SCS-C02 Management and Security Governance — 20 Questions

Question 1

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that all S3 buckets across all accounts are encrypted with AWS KMS. Which policy should be used to enforce this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an SCP at the root OU that denies s3:PutBucketEncryption unless encryption is set to AWS KMS. Service Control Policies (SCPs) at the root OU can deny the s3:PutBucketEncryption action unless the request includes encryption settings that use AWS KMS. This enforces encryption at the organizational level, overriding any account-level permissions, and ensures that all S3 buckets across all accounts are encrypted with KMS.

Answer

Apply a bucket policy on each bucket denying PutObject without encryption

Answer

Enable AWS Config with the s3-bucket-server-side-encryption-enabled rule

Answer

Attach an IAM policy to each account's admin user requiring encryption

Question 2

A security engineer needs to grant cross-account read access to an S3 bucket in Account A to a user in Account B. What is the correct combination of actions?

Accepted Answer

Apply a bucket policy in Account A granting access to the principal in Account B, and attach an IAM policy to the user in Account B allowing the action. Cross-account S3 access requires both a bucket policy in the resource account (Account A) that explicitly grants the cross-account principal (the user in Account B) the s3:GetObject action, and an IAM policy attached to the user in Account B that allows the same action. This two-way authorization is necessary because the bucket policy controls access to the S3 resource, while the IAM policy controls the user's permissions to initiate the request. Without both, the request will be denied by either the resource-based policy or the identity-based policy.

Answer

Attach an IAM policy to the user in Account B allowing the action; no bucket policy needed

Answer

Apply a bucket policy in Account A granting access to the user in Account B; no user policy needed

Answer

Use S3 bucket ACLs to grant READ access to the Account B user

Question 3

A company wants to use AWS CloudTrail to log all API activity across multiple accounts in AWS Organizations. Which configuration meets the requirement of centralized logging with minimal operational overhead?

Accepted Answer

Create an organization trail in the management account that applies to all accounts. Creating an organization trail in the management account automatically applies to all accounts in AWS Organizations, centralizing CloudTrail logs into a single S3 bucket without requiring per-account configuration. This approach minimizes operational overhead by leveraging the Organizations integration, which handles log delivery from member accounts transparently.

Answer

Create a CloudTrail trail in each account and aggregate logs to a common S3 bucket

Answer

Enable CloudTrail in each account and use cross-account roles to centralize logs

Answer

Use AWS Config to record API calls and send to CloudWatch Logs

Question 4

A security engineer attaches the above SCP to an OU containing development accounts. The engineer expects that only t3.micro instances can be launched, but developers report that they cannot launch any EC2 instances. What is the MOST likely reason?

Accepted Answer

The SCP denies all ec2 actions because there is no explicit allow statement.. SCPs operate on a default-deny model: all actions are implicitly denied unless explicitly allowed. The policy only denies non-t3.micro instance types but does not include an explicit Allow statement for ec2:RunInstances or any other EC2 action. Without an explicit Allow, the implicit deny blocks all EC2 actions, including launching t3.micro instances.

Answer

The SCP syntax is invalid because it uses Deny without an explicit Allow.

Answer

The condition StringNotEquals is evaluated incorrectly for EC2 instance types.

Answer

The SCP is applied at the organization root and overrides the OU-level policy.

Question 5

A security engineer reviews the above CloudTrail event. Which action should the engineer take FIRST to mitigate a potential security issue?

Accepted Answer

Revert the bucket policy to remove the public access.. The CloudTrail event shows that the root user executed `s3:PutBucketPolicy` to apply a bucket policy that grants public access (e.g., `Principal: "*"` or `Effect: "Allow"` with `Action: "s3:GetObject"`). Reverting the bucket policy to remove public access is the immediate corrective action to stop unauthorized data exposure. This directly addresses the security issue by revoking the public read permissions that were just granted.

Answer

Delete the bucket to prevent data exposure.

Answer

Contact the root user to confirm the action.

Answer

Disable the root user's access keys.

Question 6

A company uses AWS Organizations with multiple accounts and wants to ensure that all newly created S3 buckets have encryption enabled. The Security team needs a solution that automatically remediates non-compliant buckets without manual intervention. What should they do?

Accepted Answer

Enable AWS Config with the s3-bucket-server-side-encryption-enabled rule and set up automatic remediation using Systems Manager Automation.. AWS Config can continuously evaluate S3 buckets against the s3-bucket-server-side-encryption-enabled rule and automatically remediate non-compliant buckets using Systems Manager Automation, requiring no manual intervention. Option A is incorrect because a service control policy (SCP) cannot enforce encryption on bucket creation; the described SCP is circular and unenforceable since it denies s3:PutBucketEncryption unless encryption is already enabled, which is impossible to satisfy at creation time.

