An application running on an Amazon EC2 instance needs to access an Amazon S3 bucket. What is the recommended way to provide credentials to the application without storing long-term credentials on the instance?

Attach an IAM role to the EC2 instance

Store AWS access keys in the application code

Use an IAM user with a long-term access key

A company uses IAM Identity Center with an external SAML 2.0 IdP. A user reports that they can sign in to the IdP and see the AWS account in the portal, but when they click the account, they receive an 'AccessDenied' error. CloudTrail shows an AssumeRole event that succeeded. The user is a member of the 'Developers' group, and the permission set 'DeveloperAccess' is assigned to that group. What should the administrator investigate first?

Check the permission set's IAM policy to ensure it grants the necessary permissions for the resources the user is trying to access.

Confirm that the user's session duration in IAM Identity Center is set to a value that does not exceed the maximum allowed.

Verify that the SAML IdP is correctly configured to pass the user's group membership to IAM Identity Center.

Check the CloudTrail log for the target account to see if the user's requests are being denied by resource-based policies.

A developer needs to provide temporary credentials to a federated user who authenticated with an external identity provider. Which AWS service is used to issue these temporary credentials?

AWS Security Token Service (STS)

An administrator notices that a user in IAM Identity Center has more permissions than expected. The user is a member of two groups, each with a different permission set. What is the effective permission for the user?

The union of permissions from both permission sets

The intersection of permissions from both permission sets

The permissions from the most recently assigned permission set

The permissions from the first permission set only

AWSCertified Security - Specialty

Domain 4Objective 1

Task 4.1: Design, Implement, and Troubleshoot Authentication Strategies SCS-C03 Practice Questions (Page 2)

Part of the Content Domain 4: Identity and Access Management domain, which accounts for 20% of the SCS-C03 exam. AWS does not publish an official question count, but from its 170-minute exam (~70–115 total, ~14–23 in this domain), expect 7–12 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

11concepts

20%of the exam

11 Concepts in This Objective

IAM Identity Center for human authentication
Amazon Cognito for application authentication
MFA enforcement and configuration
Identity provider integration
System and application authentication mechanisms
AWS STS and temporary credentials
Amazon S3 presigned URLs
Troubleshooting authentication with CloudTrail
Troubleshooting Cognito authentication issues
Troubleshooting IAM Identity Center permission sets
Troubleshooting AWS Directory Service authentication

Questions 6–10

6foundation · easy
A security engineer is investigating an authentication failure where a user was unable to assume an IAM role. Which AWS service provides logs that can be used to diagnose the failure?
Select an answer first
7foundation · easy
An application running on an Amazon EC2 instance needs to access an Amazon S3 bucket. What is the recommended way to provide credentials to the application without storing long-term credentials on the instance?
Select an answer first
8expert · hard
A company uses IAM Identity Center with an external SAML 2.0 IdP. A user reports that they can sign in to the IdP and see the AWS account in the portal, but when they click the account, they receive an 'AccessDenied' error. CloudTrail shows an AssumeRole event that succeeded. The user is a member of the 'Developers' group, and the permission set 'DeveloperAccess' is assigned to that group. What should the administrator investigate first?
Select an answer first
9foundation · easy
A developer needs to provide temporary credentials to a federated user who authenticated with an external identity provider. Which AWS service is used to issue these temporary credentials?
Select an answer first
10foundation · easy
An administrator notices that a user in IAM Identity Center has more permissions than expected. The user is a member of two groups, each with a different permission set. What is the effective permission for the user?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCS-C03

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “SCS-C03” is a trademark of its owner, used for identification only.

Task 4.1: Design, Implement, and Troubleshoot Authentication Strategies SCS-C03 Practice Questions (Page 2)

Questions 6–10

A security engineer is investigating an authentication failure where a user was unable to assume an IAM role. Which AWS service provides logs that can be used to diagnose the failure?

An application running on an Amazon EC2 instance needs to access an Amazon S3 bucket. What is the recommended way to provide credentials to the application without storing long-term credentials on the instance?

A developer needs to provide temporary credentials to a federated user who authenticated with an external identity provider. Which AWS service is used to issue these temporary credentials?

An administrator notices that a user in IAM Identity Center has more permissions than expected. The user is a member of two groups, each with a different permission set. What is the effective permission for the user?

Keep studying — Content Domain 4: Identity and Access Management