SCS-C02 Mock Exam 78 — 25 Questions

Question 1

A company uses AWS Organizations with a multi-account strategy. The security team wants to ensure that no EC2 instances are launched without an approved Amazon Machine Image (AMI) ID. Which approach should the team take to enforce this requirement across all accounts?

Accepted Answer

Create an SCP that denies ec2:RunInstances if the AMI ID is not in a specified list.. Using an SCP to deny RunInstances with a condition on the AMI ID is the most direct way to enforce at the organization level. Option A (IAM policy in each account) is less manageable. Option C (AWS Config) detects but does not prevent. Option D (Lambda) is reactive.

Answer

Use AWS Config to detect EC2 instances with noncompliant AMI IDs and send notifications.

Answer

Create an IAM policy in each account that denies ec2:RunInstances unless the AMI ID is in an approved list.

Answer

Deploy a Lambda function that terminates any EC2 instance with a noncompliant AMI ID.

Question 2

A company wants to centrally manage access keys for all IAM users across multiple accounts. Which AWS service should be used to rotate access keys automatically?

Accepted Answer

AWS IAM. Option A is correct because IAM access keys can be rotated using IAM credential report and IAM policies, but there is no built-in automatic rotation. However, AWS Secrets Manager can automatically rotate secrets for supported services, but not for IAM access keys. The correct answer is none; IAM access keys must be rotated manually or via custom automation. Given options, Option A is the best because IAM is the service that manages access keys, and you can use IAM API to rotate them. Option B is wrong because STS provides temporary credentials. Option C is wrong because Secrets Manager can store but not rotate IAM keys automatically. Option D is wrong because CloudHSM is for hardware security modules.

Answer

AWS STS

Answer

AWS Secrets Manager

Answer

AWS CloudHSM

Question 3

A company needs to audit all changes to IAM policies in their AWS account. Which AWS service should they use to record these changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls, including IAM policy changes. Option B is correct because CloudTrail logs all IAM policy modifications. Option A is wrong because AWS Config records resource state changes but not API calls. Option C is wrong because CloudWatch Logs stores logs but does not record API calls. Option D is wrong because S3 is a storage service.

Answer

Amazon S3

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Question 4

A security engineer is designing a solution to detect and alert on any S3 bucket that is publicly accessible. Which THREE services can be used together to achieve this?

Accepted Answer

AWS Security Hub. Option A is correct: CloudTrail logs S3 bucket policy changes. Option B is correct: AWS Config can evaluate bucket policies against a rule for public access. Option D is correct: S3 itself can block public access via account-level settings, but that is not detection. Option C is correct: Security Hub aggregates findings from Config. Option E is wrong: VPC Flow Logs do not deal with S3 bucket policies.

Answer

Amazon S3 Block Public Access settings

Answer

Amazon VPC Flow Logs

Question 5

Refer to the exhibit. A security engineer runs the AWS CLI command to look up CloudTrail events. What can be concluded from the output?

Accepted Answer

User 'admin' created a trail named 'my-trail' on Jan 15. The output shows that user 'admin' created a trail named 'my-trail' on Jan 15. Option A is correct. Option B is wrong because the event is not read-only. Option C is wrong because the trail was created, not deleted. Option D is wrong because the event name is CreateTrail.

Answer

The event name is DeleteTrail

Answer

The trail was deleted by user 'admin'

Answer

The event is a read-only API call

Question 6

A company's security team is implementing a solution to automatically revoke public access to Amazon S3 buckets that become public. The solution must be serverless and use native AWS services. Which combination of services should be used?

Accepted Answer

Amazon EventBridge (CloudWatch Events) to detect PutBucketPolicy events and invoke an AWS Lambda function to remove the policy. Amazon EventBridge can detect S3 bucket policy changes via CloudTrail and trigger a Lambda function to remediate. Option A is wrong because AWS Config can detect but not automatically remediate without Lambda. Option C is wrong because S3 events only trigger on object-level events, not bucket policy changes. Option D is wrong because CloudWatch Logs alone cannot trigger remediation.

Answer

Amazon S3 event notifications on ObjectCreated events to invoke a Lambda function

Answer

Amazon CloudWatch Logs with a metric filter and alarm to trigger an SNS notification

Answer

AWS Config with managed rule 's3-bucket-public-read-prohibited' and auto-remediation via Systems Manager

Question 7

A security team is reviewing IAM roles and policies. They want to ensure that any new IAM role created in the account must include a specific managed policy (e.g., SecurityAudit). What AWS service can enforce this requirement?

Accepted Answer

Service control policy (SCP) in AWS Organizations. Option C is correct because SCPs can deny IAM role creation if the role does not have a specific policy attached. Option A is wrong because IAM policies define permissions, not enforce role creation rules. Option B is wrong because AWS Config can detect noncompliant roles but cannot prevent their creation. Option D is wrong because CloudTrail logs API calls but does not enforce policies.

