-based access to video assets, runs a thumbnail service on Amazon EKS needing S3 access, and operates an on-premises render farm that must call Amazon Rekognition without long-term keys. Access must be attribute-driven for humans, short-lived for workloads, and certificate-based for servers. Which authorization design should the security architect select to satisfy human, application, and system access?
• A startup with a single standalone AWS account (no AWS Organizations) grants developers permissions to launch approved analytics services but a misconfigured policy once allowed iam:CreateUser in production, and contractors need temporary scoped-down access via federation. Which least-privilege control set should the IAM lead implement to contain delegation risk?
• A photo-sharing app lets authenticated users upload directly to S3 and lets support view private objects for 15 minutes without IAM credentials. The design must avoid long-lived keys and enforce least privilege per object. Which temporary credential mechanism meets both upload and support needs?
• An edtech startup offers a student mobile app using an Amazon Cognito User Pool federated to a university SAML identity provider. After updating SAML attribute mappings, many students face login redirects that fail with token errors while native test users still sign in. CloudTrail is enabled. Which troubleshooting sequence should the engineer follow to diagnose Cognito authentication failures?
• A SaaS company has 40 product teams deploying EC2 and S3 resources tagged Project=Alpha or Beta. Engineers switch projects often, and operators want single roles with access scoped automatically by project without creating new policies per team. Which ABAC and RBAC authorization strategy should the architect design?
• Employees using IAM Identity Center federated to AWS Managed Microsoft AD report intermittent Access Denied when assuming a permission set, while others succeed. Directory health checks pass. Which troubleshooting approach isolates the authentication failure for federated permission set assumptions?
• A SaaS provider has 40 projects with developers rotating frequently and needs access to EC2 and S3 limited to resources tagged with their assigned project. Maintaining separate IAM roles per project is overwhelming administrators. Developers sign in through federation from the corporate identity provider and use temporary credentials. Which authorization design should the architect implement to enforce project-based access using resource tags?
• A retailer runs corporate AWS access for 800 employees with Okta, a customer mobile app with 200,000 users, and EC2 microservices calling DynamoDB. Password sprawl and hard-coded keys caused incidents. Which identity architecture should the architect implement to provide phishing-resistant workforce, customer, and workload authentication?
• Developers report a Lambda execution role receives AccessDenied for s3:GetObject on arn:aws:s3:::reports-q4/ despite an attached IAM policy allowing it. The bucket policy was recently updated, and an SCP now restricts S3 in non-logging accounts. Which diagnostic method should the engineer use to pinpoint the cause of the authorization failure?
• A SaaS company grants developers AWS access, microservices API access, and on-premises servers access to S3 without long-lived keys. Access must scale by team attributes and support fine-grained policy decisions. Which authorization design unifies human, application, and system access with least privilege?
• A logistics firm runs a customer portal on AWS and on-premises barcode scanners that upload to S3. It needs temporary AWS credentials for scanners without stored keys plus fine-grained portal authorization by team and shipment. Which design should the architect adopt to enforce authorization for system and human access?
• After a reorganization, auditors flag an IAM role allowing s3:Get on finance buckets to all developers, plus an S3 bucket policy granting internet read. The company must find all externally accessible resources and remove unused permissions without breaking jobs. Which remediation approach should the engineer take to correct unintended permissions?
• A media company lets external editors upload large videos directly to S3 and lets a partner analytics role read specific prefixes for two hours. Long-lived access keys were leaked last month. Which temporary credential mechanism should the engineer configure to enable secure time-bound uploads and cross-account reads?
• A startup lets product teams create IAM roles for microservices but two teams escalated to admin by attaching AdministratorAccess. Security must allow delegation while capping maximum permissions and scoping session privileges. Which least-privilege design should the engineer enforce to allow safe role delegation?
• A platform team grants federated contractors admin-like roles for deployments but must cap maximum privileges and scope each session to a single microservice without rewriting identity policies per request. Which least-privilege IAM policy combination should the architect interpret and implement?
• A DevOps engineer receives AccessDenied on s3:PutObject to a data lake bucket despite an IAM identity policy allowing it. The bucket policy, SCPs, and permission boundaries may also apply, and the team needs the exact denying statement. Which authorization analysis tool should the engineer use first to pinpoint the cause of the failure?
