SCS-C03 practice question: Finding and removing unintended access (IAM Access Analyzer)
Identity and Access Management A free question from our original SCS-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A public health agency uses IAM Access Analyzer across its AWS Organizations. Last week the analyzer raised an external access finding for a customer managed KMS key that protects data for an analytics pipeline. The finding shows that a principal in an AWS account outside the organization can use the key.
The agency approved a data-sharing partner account for this key months ago, and that partner's finding is expected. The team wants it archived so that it stops hiding new findings. The unknown account must lose access today, and the pipeline must keep running.
Which action should the security engineer take?
Choose one answer.
AA. Confirm that the unknown account is not approved, then edit the key policy to remove its principal. Add an archive rule that matches the approved partner finding, so the expected finding stops cluttering the list.
BB. Turn off IAM Access Analyzer across the organization until the unknown account's access is removed, so that no further findings are generated during the investigation of the key.
CC. Schedule the key for deletion, create a replacement key with a new policy, and copy the pipeline encrypted data to the new key in a maintenance window next month. Delete the old key after the copy is complete.
DD. Attach a resource control policy to every account that denies KMS actions on all keys to principals outside the organization, so that every external principal is blocked.
Show the answer and explanation
Answer: A
A. Right: Correct. The key policy decides who may use the key, so removing the unknown principal ends its access today while the pipeline keeps its own statements. The archive rule covers only the approved finding, and any new unexpected finding still appears. Learn more: What is IAM Access Analyzer? (opens in a new tab)
B. Wrong: Turning off the analyzer removes the visibility the agency needs, and it does not revoke the existing access. The unknown account would keep using the key until someone edits the key policy.
C. Wrong: Deleting the key would stop the pipeline and make its data unreadable until the copy finishes. The unknown account's access ends only when the old key is gone, which is far too slow for today.
D. Wrong: The resource control policy would block the unknown account, but it also blocks the approved partner account, which breaks the data-sharing agreement. The partner's expected access must stay in place.
Explanation
Access Analyzer reports which principals outside the zone of trust can reach a resource, and fixing a finding means changing that resource's policy. A key policy decides who may use the key, so editing it removes the unknown access today. Archive rules keep expected findings out of the way, while turning the analyzer off, deleting the key or blocking all external principals fails the requirements.
Want more on Finding and removing unintended access (IAM Access Analyzer)? The 5 full-length practice sets have 6 more Finding and removing unintended access (IAM Access Analyzer) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →