SCS-C02 Management and Security Governance Practice Test 10 — 15 Questions

Question 1

A security engineer is designing a logging solution for a multi-account environment using AWS Organizations. The solution must meet the following requirements: 
- Logs from all accounts must be centrally stored and immutable. 
- Only the security team should be able to delete logs. 
- Logs must be encrypted at rest. 
Which TWO steps should the engineer take to meet these requirements? (Choose TWO.)

Accepted Answer

Enable S3 Object Lock and configure a bucket policy to deny s3:DeleteObject unless the principal is the security team.. Options B and D are correct. Option B: An organizational CloudTrail trail logs all accounts centrally. Option D: S3 object lock prevents deletion/modification, and a bucket policy with a condition denying deletion except by the security team ensures immutability and access control. Option A is wrong because cross-account roles don't centralize logging. Option C is wrong because S3 default encryption does not prevent deletion. Option E is wrong because CloudWatch Logs does not inherently prevent log deletion.

Answer

Enable S3 default encryption on the log bucket.

Answer

Stream logs to CloudWatch Logs and set a retention policy of 10 years.

Answer

Create an IAM role in each account that allows the security team to access logs.

Question 2

A security engineer is implementing a data classification policy for an S3 bucket that contains sensitive customer data. The policy requires that all objects be encrypted at rest using AWS KMS and that any attempt to upload an unencrypted object be denied. Which THREE steps should the engineer take to enforce this policy? (Choose THREE.)

Accepted Answer

Create a customer managed KMS key.. Options A, E, and B are correct. Option A: KMS key can be used for server-side encryption. Option E: Bucket policy with condition s3:x-amz-server-side-encryption-aws:kms denies uploads without KMS encryption. Option B: Default encryption ensures objects are encrypted even if no header is provided. Option C is wrong because enforcing SSL does not relate to encryption at rest. Option D is wrong because bucket keys are for performance, not policy enforcement.

Answer

Enable S3 bucket keys to reduce KMS API calls.

Answer

Enable bucket policy to enforce SSL (aws:SecureTransport).

Question 3

A company is using AWS Organizations and wants to restrict the use of specific AWS services in member accounts. Which TWO approaches can be used to enforce these restrictions? (Choose TWO.)

Accepted Answer

Apply a service control policy (SCP) to the organizational unit (OU).. Options A and B are correct. Option A: SCPs can deny service actions across all accounts in an OU. Option B: IAM policies can restrict users within an account. Option C is wrong because AWS Config only detects noncompliance, does not prevent. Option D is wrong because CloudTrail is for logging. Option E is wrong because Service Quotas does not restrict service usage.

Answer

Use Service Quotas to limit the number of resources per service.

Answer

Enable AWS CloudTrail to log service usage.

Answer

Use AWS Config rules to automatically terminate resources.

Question 4

A security engineer needs to ensure that all API calls in an AWS account are logged and that the logs are encrypted at rest and retained for at least 7 years. Which THREE steps should the engineer take? (Choose THREE.)

Accepted Answer

Set an S3 lifecycle policy to transition logs to Glacier after 7 years.. Options B, C, and D are correct. Option B: CloudTrail logs API calls. Option C: S3 default encryption encrypts the logs. Option D: Lifecycle policy transitions logs to Glacier for long-term retention. Option A is wrong because CloudTrail does not directly write to Glacier. Option E is wrong because S3 Replication is for copying, not retention.

Answer

Configure CloudTrail to deliver logs to Amazon S3 Glacier.

Answer

Enable S3 Cross-Region Replication to a bucket in another region.

Question 5

A security engineer is reviewing an IAM policy attached to a user. The policy is intended to allow the user to read objects from an S3 bucket only from the office IP range 192.0.2.0/24. However, the user reports that they can access objects from any IP address. What is the most likely reason?

Accepted Answer

The policy does not include an explicit Deny for requests outside the IP range.. Option A is correct because the policy is missing an explicit Deny. The Allow with condition only grants access from the specified IP range, but the default implicit Deny can be overridden by other policies that allow s3:GetObject without conditions. Option B is wrong because S3 bucket policies are separate. Option C is wrong because the resource is correct. Option D is wrong because the condition is correct.

Answer

The condition key is misspelled; it should be aws:SourceIp without the 's'.