• A fintech has 400 developers across payments and lending projects who assume one Developer role to access S3 buckets and DynamoDB tables. Access must auto-adjust when engineers change projects, tags carry project and clearance, and no policy update is needed for joins. Which authorization strategy should the architect implement to enforce project-based access?
• Developers report AccessDenied when calling s3:GetObject on arn:aws:s3:::app-data/ despite an attached IAM policy allowing it, and the bucket has no restrictive policy. The team suspects an explicit deny from an SCP or permissions boundary. Which authorization failure analysis tool pinpoints the cause of this denial?
• A media company has 400 editors across brands using one portal role, needs brand-level access to S3 prefixes, must avoid creating 40 IAM roles, and wants access to follow project tags automatically. Which authorization strategy enforces scalable brand-level access with tags?
• A healthcare company has 800 employees needing SSO to AWS accounts, plus a patient mobile app needing sign-up, MFA, and short-lived AWS API access for 200,000 external users without IAM users. Which identity design correctly assigns human, application, and system authentication for workforce and customer access?
• After migrating to IAM Identity Center, helpdesk staff cannot activate MFA for some users, federated Cognito logins fail intermittently, and CloudTrail shows AccessDenied on directory calls. Which troubleshooting approach best isolates the authentication failure source?
• An audit finds an S3 bucket policy and an EC2 instance role that both grant s3: to the public and to all principals, created during a migration. Security must identify every unintended external access path and remove it without breaking legitimate workloads. Which approach investigates and corrects these unintended privileges?
• A retail company discovers an S3 bucket allows public reads due to an overly broad bucket policy and IAM role trust drift. The security team must find all unintended cross-account and public grants across IAM, S3, and KMS. Which service should the team use to investigate and correct the excessive privileges?
• A logistics partner needs one-time download of invoices from a private S3 bucket for 30 minutes without creating IAM users, while an analytics app needs scoped AWS API access from its EC2 role. Which temporary credential mechanism should the engineer implement to grant least-privilege short-lived access?
• A media firm needs editors to access S3 prefixes by project, EC2 workloads to fetch S3 without keys, and on-premises servers to use AWS APIs without stored secrets. Which authorization design best controls human, application, and system access appropriately?
• A startup grants developers broad IAM access for speed, had privilege escalation via iam:PassRole, and needs least privilege without blocking deployments. New guardrails must limit role passing and scope actions. Which least-privilege design prevents escalation while enabling delivery?
• A startup grants developers broad IAM roles for velocity, but a breach review requires least privilege without breaking deployments, temporary elevation for on-call, and guardrails preventing privilege escalation. Which policy mechanism should the architect implement to enforce least privilege?
• A SaaS company with 200 engineers runs 50 projects tagged Project=Alpha, Beta, and more, with developers federated via Okta constantly joining teams. Static per-project IAM roles cause delays and privilege sprawl. Which ABAC and role strategy grants project access dynamically based on tags?
• Developers report an EC2 deployment role receives AccessDenied when calling s3:PutObject to a vendor bucket despite an allow in its identity policy, and the security engineer must pinpoint whether an SCP, permission boundary, or resource policy blocks it without changing production. Which authorization analysis approach pinpoints the blocking policy type?
• A healthcare SaaS has 800 employees using Microsoft Entra ID and 50,000 patients needing self-registration with MFA and social login for a mobile app backed by API Gateway. Both groups need audited access without long-lived credentials in code. Which identity architecture should the engineer establish to separate workforce and customer authentication?
• Employees federated through IAM Identity Center suddenly cannot access AWS accounts via permission sets, while direct IAM users still work. Helpdesk reports No access errors after IdP certificate renewal. Failed sign-ins started within the hour. Which troubleshooting path isolates the authentication failure fastest?
• A developer with PowerUserAccess receives AccessDenied on s3:PutObject to a data-lake bucket despite an attached allow policy, and the error mentions an explicit deny. The bucket policy, SCPs, permission boundaries, and session policies could all contribute. Which authorization analysis method pinpoints the cause of this authorization failure?
• A logistics company has corporate staff using Okta, delivery drivers using mobile phones with social logins, and microservices calling AWS APIs from ECS tasks. Access must federate human identities centrally while giving apps scalable customer auth without long-lived keys. Which identity architecture best supports human, app, and system authentication needs?
• During a quarterly review, a bank finds an S3 bucket policy and an IAM role trust policy that allow access from an external partner account that was offboarded last year. Hundreds of buckets exist, and manual review misses cross-account grants. Which investigation approach finds and corrects these unintended external authorizations?
