SCS-C02 Management and Security Governance Practice Test 10 — 15 Questions

Question 1

Which TWO actions should a security engineer take to protect root user credentials? (Select TWO.)

Accepted Answer

Do not create access keys for the root user. AWS strongly recommends that you do not create access keys for the root user. Access keys provide programmatic access to the AWS API, and if compromised, an attacker would have unrestricted access to all AWS resources and billing information. By not creating access keys, you eliminate this high-risk attack vector.

Answer

Use the root user only for billing

Answer

Share the root user credentials with the security team

Answer

Delete the root user account

Question 2

Which TWO are best practices for managing IAM policies? (Select TWO.)

Accepted Answer

Grant least privilege by using specific actions and resources. The principle of least privilege is a foundational security best practice in AWS IAM. By specifying exact actions (e.g., s3:GetObject) and resources (e.g., arn:aws:s3:::example-bucket/*) instead of using wildcards, you minimize the blast radius of a compromised credential or misconfigured policy. This aligns with the AWS Well-Architected Framework's security pillar, which mandates granting only the permissions required to perform a task.

Answer

Use wildcards (*) to simplify policy management

Answer

Use inline policies instead of managed policies

Answer

Use SCPs to enforce permissions

Question 3

Refer to the exhibit. An IAM policy attached to a user allows s3:GetObject only from a specific IP range and denies all S3 actions if not using HTTPS. What happens when the user makes a GET request from IP 10.0.0.5 using HTTP?

Accepted Answer

Denied because the Deny statement matches. The request is denied because the Deny statement's condition (SecureTransport: false) matches HTTP, and Deny overrides Allow. Therefore option C is correct. Option A is incorrect because even if the IP is in the allowed range, the Deny statement applies and denies the request. Option B is incorrect because the condition does match (HTTP triggers Deny). Option D is incorrect because the IP range is irrelevant when a Deny applies.

Answer

Allowed because the IP is in the range

Answer

Allowed because the condition does not match

Answer

Denied because the IP is not in the range

Question 4

Refer to the exhibit. A security engineer runs the AWS CLI command to look up CloudTrail events. What can be concluded from the output?

Accepted Answer

User 'admin' created a trail named 'my-trail' on Jan 15. The output shows that user 'admin' created a trail named 'my-trail' on Jan 15, so option C is correct. Option A is wrong because the event name is 'CreateTrail', not 'DeleteTrail'. Option B is wrong because the trail was created, not deleted, and the user is 'admin'. Option D is wrong because 'CreateTrail' is a write API call, not a read-only call.

Answer

The event name is DeleteTrail

Answer

The trail was deleted by user 'admin'

Answer

The event is a read-only API call

Question 5

Refer to the exhibit. A CloudFormation template creates an S3 bucket. Which security control is NOT enabled by this template?

Accepted Answer

Bucket versioning. The CloudFormation template configures default encryption (AES256), blocks public access, and applies bucket policy restrictions, but it does not include a property to enable versioning. Therefore, versioning remains disabled by default. The correct answer is A because versioning is the security control not enabled by this template.

Answer

Bucket policy restrictions

Answer

Blocking public access

Answer

Server-side encryption

Question 6

A security engineer is designing a solution to enforce that all S3 buckets in an AWS account have server-side encryption enabled. The engineer needs to automatically remediate any non-compliant buckets. Which AWS service should be used to implement this requirement?

Accepted Answer

AWS Config with managed rules and auto-remediation. AWS Config can evaluate resource configurations against rules and automatically remediate non-compliant resources using AWS Systems Manager Automation documents. Option A (Lambda with S3 events) can be used to enforce encryption but is not the primary service for governance at scale and requires custom code. Option C (IAM policy) can prevent creation of buckets without encryption but does not remediate existing non-compliant buckets. Option D (CloudTrail) records API activity but does not enforce configuration requirements.

