SCS-C02 Mock Exam 79 — 25 Questions

Question 1

A company uses AWS Organizations with 50 accounts. The security team wants to centrally manage IAM roles that grant cross-account access to a central security account. Which THREE steps are required to set up this cross-account access?

Accepted Answer

Create an IAM role in each member account with a trust policy that allows the security account to assume the role.. The correct approach: create IAM roles in each member account with a trust policy allowing the security account to assume them, create an IAM user or role in the security account with sts:AssumeRole permissions, and use an SCP to prevent member accounts from modifying the trust policy. Option D is not needed because AWS Organizations can be used but not required. Option E is not necessary.

Answer

Create an IAM group in the security account with permissions to assume roles in member accounts.

Answer

Enable AWS Organizations trusted access with AWS IAM Access Analyzer.

Question 2

A company needs to grant an IAM user permissions to start and stop specific EC2 instances. Which IAM policy element should be used to restrict actions to specific instances?

Accepted Answer

Condition. Option B is correct because a Condition element can use 'ec2:ResourceTag' to restrict to instances with specific tags. Option A is wrong because 'NotAction' is for actions, not resources. Option C is wrong because 'Resource' can specify instance ARNs but not dynamically based on tags. Option D is wrong because 'Principal' is for specifying who.

Answer

Resource

Answer

Principal

Answer

NotAction

Question 3

A company wants to ensure that all S3 buckets in their AWS account have encryption enabled. Which AWS service can continuously evaluate compliance and automatically remediate non-compliant buckets?

Accepted Answer

AWS Config. Option D is correct: AWS Config with a managed rule 's3-bucket-server-side-encryption-enabled' can evaluate compliance and trigger an auto-remediation action to enable encryption. Option A is wrong because CloudTrail only logs. Option B is wrong because IAM does not manage bucket encryption. Option C is wrong because S3 itself does not auto-remediate.

Answer

AWS CloudTrail

Answer

AWS IAM

Answer

Amazon S3

Question 4

A security engineer is reviewing an SCP that denies access to a specific AWS service. The engineer notices that the SCP has an Effect of 'Deny' for 's3:PutObject' but the condition block uses 'StringEquals' with 'aws:SourceIp' set to an IP range. Users in the account are still able to upload objects to S3 from IP addresses outside the range. What is the most likely reason?

Accepted Answer

The SCP condition key 'aws:SourceIp' is not available for use in SCPs; SCPs only support condition keys that are global and listed in the AWS Global Condition Context Keys documentation for SCPs.. Option D is correct because SCPs do not support the aws:SourceIp condition key; they only support condition keys that are global in the context of the service control policy. Option A is wrong because SCPs are not limited to IAM users and groups; they apply to all principals in the account. Option B is wrong because SCPs support conditions, but not all condition keys are available. Option C is wrong because SCPs are evaluated before IAM policies and can deny actions.

Answer

The SCP condition key 'aws:SourceIp' is not supported for SCPs; SCPs only support conditions that are resource-based.

Answer

The SCP only applies to IAM users and groups, not to the root user.

Answer

The SCP is evaluated after IAM policies, so an IAM policy allowing the action overrides the SCP.

Question 5

Which TWO AWS services can be used to automatically enforce policies on resources at the time of creation? (Choose two.)

Accepted Answer

AWS Service Catalog. Options B and D are correct. AWS Service Catalog allows creation of pre-approved resources with policies, and AWS Config rules with remediation can enforce policies after creation. Option A is wrong because IAM policies are for permissions. Option C is wrong because CloudTrail is for logging. Option E is wrong because AWS KMS is for encryption keys.

Answer

AWS Key Management Service (KMS)

Answer

AWS CloudTrail

Answer

AWS IAM

Question 6

A company wants to grant a third-party auditor read-only access to specific CloudTrail log files stored in an S3 bucket. The auditor should not be able to list or access any other objects in the bucket. What is the most secure way to achieve this?

Accepted Answer

Generate pre-signed URLs for the specific log files and share them with the auditor.. Using S3 pre-signed URLs grants time-limited access to specific objects without requiring the auditor to have AWS credentials. Option A is wrong because it grants broad access. Option B is wrong because a bucket policy granting GetObject for the auditor's IAM user still allows listing if they have ListBucket permission. Option D is wrong because CloudTrail does not natively provide access to log files.

Answer

Use CloudTrail's built-in console access for the auditor.

Answer

Create a new IAM user for the auditor with an S3 policy that grants s3:GetObject on the entire bucket.

Answer

Use a bucket policy that grants the auditor's IAM user s3:GetObject access to the specific log file prefix.

Question 7

Which TWO AWS services can be used to enforce that Amazon S3 buckets are not publicly accessible? (Choose two.)

