SCS-C02 Management and Security Governance Practice Test 10 — 15 Questions

Question 1

Drag and drop the steps to set up a secure S3 bucket with encryption and access control in the correct order.

Accepted Answer

Enable default encryption → Block public access → Attach bucket policy → Enable versioning → Enable access logging. Secure S3 bucket requires encryption, public access block, bucket policy, versioning, and access logging.

Answer

Block public access → Enable default encryption → Attach bucket policy → Enable versioning → Enable access logging

Answer

Enable default encryption → Block public access → Enable versioning → Attach bucket policy → Enable access logging

Answer

Enable default encryption → Enable versioning → Block public access → Attach bucket policy → Enable access logging

Question 2

Match each AWS security control to its category.

Accepted Answer

Security Group: A stateful firewall that controls inbound and outbound traffic at the instance level.. Security Groups are stateful instance-level firewalls, Network ACLs are stateless subnet-level firewalls. Common confusions involve mixing statefulness and level of operation.

Answer

Security Group: A stateless firewall that controls traffic at the subnet level.

Answer

AWS WAF: A stateful firewall that controls traffic at the instance level.

Question 3

A security engineer notices that an IAM role in the production account is being assumed by a user from another AWS account, which violates the principle of least privilege. The role's trust policy allows the root user of the external account. What is the MOST secure way to restrict access to only a specific user in the external account?

Accepted Answer

Modify the trust policy to specify the exact user ARN instead of the root ARN.. Modifying the trust policy to include the specific user ARN is the most direct and secure approach. Option A is incorrect because SCPs do not affect cross-account access. Option B is incorrect because IAM policies on the role do not restrict who can assume it. Option D is incorrect because the external account's IAM policies do not control trust.

Answer

Apply an SCP to the external account to deny the sts:AssumeRole action.

Answer

Create an IAM policy in the external account that denies sts:AssumeRole for the role.

Answer

Add a condition to the role's permissions policy requiring a specific source IP.

Question 4

A company wants to automatically detect and remediate S3 buckets that are publicly accessible. Which AWS service can be used to evaluate bucket policies against a defined rule and trigger an automated response?

Accepted Answer

AWS Config. AWS Config evaluates resource configurations against rules and can trigger automatic remediation via SSM Automation documents. For S3 public access, the managed rule s3-bucket-public-read-prohibited or s3-bucket-public-write-prohibited can detect noncompliant buckets and invoke a remediation action to block public access.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

Amazon Inspector

Question 5

A company uses AWS Organizations with all features enabled. The security team wants to ensure that no IAM users are created in any account. Which approach should be used?

Accepted Answer

Attach a service control policy (SCP) that denies iam:CreateUser.. Service Control Policies (SCPs) in AWS Organizations allow you to centrally restrict permissions across all accounts in the organization. By attaching an SCP that denies the `iam:CreateUser` action, you prevent the creation of IAM users in any member account, regardless of any IAM policies attached to users or roles within those accounts. This provides a guardrail that cannot be overridden by account administrators, ensuring compliance with the security team's requirement.

Answer

Use AWS Config rules to detect IAM users and notify via SNS.

Answer

Enable AWS CloudTrail Insights to detect anomalous IAM activity.

Answer

Apply an IAM policy to the root user to deny iam:CreateUser.

Question 6

A company's security team needs to enforce encryption at rest for all RDS instances in the production account. They have enabled mandatory encryption using a service control policy. What else must be done to ensure existing unencrypted RDS instances are encrypted?

Accepted Answer

Create a snapshot of the unencrypted instance, copy the snapshot with encryption enabled, and restore the encrypted snapshot to a new DB instance.. RDS does not support directly enabling encryption on an existing unencrypted instance. The only way to encrypt an existing unencrypted RDS instance is to take a snapshot of it, copy the snapshot with encryption enabled, and restore the encrypted snapshot to a new DB instance. Options A, C, and D are incorrect: A: Attaching a new KMS key policy to the RDS instance does not encrypt the instance; encryption is applied at snapshot creation. C: Enabling encryption on the DB subnet group does not affect existing instances; it only applies to new instances. D: Modifying the RDS instance via the console does not allow enabling encryption on an existing instance; encryption can only be enabled at creation or via snapshot copy.

Answer

Attach a new KMS key policy to the RDS instance.

Answer

Enable encryption on the DB subnet group and reboot the instance.

Answer

Modify the RDS instance to enable encryption using the AWS Console.

Question 7

A company needs to audit all changes to IAM policies in their AWS account for compliance. Which AWS service should be enabled to record the API calls that modify IAM policies?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity in an AWS account, including all calls that modify IAM policies such as CreatePolicy, PutRolePolicy, AttachRolePolicy, and DeletePolicy. Enabling CloudTrail (which is on by default for management events) provides the audit trail of who made the change, when, and from where. This is the correct service for auditing IAM policy modifications.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

VPC Flow Logs

Question 8

A company wants to centrally manage and enforce backup policies for all EC2 instances across multiple AWS accounts. Which AWS service should be used?

Accepted Answer

AWS Backup. AWS Backup is the correct service because it provides a centralized, policy-based solution to define and enforce backup policies across multiple AWS accounts and regions. It integrates with AWS Organizations to manage backups for EC2 instances and other supported resources, ensuring compliance with governance requirements without needing custom scripts or manual processes.

