Amazon SCS-C02 Exam - Topic 3 Question 53 Discussion

Actual exam question for Amazon's SCS-C02 exam

Question #: 53
Topic #: 3

[Identity and Access Management]

A company's engineering team is developing a new application that creates IAM Key Management Service (IAM KMS) CMK grants for users immediately after a grant IS created users must be able to use the CMK tu encrypt a 512-byte payload. During load testing, a bug appears |intermittently where AccessDeniedExceptions are occasionally triggered when a userrst attempts to encrypt using the CMK

Which solution should the c0mpany's security specialist recommend'?

AInstruct users to implement a retry mechanism every 2 minutes until the call succeeds.

BInstruct the engineering team to consume a random grant token from users, and to call the CreateGrant operation, passing it the grant token. Instruct use to use that grant token in their call to encrypt.

CInstruct the engineering team to create a random name for the grant when calling the CreateGrant operation. Return the name to the users and instruct them to provide the name asthe grant token in the call to encrypt.

DInstruct the engineering team to pass the grant token returned in the CreateGrant response to users. Instruct users to use that grant token in their call to encrypt.

Show Suggested Answer

Suggested Answer: D

To avoid AccessDeniedExceptions when users first attempt to encrypt using the CMK, the security specialist should recommend the following solution:

Instruct the engineering team to pass the grant token returned in the CreateGrant response to users. This allows the engineering team to use the grant token as a form of temporary authorization for the grant.

Instruct users to use that grant token in their call to encrypt. This allows the users to use the grant token as a proof that they have permission to use the CMK, and to avoid any eventual consistency issues with the grant creation.

by Dortha at Nov 21, 2025, 10:28 AM

Limited Time Offer

25%

Off

Get Premium SCS-C02 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Albina

5 hours ago

This question is tricky! I feel like it's testing our understanding of IAM.

upvoted 0 times

...

Ariel

5 days ago

AccessDeniedExceptions? That's surprising! Thought IAM was more reliable.

upvoted 0 times

...

Paris

11 days ago

Definitely agree with D, it keeps things straightforward.

upvoted 0 times

...

Elfrieda

16 days ago

Wait, why would we need a random name for the grant? That seems unnecessary.

upvoted 0 times

...

Ruthann

21 days ago

I think option D is the best choice here.

upvoted 0 times

...

Tracey

26 days ago

Sounds like a classic race condition issue.

upvoted 0 times

...

Dannie

1 month ago

Retry mechanisms every 2 minutes? That's just asking for trouble. Option D is the clear winner here.

upvoted 0 times

...

Elliot

1 month ago

Option B is a bit too convoluted for my liking. I'd go with the simple and elegant solution in option D.

upvoted 0 times

...

Tamesha

1 month ago

Haha, "AccessDeniedExceptions" - sounds like a great band name! But in all seriousness, option D looks like the way to go.

upvoted 0 times

...

Ligia

2 months ago

I feel like retrying every 2 minutes is a bit of a workaround. There must be a more direct solution to handle the AccessDeniedExceptions.

upvoted 0 times

...

Antonette

2 months ago

This seems similar to a practice question we did on IAM permissions. I think passing the grant token from the CreateGrant response makes the most sense, but I could be wrong.

upvoted 0 times

...

Lindsey

2 months ago

I'm a bit hesitant about option B, where the users have to consume a random grant token. That seems like it could introduce additional complexity and potential points of failure. I'd be more inclined to go with option D, as it seems the most direct and straightforward approach to addressing the issue.

upvoted 0 times

...

Della

2 months ago

I remember something about grant tokens being crucial for permissions, but I'm not sure if we should be using random tokens or the ones returned in the response.

upvoted 0 times

...

Felicitas

2 months ago

Okay, let's think this through step-by-step. The users need to be able to encrypt a 512-byte payload using the CMK, and the issue is that they're sometimes getting AccessDeniedExceptions. I'm leaning towards option D, where the engineering team passes the grant token directly to the users to use in their encrypt call. That seems like the most straightforward solution.

upvoted 0 times

...

Brittani

2 months ago

I'm not sure I understand the need for a grant token at all. Shouldn't the users just be able to use the CMK directly?

upvoted 0 times

...

Wilda

3 months ago

I vaguely recall that using a specific grant token is important for ensuring the right permissions, but I can't remember if it should be random or the one provided.

upvoted 0 times

...

Joana

3 months ago

Option D seems like the most straightforward solution. Why complicate things with random tokens or retry mechanisms?

upvoted 0 times

...

Rodolfo

3 months ago

Hmm, this is an interesting one. I think the key here is to focus on how to handle the intermittent AccessDeniedExceptions that are being triggered. The question is asking for a solution, so I'd want to carefully consider each of the options presented.

upvoted 0 times

...

Chaya

3 months ago

I'm a bit confused by this question. It seems like there's a lot of technical details to consider, and I'm not sure I fully understand the IAM KMS CMK grants and how they're being used in this application.

upvoted 0 times

...