SCS-C02 Management and Security Governance Practice Test 11 — 15 Questions

Question 1

Which THREE are benefits of using AWS CloudTrail for security governance? (Choose three.)

Accepted Answer

Supports compliance audits by providing event history. Option C is correct because CloudTrail retains a searchable history of management and data events that auditors can use to demonstrate who did what and when, satisfying compliance audit requirements. Option D is correct because CloudTrail's core function is to record AWS API activity (management events, and optionally data and insight events) in the account and deliver them as log files to Amazon S3 and/or CloudWatch Logs. Option E is correct because those API activity records include the identity (IAM user, role, federated user) and source IP, enabling security teams to analyze user behavior and detect anomalous or unauthorized actions. Option A is not correct as stated because CloudTrail itself does not perform real-time log analysis; it can deliver events to CloudWatch Logs, but the analysis is done by CloudWatch Logs metric filters/alarms, not by CloudTrail. Option B is not correct because CloudTrail is an auditing and logging service and does not automatically remediate noncompliant resources; remediation requires services such as AWS Config rules with remediation actions or Lambda-based automation.

Answer

Enables real-time log analysis with Amazon CloudWatch Logs

Answer

Automatically remediates noncompliant resources

Question 2

Which TWO are valid methods to centrally manage multiple AWS accounts? (Choose two.)

Accepted Answer

AWS Control Tower. AWS Control Tower (D) is correct because it provides a centralized landing zone that automates the setup of a multi-account AWS environment using AWS Organizations, IAM Identity Center, and guardrails (preventive and detective controls) to govern accounts at scale. AWS Organizations (E) is correct because it is the foundational service for centrally managing multiple AWS accounts, allowing consolidated billing, organizational units (OUs), service control policies (SCPs), and centralized policy-based governance across accounts. AWS IAM (A) is not correct because it manages users, groups, roles, and permissions within a single AWS account (or via roles across accounts), not centralized multi-account governance. AWS Service Catalog (B) is not correct because it lets administrators create and manage approved IT service portfolios for end users, but it does not itself centrally manage multiple AWS accounts. Amazon Cognito (C) is not correct because it provides identity, authentication, and authorization for web and mobile applications, not multi-account AWS management.

Answer

AWS IAM

Answer

AWS Service Catalog

Answer

Amazon Cognito

Question 3

A developer needs to grant an IAM user read-only access to an S3 bucket containing sensitive data. The bucket is encrypted with an AWS KMS customer managed key. Which set of permissions must be included in the IAM policy?

Accepted Answer

s3:GetObject, kms:Decrypt. To read objects from an encrypted S3 bucket, the user needs both s3:GetObject to retrieve the object and kms:Decrypt to decrypt the object using the KMS key. Option A is wrong because it includes kms:Encrypt instead of kms:Decrypt; decryption is required, not encryption. Option C is wrong because it lacks s3:GetObject permission, which is necessary to retrieve the object. Option D is wrong because it includes s3:ListBucket, which is not required for reading a specific object, and it lacks s3:GetObject.

Answer

s3:GetObject, kms:Encrypt

Answer

kms:Decrypt

Answer

s3:ListBucket, kms:Decrypt

Question 4

A company's Security team is using AWS Organizations with a consolidated billing account. The security team wants to ensure that all member accounts have AWS CloudTrail enabled and that logs are delivered to a central S3 bucket in the management account. Which combination of actions should the security team take? (Choose the best answer.)

Accepted Answer

Use an SCP to deny disabling CloudTrail and use CloudFormation StackSets to deploy CloudTrail in all accounts.. Using an SCP to deny disabling CloudTrail and a CloudFormation StackSet to deploy CloudTrail in each account ensures enforcement and deployment across all member accounts. Option A is wrong because AWS Config rules can detect but not prevent disabling of CloudTrail. Option B is wrong because an IAM policy requiring account owners to enable CloudTrail is not enforceable and relies on individual action. Option C is wrong because enabling CloudTrail only in the management account does not enable it in member accounts; cross-account logging requires member accounts to have CloudTrail configured.

Answer

Use AWS Config rules to detect when CloudTrail is disabled.

Answer

Create a new IAM policy that requires each account owner to enable CloudTrail.

Answer

Enable CloudTrail in the management account only and use cross-account logging.

