SCS-C02 Management and Security Governance — 40 Questions

Question 1

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that all S3 buckets across all accounts are encrypted with AWS KMS. Which policy should be used to enforce this?

Accepted Answer

Create an SCP at the root OU that denies s3:PutBucketAction without encryption. Option B is correct because Service Control Policies (SCPs) at the root OU can deny the s3:PutBucketAction (which includes s3:PutBucketEncryption) unless the request includes encryption settings that use AWS KMS. This enforces encryption at the organizational level, overriding any account-level permissions, and ensures that all S3 buckets across all accounts are encrypted with KMS.

Answer

Apply a bucket policy on each bucket denying PutObject without encryption

Answer

Enable AWS Config with the s3-bucket-server-side-encryption-enabled rule

Answer

Attach an IAM policy to each account's admin user requiring encryption

Question 2

A security engineer needs to grant cross-account read access to an S3 bucket in Account A to a user in Account B. What is the correct combination of actions?

Accepted Answer

Apply a bucket policy in Account A granting access to the principal in Account B, and attach an IAM policy to the user in Account B allowing the action. Cross-account S3 access requires both a bucket policy in the resource account (Account A) that explicitly grants the cross-account principal (the user in Account B) the s3:GetObject action, and an IAM policy attached to the user in Account B that allows the same action. This two-way authorization is necessary because the bucket policy controls access to the S3 resource, while the IAM policy controls the user's permissions to initiate the request. Without both, the request will be denied by either the resource-based policy or the identity-based policy.

Answer

Attach an IAM policy to the user in Account B allowing the action; no bucket policy needed

Answer

Apply a bucket policy in Account A granting access to the user in Account B; no user policy needed

Answer

Use S3 bucket ACLs to grant READ access to the Account B user

Question 3

A company uses AWS Config to evaluate resource compliance. The security team notices that the AWS::IAM::Group resource type is not supported by AWS Config managed rules. What is the best way to detect IAM groups that have an inline policy allowing 'iam:CreateUser'?

Accepted Answer

Create a custom AWS Config rule using a Lambda function that evaluates IAM groups. AWS Config managed rules do not support the AWS::IAM::Group resource type, so you cannot use a managed rule to evaluate inline policies on IAM groups. The best approach is to create a custom AWS Config rule backed by a Lambda function that can evaluate the IAM group's inline policies and trigger a compliance check when the group configuration changes. This allows you to detect any inline policy that contains the 'iam:CreateUser' action.

Answer

Use IAM Access Analyzer to identify policies that grant broad access

Answer

Use AWS CloudTrail Insights to detect CreateUser events

Answer

Enable AWS Config advanced query and run a query on IAM groups

Question 4

A company wants to use AWS CloudTrail to log all API activity across multiple accounts in AWS Organizations. Which configuration meets the requirement of centralized logging with minimal operational overhead?

Accepted Answer

Create an organization trail in the management account that applies to all accounts. Option D is correct because creating an organization trail in the management account automatically applies to all accounts in AWS Organizations, centralizing CloudTrail logs into a single S3 bucket without requiring per-account configuration. This approach minimizes operational overhead by leveraging the Organizations integration, which handles log delivery from member accounts transparently.

Answer

Create a CloudTrail trail in each account and aggregate logs to a common S3 bucket

Answer

Enable CloudTrail in each account and use cross-account roles to centralize logs

Answer

Use AWS Config to record API calls and send to CloudWatch Logs

Question 5

A security team needs to audit all changes to IAM policies in their AWS account. Which AWS service should they use to record policy changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made in the AWS account, including IAM policy changes (e.g., CreatePolicy, PutRolePolicy, AttachUserPolicy). These events are captured as CloudTrail log entries, providing a complete audit trail of who made the change, when, and from which source IP. This directly meets the requirement to audit all changes to IAM policies.

Answer

Amazon Inspector

Answer

Amazon GuardDuty

Answer

AWS Config

Question 6

A company uses AWS Organizations with SCPs. The security team wants to ensure that no IAM user can be created without MFA. Which SCP should be applied at the root OU?

