A security team wants to grant developers access to EC2 instances only if the instance has the tag `environment=dev`. Which authorization strategy is most appropriate?

Role-based access control (RBAC)

Attribute-based access control (ABAC)

A security engineer is investigating a potential security issue where an IAM role in the production AWS account has been granted permissions to access an S3 bucket in a different AWS account. The engineer wants to identify all such cross-account access grants. Which AWS service or feature should the engineer use?

AWS CloudTrail to review all API calls made by the IAM role.

AWS Trusted Advisor to review security best practices.

AWS Config to check the configuration of the IAM role.

IAM Access Analyzer to generate findings for cross-account access.

A security engineer needs to ensure that a developer role can only launch EC2 instances, but cannot perform any other EC2 actions. Which IAM feature should be used to enforce this restriction?

An IAM policy that allows only the `ec2:RunInstances` action

An SCP that denies all EC2 actions except RunInstances

AWSCertified Security - Specialty

Domain 4Objective 2

Task 4.2: Design, Implement, and Troubleshoot Authorization Strategies SCS-C03 Practice Questions (Page 1)

Part of the Content Domain 4: Identity and Access Management domain, which accounts for 20% of the SCS-C03 exam. AWS does not publish an official question count, but from its 170-minute exam (~70–115 total, ~14–23 in this domain), expect 7–12 from this objective — we provide 13 practice questions to prepare you well beyond it. (estimate)

13questions here

3free pages

5concepts

20%of the exam

Questions 1–5

1foundation · easy
An administrator wants to allow developers to create IAM roles, but only with a maximum permission set that prevents them from granting administrative privileges. Which IAM feature should be used?
Select an answer first
2foundation · easy
A security team wants to grant developers access to EC2 instances only if the instance has the tag `environment=dev`. Which authorization strategy is most appropriate?
Select an answer first
3foundation · easy
A security engineer needs to identify which S3 buckets in the account are accessible from outside the organization. Which AWS service can automatically generate findings for such external access?
Select an answer first
4application · medium
A security engineer is investigating a potential security issue where an IAM role in the production AWS account has been granted permissions to access an S3 bucket in a different AWS account. The engineer wants to identify all such cross-account access grants. Which AWS service or feature should the engineer use?
Select an answer first
5foundation · easy
A security engineer needs to ensure that a developer role can only launch EC2 instances, but cannot perform any other EC2 actions. Which IAM feature should be used to enforce this restriction?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCS-C03

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “SCS-C03” is a trademark of its owner, used for identification only.

Task 4.2: Design, Implement, and Troubleshoot Authorization Strategies SCS-C03 Practice Questions (Page 1)

Questions 1–5

An administrator wants to allow developers to create IAM roles, but only with a maximum permission set that prevents them from granting administrative privileges. Which IAM feature should be used?

A security team wants to grant developers access to EC2 instances only if the instance has the tag `environment=dev`. Which authorization strategy is most appropriate?

A security engineer needs to identify which S3 buckets in the account are accessible from outside the organization. Which AWS service can automatically generate findings for such external access?

A security engineer needs to ensure that a developer role can only launch EC2 instances, but cannot perform any other EC2 actions. Which IAM feature should be used to enforce this restriction?

Keep studying — Content Domain 4: Identity and Access Management