Question 5

A company uses AWS Organizations with multiple accounts. The security team wants to centrally manage IAM policies across all accounts. Which AWS feature should the team use to enforce permissions across member accounts?

Accepted Answer

Service Control Policies (SCPs). Service Control Policies (SCPs) allow central control over permissions for all accounts in an organization. Option A is wrong because IAM roles with cross-account access provide temporary access but do not enforce policies centrally. Option C is wrong because AWS Config rules are for compliance monitoring, not permission enforcement. Option D is wrong because AWS CloudTrail is for auditing, not enforcement.

Answer

IAM roles with cross-account access

Answer

AWS Config rules

Answer

AWS CloudTrail trails

Question 6

A security engineer needs to grant an EC2 instance access to an S3 bucket without storing long-term credentials on the instance. Which approach should the engineer use?

Accepted Answer

Create an IAM role with the required permissions and attach it to the EC2 instance as an instance profile.. An IAM role attached to an EC2 instance via an instance profile allows the instance to obtain temporary, automatically rotated credentials from the EC2 Instance Metadata Service (IMDS) at 169.254.169.254. This eliminates the need to embed long-term access keys anywhere on the instance or in the AMI. The instance assumes the role and receives short-lived STS credentials scoped to the role's permissions.

Answer

Generate an access key and secret key for an IAM user and store them in the EC2 instance.

Answer

Use an SCP to allow the EC2 instance to access the S3 bucket.

Answer

Store the credentials in the AMI used to launch the instance.

Question 7

A company wants to ensure that IAM users with console access have strong passwords. Which IAM password policy setting should the company configure to enforce the use of at least one uppercase letter?

Accepted Answer

RequireUppercaseCharacters. The IAM password policy setting `RequireUppercaseCharacters` specifically enforces that IAM user passwords contain at least one uppercase letter (A-Z). When enabled, any password created or changed must include an uppercase character, otherwise IAM rejects it. This directly satisfies the requirement to enforce uppercase letters for console users.

Answer

MinimumPasswordLength

Answer

RequireNumbers

Answer

RequireSymbols

Question 8

A security engineer needs to audit all API calls made in an AWS account for the past 90 days. Which AWS service should the engineer use?

Accepted Answer

AWS CloudTrail. AWS CloudTrail (Option B) is the correct service for auditing all API calls made in an AWS account over the past 90 days. It records API activity and can be configured to store logs for 90 days in the management event history. Option A (Amazon S3 access logs) logs access to S3 objects, not API calls. Option C (AWS Config) tracks resource configuration changes, not API calls. Option D (Amazon CloudWatch Logs) is for monitoring, storing, and accessing log files from various sources, but it is not specifically designed for auditing API calls; CloudTrail is the primary service for that purpose.

Answer

Amazon S3 access logs

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 9

Which TWO actions are best practices for securing an AWS account root user? (Select TWO.)

Accepted Answer

Create an IAM user with administrative privileges and use it instead of the root user.. Option D is correct because AWS best practice is to create an IAM user (or federated identity) with the required administrative permissions and use that identity for day-to-day administration, reserving the root user only for the few tasks that specifically require it, such as changing the account name, closing the account, or changing the support plan. Option E is correct because enabling multi-factor authentication (MFA) on the root user adds a second authentication factor, so a compromised root password alone is insufficient to sign in; AWS strongly recommends a hardware MFA device for the root user. Option A is wrong because using the root user for everyday administrative tasks violates least privilege and greatly increases the blast radius if those credentials are compromised. Option B is wrong because AWS advises against creating access keys for the root user; if root access keys already exist, they should be deleted, since long-lived root keys are a major security risk. Option C is wrong because the root user cannot be deleted; it is permanently tied to the account and can only be secured by protecting its credentials and limiting its use.

Answer

Use the root user for everyday administrative tasks.

Answer

Create access keys for the root user.

Answer

Delete the root user to prevent unauthorized access.

Question 10

A company uses AWS Organizations with multiple accounts. The security team needs to enforce that all S3 buckets in the organization block public access. Which policy should be attached to the root organizational unit to achieve this?

