nerdexam
Amazon

SCS-C02 · Question #89

An application is running on an Amazon EC2 instance that has an IAM role attached. The IAM role provides access to an AWS Key Management Service (AWS KMS) customer managed key and an Amazon S3 bucket.

The correct answer is C. Revoke the IAM role's active session permissions. Update the S3 bucket policy to deny access to. Revoking active IAM role sessions and denying access via S3 bucket policy immediately invalidates all existing credentials and blocks new requests, stopping data exposure without requiring instance shutdown.

Submitted by sofia.br· Mar 6, 2026Threat Detection and Incident Response

Question

An application is running on an Amazon EC2 instance that has an IAM role attached. The IAM role provides access to an AWS Key Management Service (AWS KMS) customer managed key and an Amazon S3 bucket. The key is used to access 2 TB of sensitive data that is stored in the S3 bucket. A security engineer discovers a potential vulnerability on the EC2 instance that could result in the compromise of the sensitive data. Due to other critical operations, the security engineer cannot immediately shut down the EC2 instance for vulnerability patching. What is the FASTEST way to prevent the sensitive data from being exposed?

Options

  • ADownload the data from the existing S3 bucket to a new EC2 instance. Then delete the data from
  • BBlock access to the public range of S3 endpoint IP addresses by using a host-based firewall.
  • CRevoke the IAM role's active session permissions. Update the S3 bucket policy to deny access to
  • DDisable the current key. Create a new KMS key that the IAM role does not have access to, and

How the community answered

(36 responses)
  • A
    14% (5)
  • B
    6% (2)
  • C
    75% (27)
  • D
    6% (2)

Why each option

Revoking active IAM role sessions and denying access via S3 bucket policy immediately invalidates all existing credentials and blocks new requests, stopping data exposure without requiring instance shutdown.

ADownload the data from the existing S3 bucket to a new EC2 instance. Then delete the data from

Downloading 2 TB of data to a new instance and deleting the original is extremely time-consuming and not the fastest option for preventing immediate exposure.

BBlock access to the public range of S3 endpoint IP addresses by using a host-based firewall.

Blocking S3 endpoint IP ranges at the host firewall is unreliable because S3 uses many IP addresses and this approach may not block all access paths, including VPC endpoints.

CRevoke the IAM role's active session permissions. Update the S3 bucket policy to deny access toCorrect

Using iam:RevokeSession to invalidate the role's active sessions and applying an S3 bucket policy Deny immediately cuts off all current and future access to the sensitive data; this is the fastest approach because it requires only policy changes with no data movement or re-encryption.

DDisable the current key. Create a new KMS key that the IAM role does not have access to, and

Creating a new KMS key and re-encrypting 2 TB of existing data is a lengthy process that does not provide immediate protection.

Concept tested: Immediate credential revocation and S3 bucket policy deny

Source: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_revoke-sessions.html

Topics

#IAM role session revocation#incident response#S3 bucket policy#KMS key

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SCS-C02 Practice