Accepted Answer

AWS Organizations service control policies (SCPs). AWS Config can evaluate bucket policies against a rule and trigger remediation. SCPs in AWS Organizations can deny actions that make buckets public. AWS CloudTrail only logs. IAM Access Analyzer identifies public access but does not enforce. Amazon Macie discovers sensitive data.

Answer

IAM Access Analyzer

Answer

AWS CloudTrail

Answer

Amazon Macie

Question 8

A security engineer needs to ensure that all EC2 instances launched in an account have a specific tag (e.g., CostCenter) applied. If an instance is launched without the tag, it should be automatically terminated. Which solution meets these requirements with minimal effort?

Accepted Answer

Use AWS Config rules with an automatic remediation action that invokes a Lambda function to terminate the instance.. Option D is correct because AWS Config rules can detect untagged instances and trigger a Lambda function to terminate them. Option A is wrong because SCPs cannot enforce tagging on EC2 instances. Option B is wrong because Tag Policies only enforce tagging on resources that support tags, but they do not auto-remediate. Option C is wrong because CloudTrail can detect launch events but cannot automatically terminate instances.

Answer

Use an SCP to deny ec2:RunInstances if the request does not include the required tag.

Answer

Use AWS Organizations Tag Policies to enforce the tag.

Answer

Use AWS CloudTrail to detect RunInstances events and send alerts to the security team.

Question 9

A security engineer is auditing IAM policies. The engineer wants to identify if any policy grants 'Effect: Allow' with 'Action: *' and 'Resource: *'. Which TWO AWS services can be used to detect such overly permissive policies?

Accepted Answer

AWS Config. IAM Access Analyzer can analyze policies for broad permissions. AWS Config can evaluate custom rules to check for such policies. Option A (CloudTrail) logs usage, not policy content. Option C (GuardDuty) does not analyze IAM policies. Option E (Trusted Advisor) checks some but not all policies.

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Question 10

Which TWO actions are valid ways to enforce the principle of least privilege in an AWS environment?

Accepted Answer

Grant only the necessary actions in IAM policies. Options A and C are correct. Option A is correct because IAM policies should grant the minimum required permissions. Option C is correct because SCPs can restrict permissions across accounts. Option B is wrong because S3 bucket policies are resource-based and not a direct least privilege method for users. Option D is wrong because assigning full access is against least privilege. Option E is wrong because root user has unrestricted access.

Answer

Use the root user for daily administration

Answer

Use S3 bucket policies to allow all IAM users

Answer

Assign the AdministratorAccess managed policy to all users

Question 11

An organization uses AWS Organizations with multiple OUs. The security team wants to ensure that any new account created in the 'Production' OU automatically gets a set of mandatory tags (CostCenter, Environment) and that these tags cannot be removed. What is the most effective approach?

Accepted Answer

Apply an SCP that denies changes to the specified tags for all accounts in the Production OU.. Option B is correct: using an SCP with a condition that denies modification of those specific tags. SCPs can prevent any IAM actions that remove or modify tags. Option A is wrong because AWS Config rules only detect, not prevent. Option C is wrong because SCPs cannot be used to automatically add tags. Option D is wrong because IAM policies in each account are less centralized.

Answer

Use AWS Service Catalog to provision accounts with pre-defined tags.

Answer

Use AWS Config rules to detect untagged resources and send alerts.

Answer

Create an IAM policy in each account that prohibits tag removal.

Question 12

A company has a requirement to audit all API calls made to AWS services in their account. Which AWS service should be used to meet this requirement?

Accepted Answer

AWS CloudTrail. Option B is correct because AWS CloudTrail records API activity in the account. Option A is wrong because Amazon GuardDuty is a threat detection service. Option C is wrong because AWS Config records resource configuration changes, not API calls. Option D is wrong because Amazon Inspector is a vulnerability assessment service.

Answer

AWS Config

Answer

Amazon Inspector

Answer

Amazon GuardDuty

Question 13

A company has an AWS environment with multiple accounts managed under AWS Organizations. The security team wants to enforce that all newly created S3 buckets in any account have encryption enabled by default. Which approach should the security team take?

Accepted Answer

Create a Service Control Policy (SCP) that denies the creation of S3 buckets without encryption.. Option C is correct because SCPs can be applied to all accounts in the organization to deny the creation of S3 buckets without encryption. Option A is wrong because S3 default encryption is a bucket-level setting, not an organization-wide enforcement. Option B is wrong because AWS Config rules are reactive, not preventive. Option D is wrong because IAM policies are account-specific and cannot be centrally enforced across all accounts.

Answer

Use AWS Config rules to detect unencrypted buckets and send alerts.

Answer

Enable S3 default encryption in each account's S3 settings.

Answer

Apply an IAM policy to the root user of each account to enforce bucket encryption.