Accepted Answer

Deny iam:CreateUser unless the request includes a condition for MFA. Option C is correct because it uses a Service Control Policy (SCP) to deny the `iam:CreateUser` action unless the request includes a condition that MFA is present. SCPs are account-level permission boundaries in AWS Organizations, and this approach ensures that no IAM user can be created without MFA across all accounts in the organization, as SCPs are evaluated before any IAM policies.

Answer

Deny iam:CreateUser unconditionally

Answer

Use an IAM policy to require MFA for API calls

Answer

Attach an IAM policy to all users requiring MFA

Question 7

A security engineer needs to ensure that all EC2 instances launched in a development account are tagged with a cost center. What is the most effective way to enforce this?

Accepted Answer

Use an IAM policy that denies ec2:RunInstances unless the request includes the cost center tag. Option D is correct because using an IAM policy with a condition key (e.g., `aws:RequestTag`) that denies `ec2:RunInstances` unless the `cost center` tag is specified in the API call enforces tagging at launch time. This prevents any untagged instance from being created, providing proactive enforcement rather than reactive detection or remediation.

Answer

Use AWS Config to detect untagged instances and send alerts

Answer

Use AWS Systems Manager to tag instances after launch

Answer

Create a tag policy in AWS Organizations requiring the cost center tag

Question 8

A company wants to centrally manage access keys for IAM users. Which AWS service can generate and rotate access keys automatically?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct service because it natively supports automatic rotation of secrets, including IAM user access keys. You can configure a rotation schedule (e.g., every 30 days) and Secrets Manager will generate a new access key pair, update the IAM user, and optionally disable or delete the old key. This provides a fully managed, centralized solution for rotating access keys without custom scripting.

Answer

AWS CloudHSM

Answer

AWS KMS

Answer

AWS Systems Manager Parameter Store

Question 9

A company uses AWS Config to record resources. Which TWO actions can be taken to automatically remediate non-compliant resources detected by AWS Config rules?

Accepted Answer

Configure AWS Config rules to invoke an AWS Lambda function for remediation. Option A is correct because AWS Config rules can be configured with remediation actions that invoke an AWS Lambda function. When a resource is evaluated as non-compliant, the rule triggers the Lambda function, which can execute custom logic to modify or fix the resource, such as adjusting security group rules or enabling encryption. This provides automated, programmable remediation directly integrated with AWS Config's evaluation lifecycle.

Answer

Configure AWS Config rules to send notifications to an SNS topic

Answer

Use AWS CloudTrail to log non-compliant events

Answer

Use Amazon CloudWatch Events to trigger an AWS Step Functions state machine

Question 10

A company wants to implement least privilege access for a data analytics team that uses Amazon Athena to query data in S3. Which THREE steps should be taken?

Accepted Answer

Grant write access to an S3 bucket for query results. Option B is correct because Athena requires a dedicated S3 bucket to store query results, and granting write access to that specific bucket ensures the service can write output without exposing other data. This aligns with least privilege by limiting write permissions to only the necessary location.

Answer

Grant full S3 access to all buckets

Answer

Grant access to Amazon Redshift

Question 11

A security engineer is designing a solution to protect sensitive data in S3. Which THREE mechanisms can be used to enforce encryption at rest?

Accepted Answer

Use an SCP to deny s3:PutObject without encryption. Option A is correct because an SCP (Service Control Policy) can be applied at the organizational level to deny any s3:PutObject action that does not include encryption parameters. This enforces encryption at rest across all accounts in the organization, preventing users from uploading unencrypted objects regardless of individual bucket policies or default encryption settings.

Answer

Enable cross-region replication

Answer

Enable MFA Delete on the S3 bucket

Question 12

Refer to the exhibit. A security engineer applies this bucket policy to an S3 bucket. A user without HTTPS tries to download an object. What is the outcome?