Answer

Apply a service control policy (SCP) that denies the s3:PutBucketPublicAccessBlock and s3:PutBucketEncryption actions unless the bucket has encryption enabled.

Answer

Use an S3 bucket policy that denies PutObject unless the request includes the x-amz-server-side-encryption header.

Answer

Create an IAM role with permissions to enforce encryption and attach it to all accounts in the organization.

Question 7

A security engineer is designing a centralized logging solution for a multi-account AWS environment. They need to ensure log files are tamper-proof and cannot be deleted or modified by anyone, including the root user of any account. Which configuration meets these requirements?

Accepted Answer

Enable S3 Object Lock in Governance mode with a retention period, and use a separate account to manage the retention settings.. S3 Object Lock in Governance mode prevents any user, including the root user, from deleting or overwriting objects until the retention period expires. By storing the logs in a separate account that manages the retention settings, the security engineer ensures that even if an attacker compromises the source account, they cannot modify or delete the logs because the lock is enforced by the destination account's S3 configuration.

Answer

Create a bucket policy that denies s3:DeleteObject and s3:PutObject to all principals.

Answer

Enable MFA Delete on the S3 bucket and configure CloudTrail to log to that bucket.

Answer

Enable CloudTrail log file validation and store logs in a separate account.

Question 8

A company has a three-tier web application running on AWS. The application consists of an Application Load Balancer (ALB), an EC2 Auto Scaling group for web servers, and an RDS MySQL database. The Security team recently discovered that the database is publicly accessible from the internet. They need to remediate this immediately while minimizing downtime. The database is critical for the application, and the application must remain available. The team has identified that the database security group currently allows inbound traffic from 0.0.0.0/0 on port 3306. The web servers are in a security group named 'web-sg'. The database security group is named 'db-sg'. The team wants to restrict access to only the ALB and the web servers. Which action should the team take to resolve the issue with the least downtime?

Accepted Answer

Modify the inbound rule of the db-sg security group to allow traffic from the web-sg security group on port 3306 and remove the rule allowing traffic from 0.0.0.0/0.. Modifying the db-sg security group to allow inbound traffic from the web-sg security group (instead of 0.0.0.0/0) on port 3306 directly restricts database access to only the web servers. This change is applied immediately without requiring any resource recreation or downtime, as security group rules are stateful and take effect in real time. Removing the overly permissive rule eliminates the public exposure while keeping the existing database endpoint and application connectivity intact.

Answer

Create a new security group that allows inbound traffic from the web-sg security group on port 3306, then attach the new security group to the database instance.

Answer

Update the network ACL for the database subnet to deny inbound traffic from 0.0.0.0/0 on port 3306.

Answer

Move the RDS instance to a private subnet and update the application's database endpoint to use the new private IP address.

Question 9

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that all S3 buckets across all accounts are encrypted with AWS KMS. Which policy should be used to enforce this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an SCP that denies IAM actions without MFA and attach it to the root organizational unit (OU).. Service Control Policies (SCPs) in AWS Organizations can be attached to the root organizational unit (OU) to apply a blanket denial of IAM actions when MFA is not present, affecting all accounts and users within the organization. This leverages the `aws:MultiFactorAuthPresent` condition key in an SCP to enforce MFA at the organization level, ensuring that even if IAM users are created in member accounts, they cannot perform IAM actions without MFA. Attaching the SCP to the root OU ensures the policy cascades down to all child OUs and accounts, providing centralized enforcement.

Answer

Create an SCP that denies IAM actions without MFA and attach it to the IAM group that contains all users.

Answer

Create an SCP that denies IAM actions without MFA and attach it to each IAM user.

Answer

Create an SCP that denies IAM actions without MFA and attach it to the management account.

Question 10

Drag and drop the steps to set up a secure S3 bucket with encryption and access control in the correct order.

Accepted Answer

Enable default encryption → Block public access → Attach bucket policy → Enable versioning → Enable access logging. Secure S3 bucket requires encryption, public access block, bucket policy, versioning, and access logging.

Answer

Block public access → Enable default encryption → Attach bucket policy → Enable versioning → Enable access logging

Answer

Enable default encryption → Block public access → Enable versioning → Attach bucket policy → Enable access logging

Answer

Enable default encryption → Enable versioning → Block public access → Attach bucket policy → Enable access logging

Question 11

Which TWO actions can be taken to enforce the principle of least privilege for IAM users in an AWS account? (Choose two.)

