SCS-C02 Management and Security Governance Practice Test 12 — 15 Questions

Question 1

A company wants to enforce that all IAM users must use multi-factor authentication (MFA) to access the AWS Management Console. Which policy should be attached to the IAM users or group to enforce this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deny access if MFA is not present. The condition 'aws:MultiFactorAuthPresent':'true' in a Deny statement ensures that if MFA is not present, access is denied. Option A is wrong because it allows access without MFA. Option C is wrong because it only denies when MFA is present. Option D is wrong because it allows access with MFA but does not deny without it.

Answer

Allow access if MFA is present

Answer

Deny access if MFA is present

Answer

Grant access with a condition requiring MFA

Question 2

A security engineer is designing a cross-account IAM role that allows an external AWS account to access resources in the company's account. The external account's root user must not be able to delegate permissions to other users. Which trust policy condition should be included?

Accepted Answer

Condition: ArnLike aws:PrincipalArn. The trust policy condition should use ArnLike with aws:PrincipalArn to restrict the principal to a specific IAM role in the external account. This ensures that only that role can assume the cross-account role, preventing the root user from assuming it directly and thereby stopping the root user from delegating permissions. Option A (aws:PrincipalOrgID) restricts to an organization but does not prevent delegation within the account. Option B (aws:PrincipalIsAWSService false) only excludes AWS services but users and roles can still assume. Option D (aws:SourceAccount) restricts by account but does not prevent any entity in that account, including root, from assuming.

Answer

Condition: StringEquals aws:PrincipalOrgID

Answer

Condition: Bool aws:PrincipalIsAWSService false

Answer

Condition: StringEquals aws:SourceAccount

Question 3

A company is using AWS Organizations to manage multiple accounts. The security team wants to prevent any IAM user from creating access keys. Which type of policy should be used to enforce this control across all accounts?

Accepted Answer

Service Control Policy (SCP). A Service Control Policy (SCP) can be applied to the organization root or OUs to centrally deny the IAM action 'CreateAccessKey' across all member accounts, preventing any IAM user from creating access keys. Option B is incorrect because CloudTrail only logs actions, it does not enforce policies. Option C is incorrect because an AWS Config rule can detect non-compliant changes but cannot prevent them. Option D is incorrect because IAM permissions boundaries are applied per account and cannot enforce a blanket denial across all accounts in an organization.

Answer

AWS CloudTrail trail

Answer

AWS Config managed rule

Answer

IAM permissions boundary

Question 4

A company uses AWS KMS to encrypt data in S3 buckets. The security team needs to ensure that KMS keys can only be used by specific IAM roles within the same account. Which key policy should be applied?

Accepted Answer

"Principal": {"AWS": "arn:aws:iam::123456789012:role/AllowedRole"}. Specifying the exact IAM role ARN in the key policy grants only that role access to the KMS key. Option A is incorrect because it allows all IAM principles in the account, which is too broad. Option B is incorrect because it allows any AWS principal, which violates the security requirement. Option C is incorrect because it allows the root user and effectively all IAM users/roles in the account.

Answer

"Principal": {"AWS": "arn:aws:iam::123456789012:*"}

Answer

"Principal": {"AWS": "*"}

Answer

"Principal": {"AWS": "arn:aws:iam::123456789012:root"}

Question 5

A company is using AWS CloudFormation to deploy infrastructure. The security team wants to enforce that all S3 buckets created by CloudFormation have encryption enabled. Which approach should be used to enforce this policy?

Accepted Answer

Use AWS CloudFormation Guard to validate templates. AWS CloudFormation Guard can validate templates before deployment to ensure encryption is configured. Option A is wrong because Service Catalog enforces governance on provisioned products, but does not directly validate CloudFormation templates for encryption. Option C is wrong because CloudTrail detects but does not enforce. Option D is wrong because SCPs apply at the account level and cannot enforce specific resource configurations like bucket encryption within a template.

Answer

Use AWS Service Catalog to enforce encryption

Answer

Enable AWS CloudTrail to detect unencrypted buckets

Answer

Create an SCP to deny creation of unencrypted S3 buckets

Question 6

A company wants to centrally manage access keys for all IAM users across multiple accounts. Which AWS service should be used to rotate access keys automatically?