• A manufacturer runs Linux servers on-premises that upload telemetry to S3 daily. Security forbids long-lived AWS access keys, requires short-lived credentials tied to server identity, and needs automatic rotation. Which authorization approach best grants application access without stored secrets?
• An auditor flags an S3 bucket allowing public reads via an access point policy attached during a migration, and the platform team manages 300 buckets and needs to find all similar unintended external access paths and fix them centrally. Which investigation and remediation workflow corrects unintended public exposure at scale?
• A platform team lets product engineers create IAM roles for Lambda functions, but a recent review found wildcard permissions and privilege escalation via iam:PassRole. Engineers need flexibility without exceeding approved limits. Which least-privilege combination safely delegates role creation?
• A logistics platform lets external drivers upload delivery photos directly to S3 for 10 minutes and lets dispatchers query DynamoDB via a web app using corporate SSO, with no long-lived AWS keys on devices. Uploads must be scoped to one driver folder. Which temporary credential mechanism should the developer configure to grant least-privilege short-lived access?
• A photo-sharing app lets authenticated users upload directly to S3 and lets partner analytics assume limited read access for one hour without creating IAM users. Mobile clients cannot hold long-term secrets and uploads must not proxy through backend servers. Which temporary credential mechanism best enables secure delegated access?
• A healthcare company manages 400 developers across 30 projects using separate IAM roles per project, and role sprawl causes frequent policy updates. New projects must auto-grant access when job function and project tags match resource tags. Which authorization strategy enforces scalable project access with tags?
• A healthcare company has 800 corporate staff using Microsoft Entra ID and a patient mobile app with 200,000 users needing social login and MFA. Workforce SSO and customer identities must stay separate with centralized workforce access. Which identity design should the architect choose for human authentication?
• A 2,000-person healthcare company uses a corporate SAML identity provider, needs centralized AWS console and CLI access with job-function permission sets, automated provisioning and deprovisioning, and MFA enforced by the IdP. Local IAM users create sprawl. Which identity solution centralizes human authentication with federated single sign-on for the organization?
• A developer assumes a cross-account role and receives AccessDenied on dynamodb:Query, and the team must determine whether the identity policy, SCP, or resource policy caused the denial without changing permissions. Which diagnostic approach pinpoints the authorization failure cause?
• A university portal uses Amazon Cognito user pools federated to on-premises Active Directory for student logins. After an AD trust change, students report invalid-token and refresh failures, helpdesk sees Cognito authentication errors but no clear cause, and admins changed app client settings recently. Directory sync appears stale. Which troubleshooting sequence should the engineer follow to diagnose the federated authentication failures?
• Employees assigned an IAM Identity Center permission set receive Unexpected SSO failures after a scope change, while direct IAM users still sign in successfully. The team must pinpoint whether the failure is federation, permission set, or directory sync. Which troubleshooting sequence should the engineer follow to isolate the authentication failure?
• A fintech app needs fine-grained user actions like transfer:approve for tellers versus managers, with policy simulation and audit trails, without embedding complex checks in code across microservices. Thousands of decisions per second must scale. Which authorization approach should the architect design to externalize human and application access decisions?
• A SaaS firm lets support engineers assume a troubleshooting role via IAM Identity Center, but engineers can attach broad policies and escalate beyond ticket scope. The CISO wants maximum permissions capped and per-session scoping to single customer IDs. Which least-privilege control caps role power and session scope?
• A university research portal lets enrolled students download large private datasets from S3 for one hour, without creating IAM users, while backend jobs need short-lived cross-account access to process uploads. Direct bucket policies are too broad. Which temporary credential mechanism grants scoped time-limited access for both use cases?
• A SaaS startup authorizes warehouse staff via Identity Center, partner microservices via IAM roles, and connected forklifts via certificates, needs fine-grained document approvals, and wants consistent policy evaluation. Which authorization design should the architect choose for human, workload, and device access?
• An analytics team discovers an S3 bucket policy unexpectedly allows a partner account full s3: access, and security must identify the exposure scope and remove only the unintended grant without breaking legitimate analytics reads. Which remediation workflow corrects the excessive privilege accurately?
• A media firm shares 50GB video previews with external partners for 48 hours without creating IAM users, while an EC2 app needs S3 access without static keys. Which temporary credential mechanisms should the architect configure for secure access?