SCS-C02 Management and Security Governance Practice Test 12 — 15 Questions

Question 1

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that all accounts have AWS CloudTrail enabled and that logs are delivered to a central S3 bucket in the management account. What is the most efficient way to enforce this across all accounts?

Accepted Answer

Create a service control policy (SCP) that denies modifications to CloudTrail settings.. Using an SCP in AWS Organizations can deny the action of disabling CloudTrail or modifying trail settings, enforcing that CloudTrail remains enabled. Option A is wrong because it requires manual setup in each account. Option B is wrong because AWS Config can detect but not prevent disabling. Option D is wrong because it only monitors, not enforces.

Answer

Use AWS Trusted Advisor to check CloudTrail status and send alerts.

Answer

Configure each account individually with a CloudTrail trail pointing to the central bucket.

Answer

Use AWS Config rules in each account to detect non-compliant trails.

Question 2

A developer accidentally committed AWS access keys to a public GitHub repository. The security team needs to immediately revoke the compromised keys and ensure that no new keys are created for that IAM user. What is the most effective immediate action?

Accepted Answer

Delete the IAM user and recreate it with new permissions.. Deleting the IAM user revokes all access keys and prevents any new keys from being created. Option A is wrong because it only deactivates but does not delete. Option B is wrong because changing the password does not affect access keys. Option C is wrong because it only rotates but the old key remains active until deleted.

Answer

Rotate the access keys and update the application.

Answer

Change the IAM user's password.

Answer

Deactivate the access keys using the AWS Management Console.

Question 3

A company has a requirement that all Amazon EC2 instances must be launched with an IAM role that grants least-privilege permissions. The security team wants to prevent users from launching instances without a role, and also want to ensure that the role used is one of a set of approved roles. How can this be enforced?

Accepted Answer

Attach an IAM policy to users that denies ec2:RunInstances unless the ec2:InstanceProfile condition matches an approved profile ARN.. Using an IAM policy with a condition that checks the IAM instance profile ARN against a list of approved profiles will enforce both requirements. Option B is wrong because it only requires a role, not an approved one. Option C is wrong because AWS Config can detect but not prevent. Option D is wrong because SCPs cannot enforce specific instance profile ARNs because they apply at the account level and cannot reference resource-level conditions like ec2:InstanceProfile.

Answer

Use an SCP to require that all EC2 instances have an IAM role attached.

Answer

Use an SCP to deny ec2:RunInstances unless the instance profile is in a specific list of ARNs.

Answer

Use AWS Config to detect instances without a role and automatically terminate them.

Question 4

A company uses AWS Key Management Service (KMS) to encrypt sensitive data in Amazon S3. The security team needs to ensure that the KMS key can only be used from within the company's VPC and not from the public internet. How can this be achieved?

Accepted Answer

Create a VPC endpoint for KMS and modify the KMS key policy to allow usage only from the specified VPC endpoint.. Using a VPC endpoint for KMS and a key policy that restricts usage to the VPC endpoint prevents public internet access. Option A is wrong because it does not restrict usage to VPC. Option B is wrong because an SCP cannot restrict KMS key usage to a specific VPC. Option D is wrong because CloudTrail does not enforce access restrictions.

Answer

Use an SCP to deny kms:Encrypt unless the request comes from the VPC.

Answer

Use AWS CloudTrail to monitor KMS calls and alert if they come from outside the VPC.

Answer

Create a VPC endpoint for KMS and attach a bucket policy that requires the endpoint.

Question 5

A company is using AWS Organizations and wants to delegate the management of IAM policies to a specific member account without granting full administrative access. Which AWS feature allows the management account to delegate policy management to another account?

Accepted Answer

IAM cross-account roles. IAM cross-account roles allow the management account to assume a role in the member account with permissions to manage IAM policies. Option A is wrong because RAM shares resources, not IAM management. Option B is wrong because SSO is for user authentication and authorization. Option D is wrong because StackSets automate resource deployment, not delegation.

