SCS-C02 Management and Security Governance Practice Test 13 — 15 Questions

Question 1

Which TWO AWS services can be used to enforce that specific resource types (e.g., EC2 instances) are tagged with a 'CostCenter' tag? (Choose two.)

Accepted Answer

AWS Organizations tag policies. AWS Config can evaluate resource tagging and AWS Organizations can use tag policies. IAM is for permissions, not enforcement; CloudFormation can be used but not for existing resources; Service Catalog is for provisioning, not enforcement.

Answer

AWS Service Catalog

Answer

AWS CloudFormation

Answer

AWS IAM

Question 2

A security engineer needs to ensure that an Amazon S3 bucket is not publicly accessible. Which AWS service can be used to continuously monitor and alert if the bucket becomes public?

Accepted Answer

AWS Config. (AWS Config) is correct because AWS Config has managed rules such as 's3-bucket-public-read-prohibited' and 's3-bucket-public-write-prohibited' that can evaluate S3 bucket policies and ACLs, continuously monitor configurations, and trigger alerts via Amazon SNS when a bucket becomes public. Option A (AWS CloudTrail) is wrong because CloudTrail records API calls but does not evaluate resource configurations. Option C (AWS Trusted Advisor) provides best-practice checks but does not offer continuous monitoring and alerting for configuration changes. Option D (Amazon GuardDuty) focuses on threat detection, not configuration compliance.

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Question 3

A security engineer needs to automate the response to an AWS CloudTrail log event that indicates a potential security threat. Which AWS service would be most appropriate to orchestrate the automated response?

Accepted Answer

AWS Step Functions. AWS Step Functions is a serverless orchestration service that models workflows as state machines, making it ideal for coordinating multi-step, multi-service incident response (e.g., isolate instance → snapshot → notify → create ticket) with retries, branching, and human-approval steps. While Lambda executes individual functions, Step Functions provides the durable orchestration, state tracking, and error handling needed for a reliable automated response. It integrates natively with EventBridge, Lambda, SNS, and security services.

Answer

AWS Lambda

Answer

Amazon Simple Queue Service (SQS)

Answer

Amazon EventBridge

Question 4

A company has an AWS account with a single VPC and multiple subnets. The security team wants to ensure that no network ACL (NACL) allows inbound SSH (port 22) from 0.0.0.0/0. Which AWS service can be used to detect and alert on such non-compliant NACLs?

Accepted Answer

AWS Config. AWS Config continuously records resource configurations and evaluates them against rules, making it the correct service to detect non-compliant NACLs. You can use the managed rule 'nacl-no-unrestricted-ssh-rdp' (or a custom rule) to flag any NACL that allows inbound SSH from 0.0.0.0/0 and trigger alerts via Amazon EventBridge or SNS. This directly addresses the requirement to detect and alert on non-compliant NACLs.

Answer

Amazon Inspector

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Question 5

A company needs to audit all changes to IAM policies in its AWS account. Which AWS service should be used to record the change history of IAM policies?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the service that records API activity in an AWS account, including all changes to IAM policies. When an IAM policy is created, modified, or deleted, CloudTrail logs the event with details such as the identity of the caller, the time of the API call, the source IP address, and the request parameters. This makes CloudTrail the authoritative source for auditing IAM policy changes.

Answer

Amazon CloudWatch Logs

Answer

Amazon GuardDuty

Answer

AWS Config

Question 6

A security engineer needs to generate a report of all AWS Identity and Access Management (IAM) users who have not used their access keys in the last 90 days. Which AWS service can provide this information?

Accepted Answer

AWS IAM Credentials Report. AWS IAM Credentials Report provides a CSV file with details about IAM users, including last activity dates. Option B is wrong because AWS CloudTrail logs API calls but does not provide a summary report. Option C is wrong because Amazon GuardDuty does not track IAM key usage. Option D is wrong because AWS Config evaluates configurations, not usage.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS Config

Question 7

A company uses AWS Organizations and wants to restrict the AWS Regions in which resources can be created across all member accounts. Which mechanism should be used?

Accepted Answer

Apply a service control policy (SCP) that denies operations in unauthorized regions.. A service control policy (SCP) in AWS Organizations can be used to restrict the AWS Regions in which resources can be created across all member accounts. SCPs define the maximum permissions for accounts and can deny actions in unauthorized regions.

Answer

Use VPC endpoints to restrict API calls to specific regions.

Answer

Configure AWS Config rules to detect and delete resources in unauthorized regions.

Answer

Attach an IAM policy to each user that denies operations in unauthorized regions.

Question 8

A security engineer needs to implement a solution to detect and alert on suspicious API calls in an AWS account. Which TWO AWS services should be integrated to achieve this? (Choose two.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail (C) is correct because it records API activity in the account as management and data events, providing the raw log source needed to detect suspicious API calls. Amazon GuardDuty (E) is correct because it continuously analyzes CloudTrail management events (along with VPC Flow Logs and DNS logs) using threat intelligence and machine learning to detect and alert on suspicious API activity. Together, CloudTrail supplies the API call records and GuardDuty generates the findings and alerts. AWS Config (A) evaluates resource configuration compliance rather than detecting suspicious API behavior, Amazon Inspector (B) scans workloads for software vulnerabilities and network exposure, and AWS Trusted Advisor (D) provides best-practice recommendations, so none of these fulfill the detection-and-alert requirement.

Answer

AWS Config

Answer

Amazon Inspector

Answer

AWS Trusted Advisor

Question 9

A company wants to centrally manage and enforce security policies across multiple AWS accounts using AWS Organizations. Which THREE actions should be taken? (Choose three.)