Accepted Answer

Use IAM roles with temporary credentials for access. Uses IAM roles with temporary credentials, which adheres to least privilege by providing only necessary permissions for a limited time. Option E involves regularly reviewing and removing unused IAM policies, which ensures that only required permissions are granted and eliminates excessive permissions. Option B (full admin) violates least privilege. Option C (SCP) applies to accounts/OU, not individual users. Option D (root user) should be avoided for daily tasks due to excessive permissions.

Answer

Grant full administrative access to all users to simplify management

Answer

Use service control policies (SCPs) to restrict user permissions

Answer

Use the root user for daily administrative tasks

Question 12

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that all S3 buckets across all accounts are encrypted with AWS KMS. Which policy should be used to enforce this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The SCP denies the action, overriding the IAM policy.. SCPs act as a permission boundary; if an SCP denies an action, it cannot be performed even if an IAM policy allows it. Option A is wrong because the developer does have the ec2:RunInstances permission in their IAM policy; the error occurs due to the SCP. Option B is wrong because the order of evaluation is not relevant; SCPs and IAM policies are evaluated together, and SCPs can deny actions regardless of IAM permissions. Option D is wrong because SCPs apply to all principals in the account, not just the root user.

Answer

The IAM policy does not include the ec2:RunInstances permission.

Answer

The IAM policy is applied before the SCP.

Answer

The SCP is applied only to the root user.

Question 13

A company wants to ensure that IAM users with console access have strong passwords. Which IAM password policy setting should the company configure to enforce the use of at least one uppercase letter?

Accepted Answer

RequireUppercaseCharacters. 'RequireUppercaseCharacters' enforces the use of at least one uppercase letter. Option A is wrong because 'MinimumPasswordLength' only sets the minimum length, not character types. Option C is wrong because 'RequireNumbers' enforces digits, not uppercase letters. Option D is wrong because 'RequireSymbols' enforces special characters, not uppercase letters.

Answer

MinimumPasswordLength

Answer

RequireNumbers

Answer

RequireSymbols

Question 14

A company requires that all Amazon EC2 instances be launched only with an approved Amazon Machine Image (AMI) that has been hardened by the security team. Which AWS service should be used to enforce this requirement?

Accepted Answer

AWS Config. AWS Config is correct because it can evaluate whether EC2 instances are launched from approved AMIs using managed rules (e.g., approved-amis-by-id) or custom Lambda rules, and it can automatically remediate noncompliant instances. Option B (EC2 Image Builder) builds and manages AMIs but does not enforce their usage. Option C (AWS Systems Manager Patch Manager) patches instances but does not control which AMIs are used. Option D (AWS Service Catalog) provides a product portfolio for launching instances but does not enforce the use of specific AMIs at launch.

Answer

EC2 Image Builder

Answer

AWS Systems Manager Patch Manager

Answer

AWS Service Catalog

Question 15

A company has a requirement that all access keys for IAM users must be rotated every 90 days. A security engineer needs to implement an automated solution to identify and disable keys that are older than 90 days. Which approach meets the requirement with the least operational overhead?

Accepted Answer

Use an AWS Config rule with auto-remediation to disable keys older than 90 days.. AWS Config has a managed rule 'access-keys-rotated' that checks key age and can trigger auto-remediation via a Systems Manager automation document to disable old keys. Option A is wrong because AWS Trusted Advisor only provides recommendations, not enforcement. Option B is wrong because CloudTrail does not enforce rotation. Option C is wrong because IAM Access Analyzer does not manage key rotation; it generates findings for unused access, not key age.

Answer

Use AWS Trusted Advisor to check key age and send notifications.

Answer

Use AWS CloudTrail to monitor CreateAccessKey events and trigger a Lambda function to check key age.

Answer

Use IAM Access Analyzer to generate findings for unused keys and manually disable them.

Question 16

A security engineer is auditing an S3 bucket policy that allows cross-account access. The engineer wants to ensure that only encrypted connections are permitted. Which condition should be added to the policy?

Accepted Answer

aws:SecureTransport. Aws:SecureTransport is the condition key that enforces HTTPS. Option A is wrong because aws:SourceIp controls IP addresses, not encryption. Option B is wrong because aws:Referer controls referrer headers, not encryption. Option D is wrong because s3:x-amz-server-side-encryption controls server-side encryption headers, not transport encryption.

Answer

aws:SourceIp

Answer

aws:Referer

Answer

s3:x-amz-server-side-encryption

Question 17

A security engineer is designing a logging solution for a multi-account environment using AWS Organizations. The solution must meet the following requirements: 
- Logs from all accounts must be centrally stored and immutable. 
- Only the security team should be able to delete logs. 
- Logs must be encrypted at rest. 
Which TWO steps should the engineer take to meet these requirements? (Choose TWO.)

