SCS-C02 Management and Security Governance Practice Test 12 — 15 Questions

Question 1

A company wants to log all API calls made in their AWS account for auditing. Which AWS service should be enabled to capture these logs?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls made in an AWS account, including the identity, time, source IP, and request details, which is exactly what is needed for auditing. Enabling CloudTrail captures management and, optionally, data events across services. This makes it the correct service for logging all API calls.

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Answer

Amazon S3 server access logs

Question 2

A security engineer is reviewing the following IAM policy attached to a role. Which TWO actions are allowed by this policy? (Choose two.)

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetObject"
            ],
            "Resource": "*"
        }
    ]
}
```

Accepted Answer

s3:ListBucket. Option A (s3:ListBucket) is correct because the policy's Action list explicitly includes "s3:ListBucket" with Effect Allow and Resource "*", so listing any S3 bucket is permitted. Option E (s3:GetObject) is correct because "s3:GetObject" is also explicitly listed in the same Allow statement, granting read access to objects across all resources. The unmarked options do not belong because the policy only allows the two S3 actions named; ec2:TerminateInstances, iam:CreateUser, and kms:Decrypt are not present in the Action list, and IAM policies are deny-by-default for any action not explicitly allowed.

Answer

ec2:TerminateInstances

Answer

iam:CreateUser

Answer

kms:Decrypt

Question 3

A company is implementing AWS Organizations with multiple accounts. Which THREE are benefits of using service control policies (SCPs)? (Choose three.)

Accepted Answer

Prevent users from disabling CloudTrail. Option B is correct because an SCP can deny the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions at the OU or account level, ensuring member accounts cannot disable or delete CloudTrail trails even if their IAM policies allow it. Option C is correct because SCPs let you codify and enforce organizational compliance guardrails—such as blocking use of unapproved regions or services—uniformly across all accounts in an OU. Option E is correct because SCPs are the AWS Organizations mechanism for centrally setting the maximum available permissions for principals in member accounts, restricting what IAM policies can grant. Option A is not a benefit of SCPs because SCPs only filter/limit permissions; they never grant access, so cross-account access must be established with IAM roles, resource policies, or identity federation. Option D is not a benefit of SCPs because consolidated billing is a separate AWS Organizations feature handled by the management account's payment method, not by service control policies.

Answer

Grant cross-account access

Answer

Manage consolidated billing

Question 4

Which TWO AWS services can be used to detect and alert on suspicious API activity in real-time? (Choose two.)

Accepted Answer

AWS CloudTrail with CloudWatch Events. AWS CloudTrail with CloudWatch Events (A) is correct because CloudTrail records every API call as a management or data event, and CloudWatch Events (now EventBridge) can match those events in near real-time using rules and trigger alerts via SNS, Lambda, or other targets, enabling detection of suspicious API activity as it happens. Amazon GuardDuty (E) is correct because it continuously analyzes CloudTrail management events, VPC Flow Logs, and DNS logs with threat intelligence and machine learning to detect anomalous or malicious API activity and generate findings in real time. VPC Flow Logs (B) only capture IP traffic metadata at the network interface level, not API-level activity, so they cannot directly detect suspicious API calls. Amazon S3 (C) is an object storage service and provides no native detection or alerting for API activity. AWS Config (D) evaluates resource configuration compliance and records configuration changes, but it is not designed for real-time detection and alerting on suspicious API behavior.

Answer

VPC Flow Logs

Answer

Amazon S3

Answer

AWS Config

Question 5

Refer to the exhibit. A security engineer attaches this S3 bucket policy to an S3 bucket. What is the effect of this policy?

Accepted Answer

Requests over HTTP are denied, but HTTPS requests are allowed.. The policy contains a Deny statement conditioned on 'aws:SecureTransport' being false, which blocks all HTTP requests while allowing HTTPS requests to proceed (subject to other permissions). Because Deny only triggers when the condition matches, HTTPS requests are unaffected by this statement and can be allowed by other policies or ACLs.

Answer

The policy has no effect because there is no Allow statement.

Answer

All requests over HTTPS are allowed.

Answer

All requests to the bucket are denied.

Question 6

Refer to the exhibit. A security engineer runs the get-trail-status command for a CloudTrail trail. The engineer notices that LatestCloudWatchLogsDeliveryTime is null. What does this indicate?

Accepted Answer

The trail is not configured to deliver logs to CloudWatch Logs.. LatestCloudWatchLogsDeliveryTime being null indicates the trail has never delivered logs to a CloudWatch Logs log group — in other words, CloudWatch Logs delivery is not configured for this trail. If delivery were configured and functioning, this field would contain the timestamp of the most recent delivery. A null value specifically means no delivery has occurred, not that delivery failed.