Accepted Answer

AWS IAM. AWS IAM is the service that manages IAM users and access keys. While there is no built-in automatic rotation feature in IAM, you can automate access key rotation using IAM APIs or the AWS CLI. Among the given options, AWS IAM is the correct choice because it directly handles access keys. AWS STS provides temporary credentials, not access key management. AWS Secrets Manager can store secrets but cannot automatically rotate IAM access keys. AWS CloudHSM is for hardware-based cryptographic key storage.

Answer

AWS STS

Answer

AWS Secrets Manager

Answer

AWS CloudHSM

Question 7

A security engineer is configuring an S3 bucket policy to restrict access to only requests that originate from a specific VPC endpoint. Which condition key should be used?

Accepted Answer

aws:SourceVpce. The correct condition key is 'aws:SourceVpce' because it allows you to restrict access to an S3 bucket based on the VPC endpoint ID. Option A ('aws:VpcSourceIp') is not a valid AWS condition key. Option B ('aws:SourceVpc') restricts access by VPC ID, not the specific VPC endpoint. Option C ('aws:SourceIp') restricts by client IP address, which is not specific to VPC endpoints. Option D ('aws:SourceVpce') is the correct key to use for restricting access to a specific VPC endpoint.

Answer

aws:VpcSourceIp

Answer

aws:SourceVpc

Answer

aws:SourceIp

Question 8

A company is using AWS Config to evaluate resource compliance. They need to ensure that all EC2 instances have a specific tag key 'Environment' with a value of 'Production' or 'Development'. Which type of AWS Config rule should be used?

Accepted Answer

Custom AWS Config rule using AWS Lambda. A custom AWS Config rule using AWS Lambda allows you to implement custom logic to check that EC2 instances have the 'Environment' tag with a value of either 'Production' or 'Development'. Option A is incorrect because while custom rules can be written in Python, they must be deployed as Lambda functions; the distinction here is that the correct answer emphasizes the use of Lambda, which is the mechanism for custom rules. Option C is incorrect because the AWS Config managed rule 'ec2-instance-tags' only checks for the presence of tags, not specific values or multiple allowed values. Option D is incorrect because the managed rule 'required-tags' can check for a specific tag key and a single expected value, but it cannot handle the multiple allowed values (Production or Development) as required by the policy. Therefore, a custom Lambda rule is needed.

Answer

Custom AWS Config rule written in Python

Answer

AWS Config managed rule 'ec2-instance-tags'

Answer

AWS Config managed rule 'required-tags'

Question 9

A company needs to grant an IAM user permissions to start and stop specific EC2 instances. Which IAM policy element should be used to restrict actions to specific instances?

Accepted Answer

Condition. (Resource) is incorrect because while the Resource element can specify instance ARNs, it does not allow dynamic filtering based on tags. Option B (Condition) is correct because the Condition element can use the 'ec2:ResourceTag' condition key to restrict actions to instances with specific tags. Option C (Principal) is incorrect because the Principal element specifies who is allowed to perform actions, not the resources. Option D (NotAction) is incorrect because NotAction is used to exclude specific actions from a policy, not to limit actions to specific resources.

Answer

Resource

Answer

Principal

Answer

NotAction

Question 10

Which THREE AWS services can be used to centrally manage and audit permissions across multiple accounts in AWS Organizations?

Accepted Answer

AWS IAM Access Analyzer. The correct answers are C: AWS IAM Access Analyzer, D: AWS CloudTrail, and E: AWS Config. IAM Access Analyzer helps identify resources shared with external entities by analyzing resource policies across accounts in AWS Organizations. CloudTrail logs API activity across accounts and can be aggregated into a single trail for auditing. AWS Config allows you to aggregate compliance data and configuration changes from multiple accounts and regions using an aggregator. AWS Security Hub is another service but is not listed. Options A and B are incorrect because Amazon Inspector is a vulnerability assessment service, and AWS Shield is a DDoS protection service; neither centrally manages or audits permissions.

Answer

Amazon Inspector

Answer

AWS Shield

Question 11

Which TWO AWS services can be used to detect and alert on unauthorized API calls in real time?