Answer

AWS Lambda with S3 events

Answer

AWS IAM policy to deny PutBucketEncryption without encryption

Answer

AWS CloudTrail

Question 7

A developer accidentally committed AWS access keys to a public GitHub repository. The security team needs to immediately revoke the compromised keys and ensure that no new keys are created for that IAM user. What is the most effective immediate action?

Accepted Answer

Delete the IAM user and recreate it with new permissions.. Deleting the IAM user is the most effective immediate action because it revokes all access keys associated with that user and prevents any new keys from being created. Option A (rotating) only creates new keys and deactivates old ones but does not eliminate the risk that the old keys may still be active or reused. Option B (changing password) does not affect access keys. Option D (deactivating keys) revokes the compromised keys but does not prevent the user from creating new keys, which could lead to another exposure.

Answer

Rotate the access keys and update the application.

Answer

Change the IAM user's password.

Answer

Deactivate the access keys using the AWS Management Console.

Question 8

A company uses AWS Key Management Service (KMS) to encrypt sensitive data in Amazon S3. The security team needs to ensure that the KMS key can only be used from within the company's VPC and not from the public internet. How can this be achieved?

Accepted Answer

Create a VPC endpoint for KMS and modify the KMS key policy to allow usage only from the specified VPC endpoint.. Using a VPC endpoint for KMS and a key policy that restricts usage to the VPC endpoint prevents public internet access. Option A is wrong because an SCP cannot restrict KMS key usage to a specific VPC; it applies at the account level, not the key policy level. Option B is wrong because CloudTrail only monitors and alerts, it does not enforce access restrictions. Option D is wrong because a bucket policy cannot restrict KMS key usage; the key policy must allow the VPC endpoint.

Answer

Use an SCP to deny kms:Encrypt unless the request comes from the VPC.

Answer

Use AWS CloudTrail to monitor KMS calls and alert if they come from outside the VPC.

Answer

Create a VPC endpoint for KMS and attach a bucket policy that requires the endpoint.

Question 9

A company is using AWS Organizations and wants to delegate the management of IAM policies to a specific member account without granting full administrative access. Which AWS feature allows the management account to delegate policy management to another account?

Accepted Answer

IAM cross-account roles. IAM cross-account roles allow the management account to delegate permissions to a member account by creating a role in the member account that the management account can assume. This enables the member account to manage IAM policies without granting full administrative access. Option A is wrong because AWS Resource Access Manager shares resources, not IAM management. Option B is wrong because AWS CloudFormation StackSets automate resource deployment across accounts, not delegation of policy management. Option C is wrong because AWS Single Sign-On focuses on user authentication and authorization, not IAM policy delegation.

Answer

AWS Resource Access Manager

Answer

AWS CloudFormation StackSets

Answer

AWS Single Sign-On

Question 10

Which TWO AWS services can be used to centrally manage and audit permissions across multiple AWS accounts? (Choose two.)

Accepted Answer

AWS Organizations. AWS Organizations provides a central view of all accounts and can apply SCPs. IAM Access Analyzer analyzes resource policies across accounts to identify public or cross-account access. AWS Config evaluates resource configurations but does not centrally manage permissions. AWS CloudTrail logs API calls but does not manage permissions. AWS SSO manages user access but not resource permissions.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

AWS Single Sign-On

Question 11

Which THREE steps should a security engineer take to remediate a compromised IAM user whose access keys were exposed? (Choose three.)

Accepted Answer

Deactivate the access keys.. Immediately deactivate or delete the access keys to stop usage. Rotate the keys if the user still needs access, but the old keys must be deactivated. Remove the compromised user from any groups to limit permissions. Changing the password does not affect access keys. Creating a new user with the same permissions is unnecessary if the user can be cleaned. Reviewing CloudTrail logs is important but is an investigation step, not immediate remediation.

Answer

Create a new IAM user with the same permissions.

Answer

Change the IAM user's password.

Question 12

Which TWO AWS services can be used to enforce that Amazon S3 buckets are not publicly accessible? (Choose two.)

