SCS-C02 Management and Security Governance Practice Test 13 — 15 Questions

Question 1

A company wants to ensure that all S3 buckets in their AWS account have encryption enabled. Which AWS service can continuously evaluate compliance and automatically remediate non-compliant buckets?

Accepted Answer

AWS Config. (AWS Config) is correct: AWS Config with the managed rule 's3-bucket-server-side-encryption-enabled' can continuously evaluate S3 buckets for encryption compliance and trigger auto-remediation actions to enable encryption on non-compliant buckets. Option A (AWS CloudTrail) is incorrect because CloudTrail records API activity but does not evaluate configuration compliance or auto-remediate. Option C (AWS IAM) is incorrect because IAM manages user permissions, not bucket encryption configurations. Option D (Amazon S3) is incorrect because S3 itself does not provide automatic compliance evaluation or remediation; it requires an external service like AWS Config.

Answer

AWS CloudTrail

Answer

AWS IAM

Answer

Amazon S3

Question 2

An organization uses AWS Organizations with multiple OUs. The security team wants to ensure that any new account created in the 'Production' OU automatically gets a set of mandatory tags (CostCenter, Environment) and that these tags cannot be removed. What is the most effective approach?

Accepted Answer

Apply an SCP that denies changes to the specified tags for all accounts in the Production OU.. An SCP can be applied to the Production OU in AWS Organizations to deny actions that modify the specified tags (using the aws:TagKeys condition key). This prevents removal or modification of CostCenter and Environment tags. Option A is wrong because AWS Service Catalog can provision resources but does not enforce tag immutability across accounts. Option B is wrong because AWS Config rules are detective, not preventive. Option C is wrong because IAM policies in each account are less centralized and harder to manage; SCPs provide a central control.

Answer

Use AWS Service Catalog to provision accounts with pre-defined tags.

Answer

Use AWS Config rules to detect untagged resources and send alerts.

Answer

Create an IAM policy in each account that prohibits tag removal.

Question 3

A security auditor needs to view a list of all IAM users, including their last activity timestamps, for a compliance review. Which AWS service provides this information natively?

Accepted Answer

AWS IAM credential report. IAM's credential report includes last activity timestamps for each user. Option A is wrong because CloudTrail logs API events but does not provide a consolidated report of user activity timestamps. Option B is wrong because IAM Access Analyzer analyzes resource policies, not user activity. Option D is wrong because AWS Config evaluates resource configurations, not user activity.

Answer

AWS CloudTrail

Answer

IAM Access Analyzer

Answer

AWS Config

Question 4

A company wants to centrally manage and enforce encryption on all EBS volumes across multiple AWS accounts. Which AWS service can be used to define and enforce encryption policies at the organizational level?

Accepted Answer

AWS Organizations. AWS Organizations enables centralized management of policies across multiple accounts. Through Service Control Policies (SCPs), you can enforce EBS encryption by default at the organizational level, ensuring all EBS volumes are encrypted across all member accounts. Option A (AWS Config) can evaluate compliance but does not enforce policies natively across accounts. Option B (IAM) is account-specific and cannot define org-wide policies. Option C (AWS KMS) manages encryption keys but does not enforce encryption policies on EBS volumes.

Answer

AWS Config

Answer

AWS IAM

Answer

AWS Key Management Service (KMS)

Question 5

A security engineer is designing a system to detect and respond to IAM policy changes that could grant excessive permissions. The solution must alert within minutes of the change and automatically revert the change if it violates a predefined baseline. Which combination of services should the engineer use?

Accepted Answer

AWS CloudTrail, Amazon CloudWatch Events, and AWS Lambda. AWS CloudTrail logs IAM policy changes, and Amazon CloudWatch Events monitors those logs in near real-time. When a change is detected, CloudWatch Events triggers an AWS Lambda function that evaluates the new policy against a predefined baseline (e.g., stored in S3). If the policy violates the baseline, the Lambda function automatically reverts the change. Option A is wrong because Amazon S3 alone cannot process events or trigger remediation. Option C is wrong because AWS Config evaluates resources periodically, not in real-time, and Systems Manager is not designed for automatic IAM policy rollback. Option D is wrong because IAM Access Analyzer identifies resources shared with external entities but does not provide event-driven auto-remediation.