Answer

AWS CloudTrail

Answer

AWS Config rules

Answer

IAM permissions boundary

Question 8

A security engineer is auditing the AWS Organizations structure. The engineer notices that the 'Management' account (111111111111) has a status of 'ACTIVE' and joined method 'CREATED'. The engineer is concerned about potential security risks. Which action should the engineer take to improve security?

Accepted Answer

Enable multi-factor authentication (MFA) for the root user of the management account.. Option A is correct because the root user of the management account should have MFA enabled to protect the account that can modify SCPs and manage other accounts. Option B is wrong because removing the management account is not possible. Option C is wrong because deleting the management account is not possible. Option D is wrong because the root user cannot be deleted.

Answer

Remove the management account from the organization.

Answer

Delete the management account and create a new one.

Answer

Create a new root user for the management account and delete the old one.

Question 9

A security engineer is tasked with ensuring that all S3 buckets in an AWS account have versioning enabled. The engineer needs to identify buckets that do not have versioning enabled. Which AWS service is BEST suited for this task?

Accepted Answer

AWS Config. AWS Config has a managed rule (s3-bucket-versioning-enabled) that can evaluate S3 buckets and report compliance. Option A (CloudTrail) logs API calls. Option B (IAM Access Analyzer) analyzes policies. Option C (Trusted Advisor) has limited checks and may not cover all buckets.

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Answer

IAM Access Analyzer

Question 10

A security engineer is configuring an S3 bucket policy to restrict access to only requests that originate from a specific VPC endpoint. Which condition key should be used?

Accepted Answer

aws:SourceVpce. Option C is correct because 'aws:SourceVpce' restricts access to a specific VPC endpoint. Option A is wrong because 'aws:SourceVpc' restricts to a VPC, not the endpoint. Option B is wrong because 'aws:SourceIp' restricts by IP address. Option D is wrong because 'aws:VpcSourceIp' is not a valid condition key.

Answer

aws:VpcSourceIp

Answer

aws:SourceVpc

Answer

aws:SourceIp

Question 11

A security engineer notices that an IAM user has permissions to launch EC2 instances but the engineer wants to ensure that all new instances are automatically tagged with the creator's user name. What is the most efficient way to enforce this?

Accepted Answer

Add an IAM policy to the user that uses a condition key 'aws:RequestTag/Creator' with a value '${aws:username}'.. Using a service control policy (SCP) with a condition that requires tagging on EC2 RunInstances is not possible because SCPs cannot enforce tagging; they can only deny if tags are missing. Option B is the most efficient: using IAM policy with a condition that requires the tag 'Creator' to equal the IAM user name. Option A is incorrect because SCPs cannot enforce tagging. Option C is overly complex. Option D is incorrect because CloudTrail does not enforce tagging.

Answer

Use AWS CloudTrail to monitor and alert on untagged instances.

Answer

Use AWS Config rules to automatically tag resources after creation.

Answer

Create an SCP that denies EC2:RunInstances unless the request includes a 'Creator' tag with the user name.

Question 12

Which TWO of the following are valid AWS IAM security best practices?

Accepted Answer

Implement a strong password policy for IAM users.. Option A is correct: a password policy enforces complexity. Option D is correct: MFA adds an extra layer of security. Option B is wrong: access keys should not be shared. Option C is wrong: root user should be avoided for daily tasks. Option E is wrong: deleting users is not a best practice; deactivating is better.

Answer

Share IAM user access keys among team members for convenience.

Answer

Delete IAM users instead of disabling them when not needed.

Answer

Use the AWS account root user for everyday administrative tasks.

Question 13

Refer to the exhibit. A CloudFormation template creates an S3 bucket. Which security control is NOT enabled by this template?

Accepted Answer

Bucket versioning. The template enables default encryption (AES256) and public access blocks, but it does not enable versioning. Option C is correct. Option A is wrong because SSE is enabled. Option B is wrong because public access is blocked. Option D is wrong because bucket policy is blocked.

Answer

Bucket policy restrictions

Answer

Blocking public access

Answer

Server-side encryption

Question 14

Which TWO AWS services can be used to centrally manage and audit permissions across multiple AWS accounts? (Choose two.)

Accepted Answer

AWS Organizations. AWS Organizations provides a central view of all accounts and can apply SCPs. IAM Access Analyzer analyzes resource policies across accounts to identify public or cross-account access. AWS Config evaluates resource configurations but does not centrally manage permissions. AWS CloudTrail logs API calls but does not manage permissions. AWS SSO manages user access but not resource permissions.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

AWS Single Sign-On

Question 15

A company uses AWS Organizations with a management account and several member accounts. The security team wants to restrict the use of specific AWS services (e.g., EC2, Lambda) in certain accounts based on the account's environment (dev, test, prod). Which approach should be used to implement this requirement?