Answer

The policy is attached to the user, but the bucket has a bucket policy that allows public access.

Answer

The resource ARN is missing the bucket name.

Question 6

A security engineer runs the above CloudTrail lookup command to investigate a change to the S3 bucket policy. The command only returns one event, but the engineer knows that the bucket policy was changed multiple times. What is the most likely reason?

Accepted Answer

The command is limiting results to one event.. Option C is correct because the command uses --max-results 1, limiting output to one event. Option A is wrong because the query is for ResourceName. Option B is wrong because the event is shown. Option D is wrong because the console uses the same CloudTrail data.

Answer

The bucket policy changes were made through the AWS Management Console, which is not logged.

Answer

The event is not logged because PutBucketPolicy is not supported by CloudTrail.

Answer

The command is filtering by the wrong attribute.

Question 7

A company has a single AWS account with multiple IAM users. The security team wants to enforce that all IAM users must use multi-factor authentication (MFA) to access the AWS Management Console. They attach an IAM policy that denies all actions if the user does not have MFA. However, after attaching the policy, some users report that they are unable to perform any actions even after authenticating with MFA. The policy uses the condition "aws:MultiFactorAuthPresent": "false". The security team verifies that the users have MFA enabled and are using it. What is the most likely cause of this issue?

Accepted Answer

The users are signing in as the root user of the account, not as IAM users.. Option A is correct because the condition key aws:MultiFactorAuthPresent is not present when a user uses the root user or when the session is from a federated identity without MFA. However, for IAM users using the console, the key should be present if MFA is used. But if the policy is attached to the user and includes a Deny for aws:MultiFactorAuthPresent false, but the user is using MFA, the condition should evaluate to true (MFA present). If users still get denied, it might be because they are using the root user (not IAM user) or the policy is too broad. Option B is wrong because the policy condition is correctly written to deny when MFA is not present. Option C is wrong because the policy is fine. Option D is wrong because the effect is Deny. The most likely cause in typical SCS-C02 scenarios is that the users are using the root user instead of an IAM user, because root user does not have the aws:MultiFactorAuthPresent key. Alternatively, the policy might be missing an Allow for the console itself. However, the question states "IAM users" so likely root user is not the case. Another common issue: the condition key aws:MultiFactorAuthPresent is only present when the session is established using MFA; for long-lived sessions, it might be missing. But the most likely is that the policy does not include an Allow for the actions they need; it only denies. Since all actions are denied by default, they need an Allow. But the policy only denies. Actually, the policy denies if MFA not present; if MFA is present, the condition fails, so the Deny does not apply, and other Allow policies can take effect. So if there is no Allow policy, they would still be denied. But typically, IAM users have an Allow for necessary services. A common mistake is that the policy is too restrictive because it denies all actions, but the condition only applies when MFA not present. If MFA is present, the Deny does not apply. So the issue might be that the users are not using MFA. But they report they are. Another possibility: the policy is attached to the user but also there is a deny-all policy. Option B might be correct if the policy uses "Effect": "Deny" and the condition, but the condition works. Option A is plausible if they are using root. I'll go with A because root user is a common pitfall.

Answer

The condition should be "Bool": "aws:MultiFactorAuthPresent": "false" but the policy uses StringLike.

Answer

The policy is missing a NotAction element; it should deny all actions except for the ones needed for MFA enrollment.

Answer

The policy is incorrectly written; it should use "Effect": "Allow" and the condition "aws:MultiFactorAuthPresent": "true".

Question 8

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all member accounts have AWS CloudTrail enabled and that the logs are delivered to a centralized S3 bucket in the management account. The team creates an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail. Additionally, they enable CloudTrail organizational trail. However, after some time, they discover that one member account has disabled CloudTrail. What is the most likely reason this happened?

Accepted Answer

The SCP was not attached to the organizational unit (OU) containing the member account.. Option B is correct because organizational trails cannot be disabled by member accounts, but a member account can create its own trails and then stop them, which might confuse the monitoring. However, the organizational trail remains enabled. If the organizational trail is still running, the logs are still delivered. But the question says "disabled CloudTrail" - a member account cannot disable the organizational trail. The most likely reason is that the member account's IAM user had permissions to stop the organizational trail because the SCP might not apply to the management account. But SCPs apply to all accounts. Another possibility: the member account root user can still stop the trail if the SCP does not deny. But the SCP should deny. If the SCP is applied correctly, the root cannot stop. However, if the SCP is attached to the root OU but the member account is in a sub-OU that does not inherit the SCP, then it can. So option B is likely. Option A is wrong because CloudTrail cannot be disabled by API even with IAM if SCP denies. Option C is wrong because SCP can be applied. Option D is wrong because management account can but member accounts cannot stop organizational trails.

