A company wants to allow a user in Account A to access an S3 bucket in Account B. The S3 bucket policy in Account B grants the user access. What else must be in place for the access to work?

An IAM role in Account A that the user can assume

An IAM user policy in Account A that explicitly allows the S3 action on the bucket in Account B

A VPC endpoint in Account B for S3

An AWS Organizations service control policy (SCP) allowing the action

An organization wants to grant its finance team access to billing reports and cost explorer, while granting its operations team access to EC2 and CloudWatch. Which authorization strategy is being used?

Attribute-based access control (ABAC)

Role-based access control (RBAC)

A security engineer is reviewing an IAM policy that allows a Lambda function to read and write objects in an S3 bucket. The policy is attached to the Lambda function's execution role. The engineer wants to ensure that the Lambda function can only access the specific bucket and no other S3 resources. What should the engineer do?

Use IAM Access Analyzer to generate findings for the Lambda function's execution role.

Create a permission boundary for the Lambda function's execution role that limits access to the specific bucket.

Use the IAM Policy Simulator to test the policy and verify that it only allows access to the specific bucket.

Review the policy to ensure it uses the 'Resource' element to specify the exact bucket ARN and the 'arn:aws:s3:::bucket/*' for objects.

A security engineer needs to grant a workload running outside of AWS access to temporary AWS credentials. The workload cannot use a long-term access key. Which AWS service or feature is designed for this purpose?

AWS Identity and Access Management (IAM) policy simulator

AWSCertified Security - Specialty

Domain 4Objective 2

Task 4.2: Design, Implement, and Troubleshoot Authorization Strategies SCS-C03 Practice Questions (Page 2)

Part of the Content Domain 4: Identity and Access Management domain, which accounts for 20% of the SCS-C03 exam. AWS does not publish an official question count, but from its 170-minute exam (~70–115 total, ~14–23 in this domain), expect 7–12 from this objective — we provide 13 practice questions to prepare you well beyond it. (estimate)

13questions here

3free pages

5concepts

20%of the exam

Questions 6–10

6foundation · easy
A company wants to allow a user in Account A to access an S3 bucket in Account B. The S3 bucket policy in Account B grants the user access. What else must be in place for the access to work?
Select an answer first
7foundation · easy
An organization wants to grant its finance team access to billing reports and cost explorer, while granting its operations team access to EC2 and CloudWatch. Which authorization strategy is being used?
Select an answer first
8application · medium
A security engineer is reviewing an IAM policy that allows a Lambda function to read and write objects in an S3 bucket. The policy is attached to the Lambda function's execution role. The engineer wants to ensure that the Lambda function can only access the specific bucket and no other S3 resources. What should the engineer do?
Select an answer first
9foundation · easy
A security engineer needs to grant a workload running outside of AWS access to temporary AWS credentials. The workload cannot use a long-term access key. Which AWS service or feature is designed for this purpose?
Select an answer first
10foundation · easy
A user reports that they are unable to access an S3 bucket, even though they believe they have the correct permissions. Which AWS tool can be used to test the exact policy permissions for that user and identify the cause of the failure?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCS-C03

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “SCS-C03” is a trademark of its owner, used for identification only.

Task 4.2: Design, Implement, and Troubleshoot Authorization Strategies SCS-C03 Practice Questions (Page 2)

Questions 6–10

A company wants to allow a user in Account A to access an S3 bucket in Account B. The S3 bucket policy in Account B grants the user access. What else must be in place for the access to work?

An organization wants to grant its finance team access to billing reports and cost explorer, while granting its operations team access to EC2 and CloudWatch. Which authorization strategy is being used?

A security engineer needs to grant a workload running outside of AWS access to temporary AWS credentials. The workload cannot use a long-term access key. Which AWS service or feature is designed for this purpose?

A user reports that they are unable to access an S3 bucket, even though they believe they have the correct permissions. Which AWS tool can be used to test the exact policy permissions for that user and identify the cause of the failure?

Keep studying — Content Domain 4: Identity and Access Management