Accepted Answer

Enable all features in AWS Organizations and create service control policies (SCPs) to restrict actions.. Option B is correct because enabling all features in AWS Organizations unlocks advanced governance capabilities, including service control policies (SCPs), which are the mechanism for centrally restricting the maximum available permissions across member accounts. Option C is correct because AWS CloudTrail provides centralized audit logging of API activity; creating a trail that applies to all accounts and delivers logs to a single S3 bucket in a central account gives the company visibility and evidence of policy enforcement across the organization. Option D is correct because IAM roles in member accounts with trust policies allowing the management account to assume them enable secure cross-account administration without sharing long-term credentials, which is the recommended pattern for centralized management. Option A is not appropriate because the root user of each member account should not be used for routine administrative tasks; it has unrestricted permissions, cannot be constrained by SCPs, and should be protected with MFA and reserved for break-glass scenarios. Option E is incorrect because disabling CloudTrail in member accounts would eliminate the audit trail needed to verify and enforce security policies, undermining the centralized governance goal.

Answer

Use the root user of each member account for administrative tasks.

Answer

Disable CloudTrail in member accounts to reduce costs.

Question 10

A company needs to ensure that its S3 buckets are not publicly accessible. Which TWO AWS services can be used to detect and report on public S3 buckets? (Choose two.)

Accepted Answer

AWS Trusted Advisor. AWS Trusted Advisor (option B) checks S3 bucket permissions and reports any bucket that has open access policies, including public read or write access. AWS Config (option C) can evaluate S3 bucket policies against custom or managed rules (e.g., s3-bucket-public-read-prohibited, s3-bucket-public-write-prohibited) to detect noncompliant buckets and trigger remediation. Both services provide detection and reporting capabilities for public S3 buckets.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

Amazon Inspector

Question 11

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all newly created accounts automatically have AWS CloudTrail enabled, with logs delivered to a centralized S3 bucket. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Create an SCP that denies actions to disable CloudTrail and modify the S3 bucket policy. Use AWS CloudFormation StackSets to deploy a CloudTrail trail in each account.. The correct answer. SCPs cannot enable CloudTrail, but they can prevent disabling it and modifying the S3 bucket policy. To actually enable CloudTrail across all accounts with minimal overhead, AWS CloudFormation StackSets can deploy a CloudTrail trail in each account automatically. Option A is incorrect because SCPs cannot enable services—they only deny or allow actions. Option B is incorrect because AWS Trusted Advisor only checks and alerts; it does not enforce configurations. Option D is incorrect because AWS Config rules with auto-remediation can work but involve more setup and overhead compared to using StackSets, which is purpose-built for deploying resources across multiple accounts. Therefore, C provides the least operational overhead.

Answer

Create an SCP that enables CloudTrail and enforces log delivery to the centralized S3 bucket.

Answer

Use AWS Trusted Advisor to check CloudTrail status and send alerts to the security team.

Answer

Use AWS Config rules with auto-remediation to enable CloudTrail in each account.

Question 12

A security engineer needs to audit all IAM role creations across an AWS account. Which AWS service should be used to log these API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records all API calls made in an AWS account, including IAM role creation events (CreateRole). CloudTrail captures the identity of the caller, the time, source IP, and request parameters, making it the authoritative audit log for API activity. GuardDuty, Config, and CloudWatch Logs do not provide a complete API call history for IAM actions.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 13

A company has a requirement that all access keys for IAM users must be rotated every 90 days. A security engineer needs to implement an automated solution to identify and disable keys that are older than 90 days. Which approach meets the requirement with the least operational overhead?

Accepted Answer

Use an AWS Config rule with auto-remediation to disable keys older than 90 days.. AWS Config can evaluate IAM access key age against a desired rule (e.g., 'iam-access-key-rotated') and trigger automatic remediation using SSM Automation documents to disable keys older than 90 days. This provides a fully automated, low-overhead solution that continuously enforces the requirement without manual intervention.

Answer

Use AWS Trusted Advisor to check key age and send notifications.

Answer

Use AWS CloudTrail to monitor CreateAccessKey events and trigger a Lambda function to check key age.

Answer

Use IAM Access Analyzer to generate findings for unused keys and manually disable them.

Question 14

A company wants to grant cross-account access to an S3 bucket owned by Account A to a user in Account B. The bucket policy in Account A allows access from Account B. What additional configuration is required?

Accepted Answer

The IAM user in Account B must have a policy that allows access to the S3 bucket.. Cross-account access to an S3 bucket requires both a resource-based policy (the bucket policy in Account A) and an identity-based policy (an IAM policy attached to the user or role in Account B). The bucket policy grants access to the external account, but the IAM user in Account B must also have an explicit policy that allows the desired actions (e.g., s3:GetObject). Therefore, Option A is correct. Option B is incorrect because the bucket policy alone is not sufficient. Option C is incorrect because ACLs are not required and are generally not recommended for cross-account access. Option D is incorrect because SCPs (Service Control Policies) are used for organization-wide guardrails and are not required for this specific cross-account access.

Answer

Nothing; the bucket policy is sufficient.

Answer

The bucket must be configured with ACLs.

Answer

An SCP must allow the s3:GetObject action.

Question 15

A company wants to enforce that all IAM users use multi-factor authentication (MFA) to access the AWS Management Console. Which AWS service can be used to enforce this requirement?

Accepted Answer

AWS Identity and Access Management (IAM). AWS IAM allows you to create a policy with a condition that requires MFA for console access. Option A is wrong because AWS Organizations is used to manage multiple accounts, not to enforce MFA on individual users. Option B is wrong because AWS Config can check compliance but cannot enforce the requirement; it only evaluates resource configurations. Option D is wrong because Amazon Cognito is used for external identity federation, not for enforcing MFA on IAM users.

Answer

AWS Organizations

Answer

AWS Config

Answer

Amazon Cognito