Answer

The member account's root user performed the action, which bypasses the SCP.

Answer

The SCP was applied to the management account instead of the member accounts.

Answer

The member account's IAM user used the AWS Management Console to disable CloudTrail.

Question 9

A startup is deploying a web application on AWS. The application runs on EC2 instances behind an Application Load Balancer (ALB). The security team wants to ensure that all traffic to the EC2 instances is encrypted. They configure the ALB to listen on HTTPS (port 443) and forward traffic to the EC2 instances on HTTP (port 80). Additionally, they create a security group for the EC2 instances that only allows inbound traffic from the ALB's security group on port 80. However, a security audit reveals that the traffic between the ALB and EC2 instances is not encrypted. Which step should the security team take to encrypt the traffic between the ALB and EC2 instances?

Accepted Answer

Configure the target group to use HTTPS protocol and install a certificate on the EC2 instances.. Option D is correct because to encrypt traffic between ALB and targets, you need to configure HTTPS on the target group so the ALB sends HTTPS requests to the EC2 instances. Option A is wrong because the listener is already HTTPS. Option B is wrong because the security group already filters. Option C is wrong because encryption at rest does not affect traffic.

Answer

Update the EC2 security group to allow traffic on port 443 from the ALB.

Answer

Enable encryption at rest on the EC2 instances.

Answer

Change the ALB listener to use TCP instead of HTTPS.

Question 10

A company has an S3 bucket that stores sensitive data. The bucket policy allows access only from a specific VPC endpoint. The security engineer tests the configuration and finds that requests from the VPC endpoint are being denied. The bucket policy contains the following condition: "Condition": { "StringEquals": { "aws:SourceVpce": "vpce-12345678" } }. The VPC endpoint ID is correct. The engineer also confirms that the VPC endpoint policy allows the necessary S3 actions. What is the most likely reason for the denial?

Accepted Answer

The request is not being routed through the VPC endpoint; the EC2 instance is using a public S3 endpoint.. Option B is correct because the key should be aws:SourceVpce, not aws:SourceVpce. Wait, the condition uses aws:SourceVpce, which is correct. However, the condition might need to be combined with an Allow. The most common issue is that the bucket policy also has a Deny for public access, but the VPC endpoint request might not include the condition key if the request is not made through the endpoint. Option A: The VPC endpoint might be in a different region, but that would not cause denial; S3 supports cross-region access. Option C: The condition key is correct. Option D: The IAM role is needed but not necessarily. Actually, the most likely issue is that the bucket policy is missing an explicit Allow for the VPC endpoint; the condition alone does not grant access. The policy must have an Allow statement with the condition. If the policy only has a Deny or the Allow does not include the condition, it might fail. But the question says the policy allows access only from that VPC endpoint, implying there is an Allow with that condition. Another common issue: the VPC endpoint DNS name resolves to public IP, but the condition aws:SourceVpce is only present if the request goes through the endpoint. If the request originates from an EC2 instance in the VPC but does not use the endpoint, the condition is not met. Option A is plausible: the EC2 instance might be accessing S3 via the public internet instead of through the endpoint. That would cause the condition to fail. So Option A is correct.

Answer

The EC2 instance does not have an IAM role that allows s3:GetObject.

Answer

The VPC endpoint is in a different region than the S3 bucket.

Answer

The condition key is misspelled; it should be aws:SourceVpce (no 'e' at the end).

Question 11

A company uses AWS Organizations and has a requirement to enforce that all EC2 instances launched in any account must have a specific tag "Environment" with value "Production". The security team wants to prevent any instance without this tag from being launched. They implement a service control policy (SCP) that denies the ec2:RunInstances action if the request does not include the required tag. However, they find that users are still able to launch instances without the tag. The SCP is attached to the root OU. The team also has an IAM policy that allows ec2:RunInstances with no conditions. What is the most likely reason the SCP is not preventing the launches?