Accepted Answer

Use AWS Organizations to tag accounts (e.g., Environment=Dev) and use SCPs with conditions to deny access to services based on tags.. Option A is correct because tagging accounts in Organizations and using SCPs with conditions allows granular control based on account tags. Option B is wrong because IAM roles are per-user, not per-account service restrictions. Option C is wrong because Config rules detect usage but do not prevent it. Option D is wrong because CloudTrail logs but does not enforce restrictions.

Answer

Use AWS CloudTrail to monitor API calls and revoke access after the fact.

Answer

Create IAM roles in each account with policies that deny access to services.

Answer

Use AWS Config rules to detect and alert when restricted services are used.

Question 16

A security engineer applies the above bucket policy to an S3 bucket. What is the effect of this policy?

Accepted Answer

All requests to the bucket must be made over HTTPS.. Option A is correct because the policy denies all actions to the bucket if the request is not made over HTTPS (SecureTransport is false). This ensures only encrypted connections are allowed. Option B is wrong because it denies non-HTTPS requests, not allows them. Option C is wrong because it denies all actions, not just a few. Option D is wrong because the policy explicitly denies non-HTTPS requests.

Answer

All requests to the bucket are denied regardless of protocol.

Answer

The policy has no effect because it uses a condition.

Answer

All requests to the bucket must be made over HTTP.

Question 17

A company is implementing a data retention policy for CloudTrail logs. The logs are stored in an S3 bucket. The policy requires that logs be retained for 7 years and then automatically deleted. Which TWO actions should the security engineer take to meet this requirement?

Accepted Answer

Configure the S3 bucket policy to deny s3:DeleteObject actions for all principals.. Combining S3 lifecycle expiration with object lock or bucket policy is not needed. The simplest is to use S3 lifecycle policy to expire objects after 7 years. Option D ensures that logs are not deleted prematurely before the retention period ends.

Answer

Use AWS Backup to manage retention and deletion.

Answer

Enable S3 Object Lock in compliance mode on the bucket.

Answer

Enable S3 Versioning and create a lifecycle policy to delete noncurrent versions.

Question 18

A company is using AWS Config to evaluate resource compliance. They need to ensure that all EC2 instances have a specific tag key 'Environment' with a value of 'Production' or 'Development'. Which type of AWS Config rule should be used?

Accepted Answer

Custom AWS Config rule using AWS Lambda. Option B is correct because a custom AWS Config rule (Lambda function) can evaluate the required tags. Option A is wrong because managed rules may not have the exact logic. Option C is wrong because AWS Config does not have a built-in 'required-tags' rule with custom values. Option D is wrong because AWS Config rules cannot be written in Python directly; they use Lambda.

Answer

Custom AWS Config rule written in Python

Answer

AWS Config managed rule 'ec2-instance-tags'

Answer

AWS Config managed rule 'required-tags'

Question 19

A company has a multi-account AWS Organization with hundreds of accounts. The security team wants to prevent any IAM user from creating access keys in any account. What is the most scalable and secure approach?

Accepted Answer

Apply an SCP that denies the IAM:CreateAccessKey action to all accounts in the organization.. Option A is correct: a service control policy (SCP) at the root or OU level can deny the IAM:CreateAccessKey action, which applies to all accounts in the organization. Option B is wrong because it does not prevent users in other accounts from creating keys. Option C is wrong because IAM Access Analyzer does not block actions. Option D is wrong because it requires manual updates and is not scalable.

Answer

Use IAM Access Analyzer to generate findings when access keys are created.

Answer

Configure IAM password policies in each account to disallow access keys.

Answer

Create an AWS Config rule in each account to automatically delete access keys.

Question 20

A company is implementing a multi-account strategy using AWS Organizations. The security team wants to enforce that all newly created member accounts automatically have an IAM role that allows read-only access to the management account. Which configuration should be used?

Accepted Answer

Configure an SCP with the 'iam_role' setting to specify a role name and path to be automatically created in new accounts.. Option B is correct because AWS Organizations allows you to create a service control policy (SCP) that specifies a default IAM role for new accounts. Option A is wrong because CloudFormation StackSets can deploy resources but not automatically create roles for new accounts. Option C is wrong because AWS Config rules evaluate existing resources but do not provision roles for new accounts. Option D is wrong because AWS Lambda can be triggered by AWS CloudTrail events but is not the native mechanism for automatic role creation on new account creation.

Answer

Create an AWS Lambda function that listens for AWS CloudTrail CreateAccount events and creates the role in the new account.

Answer

Use AWS CloudFormation StackSets to deploy the role to all existing and future accounts.

Answer

Use an AWS Config managed rule to evaluate new accounts and trigger a remediation action to create the role.