Accepted Answer

AWS Organizations service control policies (SCPs). AWS Config can evaluate bucket policies against a rule and trigger remediation. SCPs in AWS Organizations can deny actions that make buckets public. AWS CloudTrail only logs. IAM Access Analyzer identifies public access but does not enforce. Amazon Macie discovers sensitive data.

Answer

IAM Access Analyzer

Answer

AWS CloudTrail

Answer

Amazon Macie

Question 13

A security engineer runs the get-account-authorization-details command and sees the exhibit output. The engineer wants to ensure that the 'admin' user does not have administrative access. Which steps should be taken?

Accepted Answer

Detach the AdministratorAccess policy from the 'admin' user and attach a custom policy with read-only permissions.. The 'admin' user has the AdministratorAccess policy attached, granting full administrative rights. To remove administrative access, the engineer should detach this policy and attach a custom policy with read-only permissions (Option C). Option A is unnecessary because deleting the user is not required; detaching the policy is sufficient. Option B is incorrect because modifying the AdministratorAccess policy to deny all actions would still leave the policy attached, potentially causing confusion or unintended effects; better to detach it. Option D is wrong because attaching a permissions boundary does not remove the existing AdministratorAccess policy; the user would still have administrative access via that policy.

Answer

Delete the 'admin' user and create a new user with limited permissions.

Answer

Modify the AdministratorAccess policy to deny all actions.

Answer

Attach a permissions boundary that denies all actions.

Question 14

A company uses AWS Organizations with multiple accounts. The security team needs to ensure that all S3 buckets across the organization are encrypted with AWS KMS keys. What is the MOST effective way to enforce this requirement?

Accepted Answer

Create a service control policy (SCP) that denies any S3 bucket creation or modification without encryption enabled.. The most effective because an SCP applied at the root OU can deny any S3 bucket creation or modification without encryption, enforcing the requirement across all accounts. Option A is incorrect because CloudTrail only logs events and does not enforce encryption. Option B is incorrect because an IAM role within each account cannot be enforced across the entire organization; SCPs are designed for organization-wide enforcement. Option C is incorrect because AWS Config rules can detect noncompliant buckets but do not prevent their creation; they provide reactive detection, not proactive enforcement.

Answer

Use AWS CloudTrail to log all bucket creation events and alert the security team.

Answer

Create an IAM role in each account that denies s3:PutBucketEncryption if encryption is not set.

Answer

Use AWS Config rules to detect unencrypted buckets and trigger a Lambda function to encrypt them.

Question 15

A security engineer is designing a centralized logging solution for a multi-account AWS environment using AWS Organizations. The solution must ensure that all CloudTrail logs from all accounts are delivered to a single S3 bucket in the security account. Additionally, the logs must be encrypted with a KMS key that is managed by the security account. Which combination of steps is required?

Accepted Answer

Create a trail in each account, each delivering to the same S3 bucket. Use a bucket policy to allow cross-account writes. Use a single KMS key with appropriate key policy.. It uses individual trails in each account, all configured to deliver to the same centralized S3 bucket in the security account. A bucket policy can grant CloudTrail write permissions from all accounts, and a single KMS key (managed by the security account) with appropriate key policy ensures encryption. This approach meets the centralized logging and encryption requirements without violating organization trail constraints. Option B is incorrect because AWS Config does not deliver CloudTrail logs, and CloudWatch Logs streaming is not the required solution. Option C is incorrect because the trail is created in the management account but delivers to a bucket in the management account, not the security account, and it uses default encryption instead of a customer-managed KMS key from the security account. Option D is incorrect because organization trails can only be created in the management account; creating one in the security account is not allowed.

Answer

Use AWS Config to deliver logs to a central bucket. Enable CloudWatch Logs in each account and stream to the security account.

Answer

Create a trail in the management account with organization trail enabled, delivering to a bucket in the management account. Use KMS default encryption.

Answer

Create a trail in the security account with organization trail enabled, delivering to a bucket in the security account. Configure bucket policy and KMS key policy to allow CloudTrail and S3 from all accounts.