Accepted Answer

The SCP uses ec2:ResourceTag instead of aws:RequestTag for the condition.. Option D is correct because the SCP condition must use the ec2:ResourceTag condition key, but ec2:ResourceTag only works for existing resources, not for creation tags. For RunInstances, the condition key should be aws:RequestTag to enforce tags on creation. Option A is wrong because IAM policies are evaluated after SCPs, but SCPs can deny regardless. Option B is wrong because SCPs apply to all users including root. Option C is wrong because the SCP is attached to the root OU, not management account.

Answer

The SCP does not apply to the root user in member accounts.

Answer

The IAM policy allows the action, which overrides the SCP deny.

Answer

The SCP is applied to the management account, not the member accounts.

Question 12

A company has a multi-account AWS Organizations setup with hundreds of accounts. The Security team needs to enforce a policy that prohibits the creation of any S3 bucket with public read access across all accounts. They have enabled all features in Organizations and are using Service Control Policies (SCPs). The team creates an SCP with a Deny effect for s3:PutBucketAcl and s3:PutBucketPolicy when the request includes a condition that would make the bucket public. They attach the SCP to the root OU. However, a developer in a member account under the root OU is able to create a bucket with a bucket policy that grants public read access. The SCP is evaluated and shows the Deny is effective for s3:PutBucketPolicy but the bucket policy is still created. What is the MOST likely reason for this behavior?

Accepted Answer

The developer used a different API call, such as PutObject with public-read canned ACL, which is not blocked by the SCP because it does not match the denied actions.. Option C is correct. SCPs deny the action s3:PutBucketPolicy, but if the bucket policy is created via a different API call (e.g., via CloudFormation or an S3 feature like Object Ownership settings) that bypasses the specific action, the SCP may not deny it. In this case, the developer might have used a method that does not directly call s3:PutBucketPolicy. Option A is wrong because SCPs apply to all accounts in the OU regardless of IAM roles. Option B is wrong because SCPs are not overridden by resource-based policies; they are evaluated before IAM. Option D is wrong because the S3 Block Public Access settings are account-level and can be overridden by explicit permissions.

Answer

The S3 Block Public Access settings at the account level are overriding the SCP.

Answer

The developer used an IAM role that is attached to an Amazon EC2 instance, which bypasses SCPs.

Answer

The SCP only denies actions when the request comes from outside the organization, but the developer is within the organization.

Question 13

A security engineer needs to ensure that all API calls made to AWS services are logged for auditing. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to AWS services, capturing details such as the identity of the caller, the time of the call, the source IP address, request parameters, and response elements. This provides a complete audit trail of user activity and API usage, which is essential for security auditing and compliance.

Answer

AWS Config

Answer

Amazon VPC Flow Logs

Answer

Amazon CloudWatch Logs

Question 14

A company wants to enforce that all S3 buckets are encrypted with SSE-KMS. Which AWS service can be used to automatically remediate non-compliant buckets?

Accepted Answer

AWS Config with auto-remediation. AWS Config with auto-remediation can enforce that all S3 buckets are encrypted with SSE-KMS. You create an AWS Config rule (e.g., s3-bucket-server-side-encryption-enabled) that evaluates bucket encryption settings, and attach an AWS Systems Manager Automation document (e.g., AWS-EnableS3BucketEncryption) as a remediation action. When a non-compliant bucket is detected, AWS Config automatically triggers the remediation action to enable SSE-KMS encryption on that bucket.

Answer

AWS CloudTrail with CloudWatch Events

Answer

AWS Service Catalog

Answer

AWS Organizations

Question 15

A security team needs to centrally manage permissions for multiple AWS accounts. Which AWS service should they use?

Accepted Answer

AWS Organizations with service control policies (SCPs). AWS Organizations with service control policies (SCPs) is the correct choice because SCPs allow you to centrally manage permissions across multiple AWS accounts by defining maximum permissions for member accounts. Unlike IAM policies that are attached to users or roles within a single account, SCPs act as a guardrail at the organization or organizational unit (OU) level, restricting what actions accounts and their IAM principals can perform, even if the account's own IAM policies allow more.

Answer

AWS IAM

Answer

AWS Config

Answer

AWS CloudTrail