Task 4.1: Design, Implement, and Troubleshoot Authentication Strategies SCS-C03 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company has a mobile application that uses Amazon Cognito identity pools to provide temporary AWS credentials to users. The application recently started using a new identity provider (IdP) for sign-in. Users can authenticate with the new IdP, but they cannot access AWS resources. What should the developer check first?

   • AVerify that the new IdP is added to the identity pool's authentication providers and that the role mapping is configured correctly.
   • BEnsure that the identity pool's unauthenticated role has the necessary permissions for the new IdP users.
   • CConfirm that the new IdP's SAML metadata is correctly uploaded to the IAM console.
   • DCheck that the user pool's app client is configured with the correct callback URL for the new IdP.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company uses AWS Managed Microsoft AD for authentication. Users report that they can sign in to their workstations but cannot authenticate to AWS services that use the directory. The directory's health status is healthy, and the security group for the directory allows inbound traffic on port 389. What should the administrator check next?

   • ACheck that the directory's DNS settings are correctly configured to resolve the service endpoints.
   • BConfirm that the AWS services are in the same VPC as the directory or have a VPC peering connection.
   • CEnsure that the directory's service account has the correct permissions to authenticate users.
   • DVerify that the directory's security group allows outbound traffic to the AWS services that need to authenticate.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A user in IAM Identity Center can see an AWS account in the portal but cannot access any resources in that account. The user's permission set is attached to the account and the user is a member of the group that has the permission set assigned. CloudTrail shows an AssumeRole event that succeeded. What should the administrator check next?

   • AConfirm that the permission set is provisioned to the AWS account.
   • BCheck the user's group membership in IAM Identity Center to ensure the user is in the correct group.
   • CVerify that the permission set's IAM policy includes the necessary permissions for the resources the user is trying to access.
   • DReview the CloudTrail log for the S3 bucket to see if the user's requests are being denied by bucket policies.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A data analytics team needs to provide a third-party vendor with temporary access to a single CSV file in an S3 bucket. The vendor does not have AWS credentials. The file must be accessible for exactly 30 minutes, and the team wants to avoid creating any IAM users or roles for the vendor. Which solution should the team use?

   • AMake the S3 object publicly readable and share the object URL with the vendor.
   • BCreate a new IAM role with read-only access to the bucket and provide the vendor with the role's ARN to assume.
   • CUse S3 Access Points to create a restricted access point and share the access point ARN with the vendor.
   • DGenerate a presigned URL for the object with an expiration time of 1800 seconds and share it with the vendor.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security engineer is troubleshooting an authentication failure for a user who is trying to assume a role in another AWS account. The user has valid credentials in the source account. CloudTrail shows an AssumeRole event with an 'AccessDenied' error. What is the most likely cause of this failure?

   • AThe role's permissions policy does not allow the user to perform the actions they need.
   • BThe user's IAM policy does not grant permission to call AssumeRole.
   • CThe user's session duration is set to a value that exceeds the maximum allowed for the role.
   • DThe role's trust policy does not allow the user's account to assume the role.
   Reveal Solution Discussion Select an answer first