Accepted Answer

Attach a service control policy (SCP) that denies s3:PutBucketPublicAccessBlock.. Attach a service control policy (SCP) that denies s3:PutBucketPublicAccessBlock. SCPs can be applied at the root organizational unit to centrally restrict permissions across all accounts, preventing any account from allowing public access to S3 buckets. Option A (CloudTrail) only logs events, not block access. Option B (AWS Config) can detect non-compliance but requires additional automation to enforce; the question asks for enforcement directly. Option D (IAM role) is account-specific and cannot enforce globally.

Answer

Enable AWS CloudTrail to log public access attempts and alert the security team.

Answer

Use AWS Config rules to remediate non-compliant buckets automatically.

Answer

Create an IAM role with a bucket policy that blocks public access.

Question 11

A security engineer notices that an IAM user has been performing suspicious actions in an AWS account. The engineer needs to generate a credential report to identify the age of the user's access keys. Which AWS CLI command should the engineer run?

Accepted Answer

aws iam generate-credential-report && aws iam get-credential-report. The AWS CLI command to generate and retrieve an IAM credential report is a two-step process: first run 'aws iam generate-credential-report' to trigger report generation, then run 'aws iam get-credential-report' to retrieve it. The report includes access key age, password age, MFA status, and other credential metadata for all IAM users, which is exactly what the engineer needs.

Answer

aws iam get-account-authorization-details

Answer

aws iam generate-service-last-accessed-details

Answer

aws iam list-access-keys --user-name suspectUser

Question 12

A security engineer is designing a solution to automatically remediate non-compliant resources in an AWS account. The engineer needs to trigger an AWS Lambda function when an EC2 instance is launched without the required tags. Which AWS service should be used to detect the non-compliant resource and invoke the Lambda function?

Accepted Answer

AWS Config. AWS Config is the correct service because it continuously evaluates resource configurations against desired rules. You can create a Config rule that checks for required tags on EC2 instances; when a non-compliant instance is detected, Config can automatically invoke a Lambda function via an remediation action. This native integration enables automatic, event-driven remediation without custom polling or additional services.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS Systems Manager

Question 13

A company's security team wants to receive alerts when an IAM user creates a new access key. Which AWS service can be used to monitor and notify on this specific API call?

Accepted Answer

AWS CloudTrail with Amazon CloudWatch Events. CloudTrail logs IAM CreateAccessKey events, and CloudWatch Events can trigger a notification. Option A is wrong because Trusted Advisor is for best practices. Option B is wrong because GuardDuty is for threat detection. Option D is wrong because AWS Config is for resource compliance.

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Answer

AWS Config

Question 14

A security engineer is designing a cross-account access policy. The engineer has an S3 bucket in Account A and wants to grant read access to a user in Account B. Which combination of policies is required?

Accepted Answer

A bucket policy in Account A allowing the user, and an IAM policy in Account B granting s3:GetObject.. Cross-account access to an S3 bucket requires both a resource-based policy (bucket policy) in Account A that grants permissions to the user in Account B, and an identity-based policy (IAM policy) in Account B that allows the user to perform the s3:GetObject action. Without both, access is denied. Option A is wrong because a bucket policy alone is insufficient; the user still needs an IAM policy in their own account to allow the action. Option B is wrong because bucket ACLs are a legacy mechanism and do not effectively support cross-account access for specific IAM users; they would still require an IAM policy in Account B. Option C is wrong because an IAM policy in Account B alone is insufficient; the bucket policy in Account A must explicitly grant access to the user, as the bucket's default policy denies access from other accounts.

Answer

A bucket policy in Account A that allows access to the user in Account B.

Answer

A bucket ACL in Account A granting access to the user in Account B.

Answer

An IAM policy in Account B that grants s3:GetObject to the bucket.

Question 15

An organization uses AWS Organizations and wants to restrict the use of specific EC2 instance types across all member accounts. Which policy type should be used to enforce this restriction?

Accepted Answer

Service control policy (SCP). Service control policies (SCPs) are the only AWS Organizations policy type that can centrally restrict the maximum available permissions for all accounts in an organization or organizational unit. By attaching an SCP that denies the ec2:RunInstances action for specific instance types (using condition keys like ec2:InstanceType), the organization can enforce the restriction across all member accounts, regardless of their local IAM policies. SCPs do not grant permissions; they only filter them, so they are ideal for guardrails.

Answer

Resource-based policy

Answer

IAM policy

Answer

AWS CloudFormation policy