Answer

AWS Resource Access Manager

Answer

AWS CloudFormation StackSets

Answer

AWS Single Sign-On

Question 6

A company's security team is implementing a solution to automatically revoke public access to Amazon S3 buckets that become public. The solution must be serverless and use native AWS services. Which combination of services should be used?

Accepted Answer

Amazon EventBridge (CloudWatch Events) to detect PutBucketPolicy events and invoke an AWS Lambda function to remove the policy. Amazon EventBridge can detect S3 bucket policy changes via CloudTrail and trigger a Lambda function to remediate. Option A is wrong because AWS Config can detect but not automatically remediate without Lambda. Option C is wrong because S3 events only trigger on object-level events, not bucket policy changes. Option D is wrong because CloudWatch Logs alone cannot trigger remediation.

Answer

Amazon S3 event notifications on ObjectCreated events to invoke a Lambda function

Answer

Amazon CloudWatch Logs with a metric filter and alarm to trigger an SNS notification

Answer

AWS Config with managed rule 's3-bucket-public-read-prohibited' and auto-remediation via Systems Manager

Question 7

Which TWO AWS services can be used to centrally manage and audit permissions across multiple AWS accounts? (Choose two.)

Accepted Answer

AWS Organizations. AWS Organizations provides a central view of all accounts and can apply SCPs. IAM Access Analyzer analyzes resource policies across accounts to identify public or cross-account access. AWS Config evaluates resource configurations but does not centrally manage permissions. AWS CloudTrail logs API calls but does not manage permissions. AWS SSO manages user access but not resource permissions.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

AWS Single Sign-On

Question 8

Which THREE steps should a security engineer take to remediate a compromised IAM user whose access keys were exposed? (Choose three.)

Accepted Answer

Deactivate the access keys.. Immediately deactivate or delete the access keys to stop usage. Rotate the keys if the user still needs access, but the old keys must be deactivated. Remove the compromised user from any groups to limit permissions. Changing the password does not affect access keys. Creating a new user with the same permissions is unnecessary if the user can be cleaned. Reviewing CloudTrail logs is important but is an investigation step, not immediate remediation.

Answer

Create a new IAM user with the same permissions.

Answer

Change the IAM user's password.

Question 9

Which TWO AWS services can be used to enforce that Amazon S3 buckets are not publicly accessible? (Choose two.)

Accepted Answer

AWS Organizations service control policies (SCPs). AWS Config can evaluate bucket policies against a rule and trigger remediation. SCPs in AWS Organizations can deny actions that make buckets public. AWS CloudTrail only logs. IAM Access Analyzer identifies public access but does not enforce. Amazon Macie discovers sensitive data.

Answer

IAM Access Analyzer

Answer

AWS CloudTrail

Answer

Amazon Macie

Question 10

The exhibit shows an SCP attached to an organizational unit. What is the effect of this policy?

Accepted Answer

It allows s3:PutBucketPolicy only if the bucket ACL is set to bucket-owner-full-control.. The SCP denies s3:PutBucketPolicy only when the bucket ACL is not set to 'bucket-owner-full-control'. If the ACL is set to that value, the action is allowed. Thus, it ensures that when a bucket policy is created, the ACL must grant full control to the bucket owner. It does not deny all PutBucketPolicy actions.

Answer

It denies all s3:PutBucketPolicy actions on all buckets.

Answer

It denies s3:PutBucketPolicy for any bucket that does not have an ACL.

Answer

It allows s3:PutBucketPolicy for buckets owned by the management account.

Question 11

A security engineer runs the get-account-authorization-details command and sees the exhibit output. The engineer wants to ensure that the 'admin' user does not have administrative access. Which steps should be taken?

Accepted Answer

Detach the AdministratorAccess policy from the 'admin' user and attach a custom policy with read-only permissions.. The 'admin' user has the AdministratorAccess policy attached. To remove administrative access, the engineer should detach this policy and attach a more restrictive policy. Option A is wrong because deleting the user is unnecessary. Option B is wrong because a permissions boundary does not remove the existing policy. Option C is wrong because the policy itself needs to be removed.