Question 14

A company's security team needs to implement a solution to detect and alert on the creation of IAM users or roles with administrative privileges. The solution must be able to analyze historical account activity and provide real-time alerts. Which combination of AWS services should be used?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Logs with metric filters and alarms. AWS CloudTrail logs IAM CreateUser, CreateRole, and AttachRolePolicy events. Amazon CloudWatch Logs can filter these events and trigger alerts via CloudWatch Alarms. Option A is wrong because AWS Config evaluates current configuration but does not provide real-time alerts on API calls. Option B is wrong because AWS Trusted Advisor is for best-practice checks, not real-time monitoring. Option D is wrong because Amazon GuardDuty focuses on threat detection, not specific IAM policy changes.

Answer

Amazon GuardDuty and AWS Lambda

Answer

AWS Trusted Advisor and Amazon SES

Answer

AWS Config with managed rules and Amazon SNS

Question 15

The exhibit shows an SCP attached to an organizational unit. What is the effect of this policy?

Accepted Answer

It allows s3:PutBucketPolicy only if the bucket ACL is set to bucket-owner-full-control.. The SCP denies s3:PutBucketPolicy only when the bucket ACL is not set to 'bucket-owner-full-control'. If the ACL is set to that value, the action is allowed. Thus, it ensures that when a bucket policy is created, the ACL must grant full control to the bucket owner. It does not deny all PutBucketPolicy actions.

Answer

It denies all s3:PutBucketPolicy actions on all buckets.

Answer

It denies s3:PutBucketPolicy for any bucket that does not have an ACL.

Answer

It allows s3:PutBucketPolicy for buckets owned by the management account.

Question 16

A company is using AWS Organizations and wants to delegate the administration of certain accounts to different teams. For example, the finance team should be able to manage billing-related accounts, but not development accounts. Which AWS feature allows this type of delegation?

Accepted Answer

AWS Organizations delegated administrator. Option A is correct because AWS Organizations delegated administrator allows you to register member accounts as delegated administrators for specific services, giving them limited administrative permissions. Option B is wrong because SCPs are for denying permissions, not for delegation. Option C is wrong because IAM roles are for users, not for account-level delegation. Option D is wrong because AWS SSO provides user access, not account management delegation.

Answer

AWS IAM Identity Center (AWS SSO)

Answer

Service control policies (SCPs)

Answer

IAM roles in each account

Question 17

A company wants to ensure that all IAM users in an account have multi-factor authentication (MFA) enabled. A security administrator needs to identify users who do not have MFA. Which AWS service should the administrator use?

Accepted Answer

IAM Credential Report. AWS IAM Credential Report lists all IAM users and their MFA status, providing a quick way to identify users without MFA. Option A (IAM Access Analyzer) focuses on resource policies. Option C (CloudTrail) logs events. Option D (AWS Config) can check compliance but requires a rule; the credential report is more direct.

Answer

AWS CloudTrail

Answer

IAM Access Analyzer

Answer

AWS Config

Question 18

A company wants to enforce that all IAM users must use multi-factor authentication (MFA) to access the AWS Management Console. Which policy should be attached to the IAM users or group to enforce this requirement?

Accepted Answer

Deny access if MFA is not present. Option B is correct because the condition 'aws:MultiFactorAuthPresent':'true' in a Deny statement ensures that if MFA is not present, access is denied. Option A is wrong because it allows access without MFA. Option C is wrong because it only denies when MFA is present. Option D is wrong because it allows access with MFA but does not deny without it.

Answer

Allow access if MFA is present

Answer

Deny access if MFA is present

Answer

Grant access with a condition requiring MFA

Question 19

Which THREE AWS services can be used to centrally manage and audit permissions across multiple accounts in AWS Organizations?

Accepted Answer

AWS IAM Access Analyzer. Options A, B, and D are correct. Option A is correct because IAM Access Analyzer can analyze resource policies across accounts. Option B is correct because AWS CloudTrail logs can be aggregated from multiple accounts. Option D is correct because AWS Config aggregator can aggregate compliance data. Option C is wrong because Inspector is for vulnerability assessments, not permission management. Option E is wrong because Shield is for DDoS protection.

Answer

Amazon Inspector

Answer

AWS Shield

Question 20

A security auditor needs to view a list of all IAM users, including their last activity timestamps, for a compliance review. Which AWS service provides this information natively?

Accepted Answer

AWS IAM credential report. Option B is correct: IAM's credential report includes last activity timestamps for each user. Option A is wrong because CloudTrail logs events but not a consolidated report. Option C is wrong because AWS Config does not provide activity timestamps. Option D is wrong because Access Analyzer analyzes resource policies, not user activity.

Answer

AWS CloudTrail

Answer

IAM Access Analyzer

Answer

AWS Config