SCS-C02 Management and Security Governance Practice Test 11 — 15 Questions

Question 1

A company wants to automate the enforcement of security best practices across all AWS accounts in an organization. The solution should automatically remediate noncompliant resources. Which AWS service should be used to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Config rules with auto-remediation. AWS Config rules can automatically remediate noncompliant resources using AWS Systems Manager Automation documents or AWS Lambda functions. Option A is wrong because AWS Organizations service control policies (SCPs) provide preventive controls but cannot automatically remediate resources. Option B is wrong because AWS IAM Access Analyzer analyzes resource policies for unintended access, not for enforcing security best practices. Option C is wrong because Amazon GuardDuty is a threat detection service, not a compliance automation tool.

Answer

AWS Organizations service control policies (SCPs)

Answer

AWS IAM Access Analyzer

Answer

Amazon GuardDuty

Question 2

A company wants to centralize the management of IAM users and groups for multiple AWS accounts. Which AWS service should be used to allow users to access multiple accounts with a single set of credentials?

Accepted Answer

AWS IAM Identity Center (AWS SSO). AWS IAM Identity Center (successor to AWS SSO) is the correct service for centralizing user management across multiple AWS accounts. It enables single sign-on (SSO) so that users can access multiple accounts with one set of credentials. Option A (AWS Organizations) helps manage accounts and policies but does not provide SSO. Option B (IAM users in each account) is decentralized and does not allow single sign-on. Option C (Amazon Cognito) is designed for customer-facing identity, not for AWS account access.

Answer

AWS Organizations

Answer

IAM users and groups in each account

Answer

Amazon Cognito

Question 3

A company is using AWS Organizations and wants to delegate the administration of certain accounts to different teams. For example, the finance team should be able to manage billing-related accounts, but not development accounts. Which AWS feature allows this type of delegation?

Accepted Answer

AWS Organizations delegated administrator. AWS Organizations delegated administrator allows you to register member accounts as delegated administrators for specific services, giving them limited administrative permissions. Option B is wrong because AWS IAM Identity Center (AWS SSO) provides user access management across accounts, not delegation of account administration. Option C is wrong because service control policies (SCPs) are used to restrict permissions, not to delegate administration. Option D is wrong because IAM roles allow cross-account access for users, but do not provide the same level of account delegation as delegated administrator.

Answer

AWS IAM Identity Center (AWS SSO)

Answer

Service control policies (SCPs)

Answer

IAM roles in each account

Question 4

A company wants to receive real-time notifications when an IAM user in their AWS account performs a console login. Which AWS service should be used to monitor and alert on this activity?

Accepted Answer

AWS CloudTrail and Amazon EventBridge. AWS CloudTrail logs console login events, and Amazon EventBridge can be used to create rules that trigger notifications (e.g., via SNS) in real-time when such events occur. Option A is incorrect because IAM does not provide monitoring capabilities. Option B is incorrect because AWS Config is designed for tracking resource configuration changes, not API call activity. Option C is incorrect because Trusted Advisor offers best-practice recommendations and does not provide real-time monitoring of login events.

Answer

AWS IAM

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 5

A company is implementing a data classification policy using AWS. The policy requires that all S3 objects containing personally identifiable information (PII) be automatically tagged and encrypted. Which THREE services should be used together to meet this requirement?

Accepted Answer

Amazon Macie. Options A, B, and D are correct. Option A: Amazon Macie can automatically discover and classify PII in S3. Option B: Amazon S3 default encryption ensures objects are encrypted. Option D: AWS Lambda can process Macie findings and apply tags. Option C is wrong because AWS Config does not classify data. Option E is wrong because CloudTrail is for logging.

Answer

AWS Config

Answer

AWS CloudTrail

Question 6

A company is using AWS Organizations to manage multiple accounts. The security team wants to ensure that no root user credentials are used for any account. Which TWO actions should be taken to enforce this?