Answer

Delete the 'admin' user and create a new user with limited permissions.

Answer

Modify the AdministratorAccess policy to deny all actions.

Answer

Attach a permissions boundary that denies all actions.

Question 12

The exhibit shows an S3 bucket policy. The security team wants to ensure that only users from account 123456789012 can access objects in the bucket. What is a potential security issue with this policy?

Accepted Answer

The policy grants access to all IAM users in the account, not just specific ones.. The policy grants access to the entire account root (all users in that account) and does not restrict to specific IAM users or roles. Therefore, any user in the account can access the objects if they have permission to call s3:GetObject. Additionally, there is no condition for encryption in transit or at rest, but the primary issue is that it's too permissive within the account. Option A is wrong because it grants access to the entire account. Option C is wrong because there is no condition for MFA. Option D is wrong because it does not restrict to specific IPs.

Answer

The policy does not restrict access to a specific VPC.

Answer

The policy uses a wildcard in the resource ARN.

Answer

The policy does not require MFA.

Question 13

A company uses AWS Organizations with multiple accounts. The security team needs to ensure that all S3 buckets across the organization are encrypted with AWS KMS keys. What is the MOST effective way to enforce this requirement?

Accepted Answer

Create a service control policy (SCP) that denies any S3 bucket creation or modification without encryption enabled.. Option A is correct because SCPs can be applied to the root OU to deny any S3 bucket creation or modification that does not have encryption configured. Option B is wrong because IAM roles operate within accounts and cannot enforce across accounts in the organization. Option C is wrong because Config rules can detect noncompliant buckets but do not prevent their creation. Option D is wrong because CloudTrail is for logging and does not enforce encryption.

Answer

Use AWS CloudTrail to log all bucket creation events and alert the security team.

Answer

Create an IAM role in each account that denies s3:PutBucketEncryption if encryption is not set.

Answer

Use AWS Config rules to detect unencrypted buckets and trigger a Lambda function to encrypt them.

Question 14

A security engineer is designing a centralized logging solution for a multi-account AWS environment using AWS Organizations. The solution must ensure that all CloudTrail logs from all accounts are delivered to a single S3 bucket in the security account. Additionally, the logs must be encrypted with a KMS key that is managed by the security account. Which combination of steps is required?

Accepted Answer

Create a trail in the security account with organization trail enabled, delivering to a bucket in the security account. Configure bucket policy and KMS key policy to allow CloudTrail and S3 from all accounts.. Option D is correct because a trail in the security account with organization trail enabled will deliver logs from all accounts to the specified S3 bucket. The S3 bucket policy must grant CloudTrail write access from all accounts, and the KMS key policy must grant CloudTrail and S3 permissions for all accounts. Option A is wrong because organization trails can only be created in the management account. Option B is wrong because individual trails per account are not centralized. Option C is wrong because CloudWatch Logs is not required.

Answer

Create a trail in each account, each delivering to the same S3 bucket. Use a bucket policy to allow cross-account writes. Use a single KMS key with appropriate key policy.

Answer

Use AWS Config to deliver logs to a central bucket. Enable CloudWatch Logs in each account and stream to the security account.

Answer

Create a trail in the management account with organization trail enabled, delivering to a bucket in the management account. Use KMS default encryption.

Question 15

A company wants to automate the enforcement of security best practices across all AWS accounts in an organization. The solution should automatically remediate noncompliant resources. Which AWS service should be used to achieve this?

Accepted Answer

AWS Config rules with auto-remediation. Option B is correct because AWS Config rules can automatically remediate noncompliant resources using SSM Automation documents or Lambda functions. Option A is wrong because SCPs only enforce preventive controls, not auto-remediation. Option C is wrong because GuardDuty is a threat detection service, not for compliance automation. Option D is wrong because IAM Access Analyzer analyzes resource policies for unintended access, not for enforcing best practices.

Answer

AWS Organizations service control policies (SCPs)

Answer

AWS IAM Access Analyzer

Answer

Amazon GuardDuty