Answer

The trail has stopped logging.

Answer

The trail is not delivering logs to S3.

Answer

The digest delivery has failed.

Question 7

A company wants to enforce that all IAM users in an AWS account must have multi-factor authentication (MFA) enabled. Which AWS service can be used to automatically detect and remediate non-compliant users?

Accepted Answer

AWS Config. AWS Config continuously records resource configurations and evaluates them against rules. A managed rule such as 'iam-user-mfa-enabled' detects IAM users without MFA, and Config remediation actions (via SSM Automation documents) can automatically enforce MFA or disable non-compliant users. This gives both detection and automated remediation in a single service, matching the requirement.

Answer

AWS Trusted Advisor

Answer

AWS IAM Access Analyzer

Answer

AWS CloudTrail

Question 8

A security engineer needs to centrally manage and enforce security policies across multiple AWS accounts in an organization. Which AWS service should they use?

Accepted Answer

AWS Organizations with SCPs. AWS Organizations with Service Control Policies (SCPs) allows central policy management across accounts. Firewall Manager focuses on VPC security, not general policies.

Answer

AWS CloudFormation StackSets

Answer

AWS IAM

Answer

AWS Firewall Manager

Question 9

A company's security team discovers that an IAM role has been assumed from an unexpected external AWS account. Which AWS service can be used to analyze the trust policy and identify unintended access?

Accepted Answer

AWS IAM Access Analyzer. AWS IAM Access Analyzer analyzes resource-based policies, including IAM role trust policies, to identify resources shared with external entities. It can detect when a role's trust policy allows an unexpected external AWS account to assume it, providing findings that highlight unintended access.

Answer

AWS CloudTrail Insights

Answer

AWS Config

Answer

AWS Security Hub

Question 10

A company wants to automatically detect and notify about any S3 buckets that have public read access. Which combination of services should be used?

Accepted Answer

AWS Config and Amazon EventBridge. AWS Config continuously records S3 bucket configurations and can evaluate them against managed rules such as 's3-bucket-public-read-prohibited', flagging any bucket with public read access as non-compliant. Amazon EventBridge can then route Config's compliance change events to targets like SNS or Lambda for notification. This combination provides both detection and automated notification without custom code.

Answer

AWS CloudTrail and AWS Lambda

Answer

AWS IAM Access Analyzer and Amazon CloudWatch

Answer

AWS Trusted Advisor and Amazon SES

Question 11

A security engineer needs to ensure that all new IAM users are created with a strong password policy enforced. Which action should be taken?

Accepted Answer

Set a custom IAM password policy in the account. AWS IAM account password policies are configured at the account level and apply to all IAM users created in that account. Setting a custom password policy enforces minimum length, complexity, reuse prevention, and rotation requirements automatically for every new and existing user. This is the native, supported mechanism for enforcing strong passwords across an AWS account.

Answer

Use AWS Config to automatically delete users with weak passwords

Answer

Create a Lambda function that checks password strength on user creation

Answer

Use AWS Secrets Manager to generate passwords

Question 12

A security team wants to audit all changes to IAM policies in the AWS account. Which AWS service should be used to track these changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity in the account, including all IAM policy changes (CreatePolicy, PutRolePolicy, AttachPolicy, etc.), and delivers these events to an S3 bucket and optionally CloudWatch Logs. It is the authoritative service for auditing who changed what and when across AWS APIs. For IAM policy change auditing, CloudTrail is the correct and standard answer.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

AWS CloudWatch Logs

Question 13

A security engineer notices that an S3 bucket policy allows access to a principal from another AWS account. Which AWS feature can be used to check if this external access is intended?

Accepted Answer

AWS IAM Access Analyzer. IAM Access Analyzer generates findings for external access to S3 buckets. You can review and archive findings if intended.

Answer

AWS Trusted Advisor bucket permissions check

Answer

AWS Config rule s3-bucket-public-read-prohibited

Answer

AWS CloudTrail event history

Question 14

A company wants to run a security assessment that checks for vulnerabilities in an EC2 instance. Which AWS service should be used?

Accepted Answer

Amazon Inspector. Amazon Inspector automatically assesses EC2 instances for vulnerabilities and network exposure.

Answer

AWS WAF

Answer

Amazon GuardDuty

Answer

AWS Shield Advanced

Question 15

Which TWO actions should a security engineer take to ensure that an S3 bucket is not publicly accessible? (Choose two.)

Accepted Answer

Enable S3 Block Public Access at the account level. Block Public Access settings at bucket and account level prevent all public access. The other options are not correct because: ACLs can allow public access; CloudTrail does not block; Bucket policies are overridden by Block Public Access.

Answer

Enable AWS CloudTrail for the bucket

Answer

Remove all bucket ACLs

Answer

Set a bucket policy that denies all public access