Accepted Answer

Create a service control policy (SCP) that denies all actions for the root user.. A service control policy (SCP) can be applied to the root organizational unit to deny all actions for the root user, effectively preventing any use of the root user credentials. Option E is correct because enabling multi-factor authentication (MFA) on the root user adds a layer of security, making it more difficult to compromise the root account even if credentials are known. Option A is incorrect because the root user cannot be deleted; it is a permanent account for an AWS organization. Option B is incorrect because AWS Config rules can detect root user activity but cannot prevent it; detection is not enforcement. Option C is incorrect because IAM roles cannot restrict the root user; the root user is not subject to IAM policies.

Answer

Delete the root user from all accounts.

Answer

Use AWS Config rules to detect root user activity.

Answer

Create an IAM role that prevents root user actions.

Question 7

A security engineer has attached the above IAM policy to a user. The user reports that they cannot upload objects to the S3 bucket from their office, which has a public IP address of 198.51.100.50. What is the MOST likely reason for the failure?

Accepted Answer

The policy restricts access to the 10.0.0.0/8 IP range, but the user's IP is outside that range.. The IAM policy includes a condition that restricts access to the 10.0.0.0/8 IP range. The user's office IP address is 198.51.100.50, which is outside that range, so the s3:PutObject action is denied. Option A is incorrect because the policy does specify the bucket resource (arn:aws:s3:::example-bucket/*) for the PutObject action. Option B is incorrect because the policy is attached to the user. Option D is incorrect because the policy does allow the s3:PutObject action.

Answer

The policy does not specify the bucket resource for the PutObject action.

Answer

The policy is not attached to the user.

Answer

The policy does not allow the s3:PutObject action.

Question 8

A security engineer is auditing the AWS Organizations structure. The engineer notices that the 'Management' account (111111111111) has a status of 'ACTIVE' and joined method 'CREATED'. The engineer is concerned about potential security risks. Which action should the engineer take to improve security?

Accepted Answer

Enable multi-factor authentication (MFA) for the root user of the management account.. The management account in AWS Organizations is the account that created the organization and has full administrative access. It is critical to secure this account, and enabling multi-factor authentication (MFA) for the root user is a fundamental security best practice. Option A is incorrect because you cannot remove the management account from the organization; it is the foundational account. Option B is incorrect because you cannot delete the management account; you would need to delete the entire organization. Option C is incorrect because you cannot delete the root user; it is a built-in user that cannot be removed. Therefore, enabling MFA on the root user of the management account is the appropriate action to improve security.

Answer

Remove the management account from the organization.

Answer

Delete the management account and create a new one.

Answer

Create a new root user for the management account and delete the old one.

Question 9

A security engineer applies the above bucket policy to an S3 bucket. What is the effect of this policy?

Accepted Answer

All requests to the bucket must be made over HTTPS.. The bucket policy includes a statement that denies all actions (s3:*) when the request does not use HTTPS (aws:SecureTransport is false). This effectively requires all requests to the bucket to be made over HTTPS. Therefore, option B is correct. Option A is incorrect because the policy does not deny all requests; it only denies non-HTTPS requests. Option C is incorrect because the condition does have an effect. Option D is incorrect because HTTP requests are denied.

Answer

All requests to the bucket are denied regardless of protocol.

Answer

The policy has no effect because it uses a condition.

Answer

All requests to the bucket must be made over HTTP.

Question 10

A company wants to ensure that all IAM users in an account have multi-factor authentication (MFA) enabled. A security administrator needs to identify users who do not have MFA. Which AWS service should the administrator use?

Accepted Answer

IAM Credential Report. AWS IAM Credential Report lists all IAM users and their MFA status, providing a quick way to identify users without MFA. Option A (AWS CloudTrail) logs API events, not MFA status. Option B (IAM Access Analyzer) focuses on resource policies. Option D (AWS Config) can check compliance but requires a rule; the credential report is more direct.

Answer

AWS CloudTrail

Answer

IAM Access Analyzer

Answer

AWS Config

Question 11

A security engineer is investigating a potential data exfiltration incident. The engineer notices that an EC2 instance in a private subnet is making outbound connections to an external IP address on port 443. The VPC has a NAT gateway in a public subnet, and the route table for the private subnet directs 0.0.0.0/0 to the NAT gateway. The security group for the instance allows all outbound traffic. Which AWS service can the engineer use to determine which IAM role or user is responsible for launching the instance?