Accepted Answer

Amazon CloudWatch Alarms. Options A and C are correct. Amazon CloudWatch Alarms can be set on CloudWatch Logs metric filters that detect patterns from CloudTrail logs, enabling real-time alerting on unauthorized API calls. Amazon EventBridge can also process CloudTrail events and trigger alerts or automated actions based on patterns indicating unauthorized API calls. Option B is incorrect because AWS KMS is for encryption key management. Option D is incorrect because IAM is for identity and access management, not monitoring or alerting. Option E is incorrect because AWS Config is for compliance evaluation and configuration tracking, not real-time alerting on API calls.

Answer

AWS KMS

Answer

AWS IAM

Answer

AWS Config

Question 12

Refer to the exhibit. An IAM policy is attached to a user. The user attempts to upload an object to my-bucket using server-side encryption with AWS KMS (SSE-KMS). What is the outcome?

Accepted Answer

The upload fails because the Deny statement denies any PutObject that does not use AES256 encryption.. The policy includes a Deny statement that denies s3:PutObject unless encryption is AES256, as indicated by the condition 's3:x-amz-server-side-encryption' not equal to 'AES256'. Since SSE-KMS uses a different encryption header (aws:kms), it does not satisfy the condition, so the Deny applies and the upload fails. The Allow statement only permits PutObject when encryption is AES256, but the Deny overrides any allow because it is explicit. Options B, C, and D are incorrect because the Deny explicitly blocks non-AES256 encryption, making the failure inevitable regardless of the Allow statement.

Answer

The upload fails because the Allow statement requires AES256 encryption.

Answer

The upload succeeds because the policy does not explicitly deny SSE-KMS.

Answer

The upload succeeds because the Allow statement matches the s3:PutObject action.

Question 13

Refer to the exhibit. A security engineer runs the CLI command to determine if the IAM user 'testuser' created a key pair in January 2023. The output shows one event. What can be concluded from this output?

Accepted Answer

The user 'testuser' created the key pair 'my-key-pair' on January 15, 2023.. The CloudTrail event shows the user 'testuser' performed a CreateKeyPair action on January 15, 2023, resulting in the key pair 'my-key-pair'. Option A is incorrect because the event is logged in the same account (the user's ARN is from the same account). Option C is incorrect because the command specifically queries for CreateKeyPair events, not all actions. Option D is incorrect because CreateKeyPair is a write operation (indicated by ReadOnly: false).

Answer

The key pair 'my-key-pair' was created in a different AWS account.

Answer

The user 'testuser' performed all actions in January 2023.

Answer

The user 'testuser' performed a read-only operation.

Question 14

Refer to the exhibit. A company uses this CloudFormation template. What security best practice is being violated?

Accepted Answer

The security group allows SSH access from all IP addresses.. The security group allows SSH access from all IP addresses (0.0.0.0/0), which is a significant security risk that exposes the instance to unauthorized access. Option A is wrong because the instance type is a performance consideration, not a security best practice. Option C is wrong because specifying the AMI ID as a parameter is not a security requirement; it is a parameterization best practice but not security-related. Option D is wrong because while encryption is a security best practice, the most critical violation here is the open SSH access, as it directly exposes the instance to potential attacks.

Answer

The instance type is too small for production workloads.

Answer

The AMI ID is not specified as a parameter.

Answer

The EBS volume is not encrypted.

Question 15

A company has a multi-account AWS Organization with hundreds of accounts. The security team wants to prevent any IAM user from creating access keys in any account. What is the most scalable and secure approach?

Accepted Answer

Apply an SCP that denies the IAM:CreateAccessKey action to all accounts in the organization.. A service control policy (SCP) applied at the root or OU level can deny the IAM:CreateAccessKey action across all accounts in the organization, providing a scalable and preventive control. Option A is wrong: IAM Access Analyzer only generates findings, it does not block the creation of access keys. Option B is wrong: IAM password policies can control password requirements but do not restrict IAM user permissions to create access keys. Option D is wrong: AWS Config rules can detect and auto-remediate, but they are reactive and require per-account configuration, making them less scalable and secure than a preventive SCP.

Answer

Use IAM Access Analyzer to generate findings when access keys are created.

Answer

Configure IAM password policies in each account to disallow access keys.

Answer

Create an AWS Config rule in each account to automatically delete access keys.