Answer

AWS Config

Answer

AWS CloudFormation StackSets

Answer

AWS Systems Manager

Question 9

A company uses AWS Organizations and wants to ensure that no member account can disable AWS CloudTrail or delete CloudTrail log files from S3. Which TWO actions should the security team take? (Choose TWO.)

Accepted Answer

Create an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail.. Option A is correct because an AWS Organizations service control policy (SCP) attached to member accounts can explicitly deny the CloudTrail control-plane actions cloudtrail:StopLogging and cloudtrail:DeleteTrail, which are exactly the API calls used to disable a trail, and SCPs are the standard guardrail mechanism for enforcing such restrictions across all accounts in the organization. Option D is correct because a bucket policy on the CloudTrail log bucket that denies s3:DeleteObject (and ideally s3:DeleteObjectVersion) prevents any principal, including account administrators, from deleting the log objects, directly satisfying the requirement to protect the log files. Option B is not correct because MFA Delete only requires additional authentication for deleting object versions; it does not by itself prevent deletion and is not the SCP/bucket-policy guardrail the scenario requires. Option C is not correct because SCPs do not apply to the management account, so applying one there would not prevent disabling CloudTrail in member accounts. Option E is not correct because an IAM role granting write-only permissions to CloudTrail does not stop member accounts from calling StopLogging/DeleteTrail or deleting S3 log objects.

Answer

Enable MFA delete on the S3 bucket that stores CloudTrail logs.

Answer

Apply an SCP to the management account to prevent disabling CloudTrail.

Answer

Create an IAM role for CloudTrail with permissions to write logs only.

Question 10

A security team needs to ensure that all IAM users in a production account use multi-factor authentication (MFA) before accessing the AWS Management Console. Which TWO steps should be taken? (Choose TWO.)

Accepted Answer

Enable MFA for each IAM user.. To enforce MFA for console access, you need to enable MFA for each user (B) and attach an IAM policy that denies console access if MFA is not present (C). Option E is incorrect because the IAM password policy cannot require MFA; it only requires MFA for password changes, not console login. Option A is incorrect because AWS Config rules can detect users without MFA but cannot enforce it. Option D is incorrect because SCPs apply to accounts, not individual user console access; they cannot directly require MFA for console login.

Answer

Use AWS Config rules to detect users without MFA.

Answer

Apply an SCP that requires MFA for console access.

Answer

Configure an IAM password policy to require MFA.

Question 11

A company uses AWS Organizations with multiple accounts. The security team needs to ensure that no account can disable a specific security service, such as AWS Config, across all accounts. Which approach should be used?

Accepted Answer

Attach a service control policy (SCP) that denies the action at the root organization level. A service control policy (SCP) in AWS Organizations can be attached to the root, OU, or account level to set permission guardrails. An SCP that denies the action (e.g., config:StopConfigurationRecorder or config:DeleteConfigurationRecorder) at the root organization level applies to all accounts and cannot be overridden by account administrators, ensuring the security service cannot be disabled.

Answer

Create an IAM role with a deny policy for the action and attach it to all users

Answer

Create an AWS Config rule to check for the action and automatically remediate

Answer

Enable AWS CloudTrail and create a metric filter to alert on the action

Question 12

A company wants to centrally manage IAM users and allow them to access multiple AWS accounts using a single set of credentials. Which AWS service should be used?

Accepted Answer

AWS IAM Identity Center (AWS SSO). AWS IAM Identity Center (formerly AWS SSO) is the correct service because it provides a centralized identity source that allows users to sign in once with a single set of credentials and then access multiple AWS accounts and business applications. It integrates with AWS Organizations to automatically manage permissions across accounts, eliminating the need for separate IAM users in each account.

Answer

IAM roles with cross-account trust

Answer

AWS Organizations consolidated billing

Answer

Amazon Cognito user pools

Question 13

A company wants to automate the enforcement of security best practices across all AWS accounts. Which AWS service provides pre-built rules for security compliance?

Accepted Answer

AWS Security Hub. AWS Security Hub is the correct answer because it provides a comprehensive view of security alerts and compliance status across AWS accounts, and it includes pre-built security standards and automated compliance checks based on frameworks such as the AWS Foundational Security Best Practices (FSBP), CIS AWS Foundations Benchmark, and PCI DSS. These pre-built rules allow you to automate the enforcement of security best practices without manual configuration.

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Answer

AWS Config

Question 14

A security engineer discovers that an IAM user has a policy that allows them to delete any S3 bucket in the account. The engineer wants to audit all delete actions performed by this user. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity in an AWS account, including S3 DeleteBucket and DeleteObject calls, capturing the identity of the caller, source IP, timestamp, and request parameters. To audit all delete actions performed by a specific IAM user, the engineer enables CloudTrail (ideally an organization trail or a trail with S3 log delivery) and filters events by the user's ARN and event names. CloudTrail is the authoritative audit log for AWS API actions.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 15

A company uses AWS Organizations and wants to restrict the use of specific AWS services in member accounts. For example, they want to block the use of Amazon Redshift. Which policy type should be used?

Accepted Answer

Service control policies (SCPs). Service control policies (SCPs) are used in AWS Organizations to centrally manage permissions across multiple accounts. They can restrict which AWS services and actions are available to member accounts. To block the use of Amazon Redshift in member accounts, an SCP can be applied to the organizational units or accounts that denies the redshift:* actions.

Answer

IAM permissions boundaries

Answer

IAM identity-based policies

Answer

S3 bucket policies