Accepted Answer

The request is denied because the condition matches. The bucket policy includes a condition that denies requests when `aws:SecureTransport` is `false`. Since the user attempts to download an object without HTTPS, the condition matches, and the explicit Deny effect overrides any Allow. Therefore, the request is denied.

Answer

The request fails because the condition does not match

Answer

The request succeeds because the policy has a Deny effect

Answer

The request succeeds because the resource is not specific enough

Question 13

Refer to the exhibit. A role has two policies attached. The custom policy includes an Allow for s3:PutObject. An IAM user assumes this role and tries to upload a file to S3. What happens?

Accepted Answer

The upload succeeds because the custom policy allows s3:PutObject. The upload succeeds because IAM evaluates policies in a default-deny environment, and the custom policy attached to the role explicitly allows s3:PutObject. When a user assumes the role, the effective permissions are the union of all attached policies; the managed policy's read-only restriction does not block the explicit allow for s3:PutObject. Since there is no explicit deny for s3:PutObject, the allow from the custom policy grants the action.

Answer

The upload fails because the managed policy only allows read

Answer

The upload is denied by default because no explicit allow

Answer

The upload fails because the managed policy overrides the custom policy

Question 14

A company runs a multi-account AWS environment using AWS Organizations. The security team uses AWS Config to monitor compliance. Recently, they noticed that a developer in the 'development' account created an S3 bucket that is publicly accessible. The security team wants to prevent this in the future by automatically remediating any public S3 bucket. They have an SCP that denies s3:PutBucketPublicAccessBlock, but developers are still making buckets public by using bucket ACLs. The security team wants to implement a solution that automatically fixes any bucket that becomes public. Which solution should they choose?

Accepted Answer

Use AWS Config with the s3-bucket-public-read-prohibited managed rule and an automatic remediation action using AWS Systems Manager Automation. Option B is correct because AWS Config's s3-bucket-public-read-prohibited managed rule evaluates S3 bucket ACLs and policies for public read access. When a noncompliant bucket is detected, an automatic remediation action using AWS Systems Manager Automation can invoke a custom SSM document (e.g., AWS-DisableS3BucketPublicReadWrite) to remove public ACLs or apply a bucket policy that denies public access. This provides automated, event-driven remediation without relying on manual intervention or incomplete SCPs.

Answer

Use CloudTrail to detect PutBucketAcl events and send to SNS for manual remediation

Answer

Update the SCP to deny s3:PutBucketAcl with a condition for public access

Answer

Attach an IAM policy to all users that denies s3:PutBucketAcl

Question 15

A company uses AWS Organizations with a single management account and multiple member accounts. The security team needs to ensure that all member accounts automatically deploy AWS Config rules to audit security group configurations. Which solution meets this requirement with minimal operational overhead?

Accepted Answer

Use AWS Config conformance packs deployed via AWS CloudFormation StackSets from the management account.. Option C is correct because AWS Config conformance packs, deployed via AWS CloudFormation StackSets from the management account, allow you to centrally deploy a collection of AWS Config rules and remediation actions across all member accounts in an AWS Organization. This approach ensures consistent security group auditing with minimal operational overhead, as StackSets automatically handle deployment, updates, and drift detection across accounts and Regions.

Answer

Configure an AWS Lambda function in each account that periodically checks security group compliance.

Answer

Enable AWS Security Hub and rely on its built-in security group checks.

Answer

Create an AWS Config rule in each member account manually using AWS CloudFormation templates.

Question 16

A security engineer is designing a solution to monitor and remediate non-compliant resources across multiple AWS accounts. The company uses AWS Organizations and wants to enforce that any S3 bucket with public read access is automatically remediated. The solution must be centralized and scalable. Which approach should the engineer take?

Accepted Answer

Deploy an AWS Config conformance pack with a rule and an auto-remediation action using AWS Systems Manager Automation.. Option A is correct because AWS Config conformance packs allow you to deploy a collection of AWS Config rules and remediation actions across multiple accounts and Regions in AWS Organizations. By including an auto-remediation action using AWS Systems Manager Automation, the solution can automatically remediate S3 buckets with public read access in a centralized and scalable manner, without manual intervention or per-account configuration.