Accepted Answer

AWS CloudTrail. AWS CloudTrail logs all API calls made within the AWS account, including the RunInstances API call. This log captures the IAM user or role that launched the EC2 instance, along with the timestamp, source IP, and other details. AWS Config (Option A) records resource configuration changes but does not track who made the API call. VPC Flow Logs (Option B) capture network traffic metadata (IP addresses, ports) but not user identity. IAM Access Analyzer (Option C) analyzes resource policies to identify unintended access, not who launched instances.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

IAM Access Analyzer

Question 12

A company has a requirement that all S3 buckets must block public access. The security engineer needs to continuously monitor for compliance and automatically remediate any noncompliant buckets. Which combination of AWS services should the engineer use?

Accepted Answer

AWS Config and AWS Lambda (or SSM Automation). AWS Config with managed rules such as s3-bucket-public-read-prohibited or s3-bucket-public-write-prohibited can detect S3 buckets that do not block public access. By configuring an automatic remediation action using AWS Lambda or AWS Systems Manager Automation, the engineer can automatically apply the appropriate bucket policies to block public access. Amazon GuardDuty (A) is a threat detection service, not a compliance monitoring tool. AWS Organizations SCPs (C) are for preventive controls at the account level, not for continuous monitoring and remediation of individual buckets. AWS Trusted Advisor (D) provides best practice checks but does not offer automated remediation or continuous compliance monitoring.

Answer

Amazon GuardDuty and AWS Security Hub

Answer

AWS Organizations SCPs and AWS CloudTrail

Answer

AWS Trusted Advisor and Amazon SNS

Question 13

A company uses AWS Organizations with a multi-account strategy. The security team wants to ensure that no EC2 instances are launched without an approved Amazon Machine Image (AMI) ID. Which approach should the team take to enforce this requirement across all accounts?

Accepted Answer

Create an SCP that denies ec2:RunInstances if the AMI ID is not in a specified list.. Using an SCP to deny RunInstances with a condition on the AMI ID is the most direct way to enforce at the organization level. Option A (AWS Config) detects but does not prevent. Option B (IAM policy in each account) is less manageable. Option D (Lambda) is reactive.

Answer

Use AWS Config to detect EC2 instances with noncompliant AMI IDs and send notifications.

Answer

Create an IAM policy in each account that denies ec2:RunInstances unless the AMI ID is in an approved list.

Answer

Deploy a Lambda function that terminates any EC2 instance with a noncompliant AMI ID.

Question 14

A security engineer is tasked with ensuring that all S3 buckets in an AWS account have versioning enabled. The engineer needs to identify buckets that do not have versioning enabled. Which AWS service is BEST suited for this task?

Accepted Answer

AWS Config. AWS Config has a managed rule (s3-bucket-versioning-enabled) that can evaluate S3 buckets and report compliance. Option A (AWS Trusted Advisor) provides best practice checks but does not have a specific versioning check. Option B (AWS CloudTrail) logs API calls and cannot directly audit bucket configurations. Option C (IAM Access Analyzer) analyzes resource policies for public access, not versioning. Option D (AWS Config) is the correct choice for continuous compliance monitoring of S3 bucket versioning.

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Answer

IAM Access Analyzer

Question 15

A company uses AWS Organizations with 50 accounts. The security team wants to centrally manage IAM roles that grant cross-account access to a central security account. Which THREE steps are required to set up this cross-account access?

Accepted Answer

Create an IAM role in each member account with a trust policy that allows the security account to assume the role.. The correct steps involve: (C) creating IAM roles in each member account with a trust policy that allows the security account to assume the role, (D) applying an SCP to member accounts that denies iam:PassRole for the roles to prevent users from modifying the trust policy, and (E) creating an IAM user or role in the security account with a policy that allows sts:AssumeRole to the member account roles. Option D is necessary to enforce that only the security account can assume the roles, and option E provides the entity in the security account that performs the role assumption. Option A is incorrect because IAM groups cannot be assigned to roles. Option B is incorrect because Access Analyzer is not used for cross-account role setup.

Answer

Create an IAM group in the security account with permissions to assume roles in member accounts.

Answer

Enable AWS Organizations trusted access with AWS IAM Access Analyzer.