Accepted Answer

Enable S3 Object Lock and configure a bucket policy to deny s3:DeleteObject unless the principal is the security team.. Options B and E are correct. Option B: S3 Object Lock prevents logs from being deleted or overwritten, ensuring immutability. Additionally, a bucket policy with a condition that denies s3:DeleteObject unless the principal is the security team ensures only they can delete logs. Option E: An organizational CloudTrail trail in the management account automatically delivers logs from all accounts in the organization to a single S3 bucket, meeting the centralized logging requirement. Option A is incorrect because S3 default encryption provides encryption at rest but does not address immutability or deletion control. Option C is incorrect because CloudWatch Logs retention policy does not prevent deletion by administrators and does not provide immutability. Option D is incorrect because creating an IAM role in each account does not centralize logs; it only provides access but logs remain in each account.

Answer

Enable S3 default encryption on the log bucket.

Answer

Stream logs to CloudWatch Logs and set a retention policy of 10 years.

Answer

Create an IAM role in each account that allows the security team to access logs.

Question 18

A company has a single AWS account with multiple IAM users. The security team wants to enforce that all IAM users must use multi-factor authentication (MFA) to access the AWS Management Console. They attach an IAM policy that denies all actions if the user does not have MFA. However, after attaching the policy, some users report that they are unable to perform any actions even after authenticating with MFA. The policy uses the condition "aws:MultiFactorAuthPresent": "false". The security team verifies that the users have MFA enabled and are using it. What is the most likely cause of this issue?

Accepted Answer

The policy is incorrectly written; it should use "Effect": "Allow" and the condition "aws:MultiFactorAuthPresent": "true".. The correct approach is to use an Allow policy with the condition that MFA must be present. The Deny policy as written will deny all actions even when MFA is present if there is no other Allow policy granting permissions. Since IAM defaults to implicit deny, a Deny policy is not sufficient to grant access; it only restricts. Therefore, users cannot perform any actions because there is no Allow statement. Option C correctly identifies this.

Answer

The condition should be "Bool": "aws:MultiFactorAuthPresent": "false" but the policy uses StringLike.

Answer

The policy is missing a NotAction element; it should deny all actions except for the ones needed for MFA enrollment.

Answer

The users are signing in as the root user of the account, not as IAM users.

Question 19

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all member accounts have AWS CloudTrail enabled and that the logs are delivered to a centralized S3 bucket in the management account. The team creates an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail. Additionally, they enable CloudTrail organizational trail. However, after some time, they discover that one member account has disabled CloudTrail. What is the most likely reason this happened?

Accepted Answer

The SCP was applied to the management account instead of the member accounts.. The security team created an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail. If this SCP is attached to the management account only, it does not apply to member accounts. Therefore, member accounts are not restricted and can disable their own CloudTrail trails. The most likely reason for the member account disabling CloudTrail is that the SCP was applied to the management account instead of the member accounts.

Answer

The member account's root user performed the action, which bypasses the SCP.

Answer

The SCP was not attached to the organizational unit (OU) containing the member account.

Answer

The member account's IAM user used the AWS Management Console to disable CloudTrail.

Question 20

A company uses AWS Organizations and has a requirement to enforce that all EC2 instances launched in any account must have a specific tag "Environment" with value "Production". The security team wants to prevent any instance without this tag from being launched. They implement a service control policy (SCP) that denies the ec2:RunInstances action if the request does not include the required tag. However, they find that users are still able to launch instances without the tag. The SCP is attached to the root OU. The team also has an IAM policy that allows ec2:RunInstances with no conditions. What is the most likely reason the SCP is not preventing the launches?

Accepted Answer

The SCP uses ec2:ResourceTag instead of aws:RequestTag for the condition.. The SCP condition must use the `aws:RequestTag` condition key to enforce tags on creation, not `ec2:ResourceTag`. The `ec2:ResourceTag` key only evaluates tags on existing resources, so it does not apply when an instance is launched. An SCP using `ec2:ResourceTag` would not deny the launch because the condition is not evaluated on the API request. To prevent launches without the required tag, the SCP should use `aws:RequestTag` to check the tags in the request. Options A, B, and C are incorrect: SCPs apply to all principals including root, IAM policies do not override SCP denies, and the SCP is attached to the root OU, not the management account.

Answer

The SCP does not apply to the root user in member accounts.

Answer

The IAM policy allows the action, which overrides the SCP deny.

Answer

The SCP is applied to the management account, not the member accounts.