Answer

Create an AWS Config rule in each account and configure an Amazon CloudWatch Events rule to trigger an AWS Lambda function for remediation.

Answer

Use AWS Trusted Advisor to identify public buckets and manually remediate them.

Answer

Deploy an AWS Config conformance pack with a rule that checks for public buckets and reports non-compliance.

Question 17

A startup uses a single AWS account for development. The developer has full administrative access and accidentally deleted an S3 bucket containing critical data. The security team wants to prevent similar incidents without hindering agility. What is the MOST effective control?

Accepted Answer

Enable S3 Versioning and MFA Delete on the bucket.. Option D is correct because enabling S3 Versioning preserves all object versions, allowing recovery of deleted objects, while MFA Delete requires multi-factor authentication to permanently delete object versions or suspend versioning. This prevents accidental or unauthorized permanent deletions without hindering the developer's ability to create, read, and update objects, thus balancing security and agility.

Answer

Remove the developer's permissions and require all changes through IT.

Answer

Configure an S3 lifecycle policy to archive objects to S3 Glacier.

Answer

Use AWS CloudTrail to monitor deletions and alert the security team.

Question 18

A company has multiple AWS accounts managed through AWS Organizations. The security team needs to ensure that no EC2 instances are launched without an approved Amazon Machine Image (AMI). Which governance control should be implemented?

Accepted Answer

Use a service control policy (SCP) that denies ec2:RunInstances unless the AMI ID is in an approved list.. A service control policy (SCP) is the correct governance control because it operates at the AWS Organizations level, allowing the security team to enforce a deny on ec2:RunInstances across all member accounts unless the AMI ID matches an approved list. SCPs are account permission boundaries that cannot be overridden by IAM policies within the account, ensuring that no user or role can launch an EC2 instance with an unapproved AMI, even if they have full administrative privileges. This provides a preventive control that blocks non-compliant actions before they occur, which is more robust than detective or reactive measures.

Answer

Deploy an AWS Config rule that triggers a Lambda function to terminate non-compliant instances.

Answer

Use AWS CloudTrail to monitor instance launches and alert the security team.

Answer

Use an IAM policy that restricts ec2:RunInstances to approved AMIs.

Question 19

A company wants to use AWS CloudFormation to manage infrastructure. The security team requires that all templates are scanned for security vulnerabilities before deployment. Which service should be integrated into the pipeline?

Accepted Answer

AWS CloudFormation Guard. AWS CloudFormation Guard (cfn-guard) is a policy-as-code tool that allows you to define rules to validate CloudFormation templates against security best practices before deployment. It integrates into CI/CD pipelines to enforce compliance with organizational policies, such as ensuring encryption is enabled or public access is restricted, directly addressing the requirement to scan templates for security vulnerabilities.

Answer

Amazon Inspector

Answer

AWS Config

Answer

AWS Shield Advanced

Question 20

A large enterprise uses AWS Organizations with hundreds of accounts. The security team needs to enforce that all accounts have AWS CloudTrail enabled and logs are delivered to a centralized S3 bucket in the management account. The team also wants to ensure that no account can disable CloudTrail or delete the bucket. Which combination of controls meets these requirements?

Accepted Answer

Use a service control policy (SCP) to deny actions that disable CloudTrail or delete the bucket.. Service control policies (SCPs) are the correct mechanism because they allow the management account to centrally restrict permissions across all accounts in the organization. By creating an SCP that denies the `cloudtrail:StopLogging`, `cloudtrail:DeleteTrail`, `cloudtrail:UpdateTrail`, and `s3:DeleteBucket` actions, the security team can prevent any account (including root users) from disabling CloudTrail or deleting the centralized S3 bucket, regardless of IAM policies or direct resource-based policies.

Answer

Enable AWS CloudTrail in the management account and use S3 bucket policies.

Answer

Use an IAM policy in each account to prevent trail modifications.

Answer

Use AWS Config rules to detect and alert on disabled trails.