SCS-C02 Amazon Web Services Exam Lab Questions

Centralize Access Management with IAM Roles:

Create roles in the testing and production accounts with permissions specific to resources in those accounts.

Add a policy that allowssts:AssumeRolefor trusted accounts.

Establish Trust Between Accounts:

Update the trust policies of the roles in the testing and production accounts to allow the roles in the development account to assume them.

Example Trust Policy:

{

"Version": "2012-10-17",

"Statement": [

{

"Effect": "Allow",

"Principal": {

"AWS": "arn:aws:iam:::role/"

},

"Action": "sts:AssumeRole"

}

]

}

Role Switching for Access:

Developers in the development account can use the AWS Management Console or CLI to assume the roles in the testing or production accounts.

Advantages of This Solution:

Scalability: No need to create individual credentials for each developer in every account.

Security: Credentials are dynamically assumed and not shared across accounts.

Ease of Management: Centralized role management simplifies permissions and reduces administrative overhead.

Cross-Account Access in AWS

Using Roles to Delegate Permissions

IAM Policies and Trust Relationships

this is a way to configure a Classic Load Balancer with perfect forward secrecy cipher suites. Perfect forward secrecy is a property of encryption protocols that ensures that past and current TLS traffic stays secure even if the certificate private key is leaked. Cipher suites are sets of algorithms that determine how encryption is performed. A custom security policy is a set of cipher suites and protocols that you can select for your load balancer to support. An HTTPS listener is a process that checks for connection requests using encrypted SSL/TLS protocol. By using an HTTPS listener that uses a custom security policy that allows only perfect forward secrecy cipher suites, you can ensure that your Classic Load Balancer meets the requirements. The other options are either invalid or insufficient for configuring a Classic Load Balancer with perfect forward secrecy cipher suites.

The possible reason that the IAM user cannot access the objects in the S3 bucket is D. The KMS key policy has been edited to remove the ability for the AWS account to have full access to the key.

This answer is correct because the KMS key policy is the primary way to control access to the KMS key, and it must explicitly allow the AWS account to have full access to the key.If theKMS key policy has been edited to remove this permission, then the IAM policy that grants kms:Decrypt permission to the IAM user has no effect, and the IAM user cannot decrypt the objects in the S3 bucket12.

The other options are incorrect because:

A. The IAM policy does not need to allow the kms:DescribeKey permission, because this permission is not required for decrypting objects in S3 using SSE-KMS.The kms:DescribeKey permission allows getting information about a KMSkey, such as its creation date, description, and key state3.

B. The S3 bucket has not been changed to use the AWS managed key to encrypt objects at rest, because this would not cause an Access Denied message for the IAM user. The AWS managed key is a default KMS key that is created and managed by AWS for each AWS account and Region.The IAM user does not need any permissions on this key to use it for SSE-KMS4.

C. An S3 bucket policy does not need to be added to allow the IAM user to access the objects, because the IAM user already has s3:List* and s3:Get* permissions for the S3 bucket and its objects through an IAM policy.An S3 bucket policy is an optional way to grant cross-account access or public access to an S3 bucket5.