Answer

AWS CloudTrail and Amazon S3

Answer

AWS Config and AWS Systems Manager

Answer

IAM Access Analyzer and AWS Lambda

Question 6

What is the purpose of an AWS Service Control Policy (SCP) in AWS Organizations?

Accepted Answer

To set permission guardrails that restrict what actions accounts in the organization can perform.. SCPs are used to centrally control the maximum available permissions for all accounts in an organization. Option A is wrong because SCPs do not grant permissions; they restrict them. Option B is wrong because SCPs apply to all users and roles, not just root. Option C is wrong because SCPs are not for monitoring; they are permission guardrails.

Answer

To grant specific permissions to users in member accounts.

Answer

To restrict only the root user of each member account.

Answer

To monitor and log API activity across the organization.

Question 7

A company wants to implement a least-privilege access model for their AWS resources. Which TWO of the following are best practices for achieving this?

Accepted Answer

Grant permissions only for the specific actions required.. Granting only the necessary permissions is the core of least-privilege. Option D is correct because using conditions to restrict access based on attributes like source IP or time further enforces least-privilege. Option A is wrong because using a single IAM role for all users violates the least-privilege principle by granting excessive permissions. Option C is wrong because attaching policies to groups is a best practice for manageability, but it does not directly address least-privilege. Option E is wrong because using only AWS managed policies may grant more permissions than needed; customer managed policies can be tailored to specific requirements.

Answer

Use a single IAM role for all users in the account.

Answer

Attach IAM policies to groups rather than individual users.

Answer

Always use AWS managed policies instead of customer managed policies.

Question 8

Which TWO of the following are valid AWS IAM security best practices?

Accepted Answer

Implement a strong password policy for IAM users.. A strong password policy enforces complexity requirements for IAM users. Option D is correct: enabling MFA for privileged users adds an extra layer of security. Option B is wrong: sharing IAM user access keys among team members violates security best practices; each user should have their own keys. Option C is wrong: deleting IAM users is not recommended because it removes audit trails; instead, disable or deactivate the user. Option E is wrong: the AWS account root user should be avoided for everyday tasks; use IAM users with appropriate permissions.

Answer

Share IAM user access keys among team members for convenience.

Answer

Delete IAM users instead of disabling them when not needed.

Answer

Use the AWS account root user for everyday administrative tasks.

Question 9

A company is implementing a multi-account strategy using AWS Organizations. The security team wants to enforce that all newly created member accounts automatically have an IAM role that allows read-only access to the management account. Which configuration should be used?

Accepted Answer

Use AWS CloudFormation StackSets to deploy the role to all existing and future accounts.. AWS CloudFormation StackSets with service-managed permissions can automatically deploy stack instances to all existing and future accounts in an organization. By defining a stack set that creates the IAM role with read-only access, it will be automatically deployed to new accounts as they are added, without any manual intervention. Option A is a workaround but introduces complexity and is not the native automatic solution. Option C is incorrect because AWS Config rules evaluate existing resources and are not proactive for new accounts. Option D is incorrect because SCPs do not have an 'iam_role' setting; they are used to control permissions, not to provision roles automatically.

Answer

Create an AWS Lambda function that listens for AWS CloudTrail CreateAccount events and creates the role in the new account.

Answer

Use an AWS Config managed rule to evaluate new accounts and trigger a remediation action to create the role.

Answer

Configure an SCP with the 'iam_role' setting to specify a role name and path to be automatically created in new accounts.

Question 10

A security engineer is reviewing an SCP that denies access to a specific AWS service. The engineer notices that the SCP has an Effect of 'Deny' for 's3:PutObject' but the condition block uses 'StringEquals' with 'aws:SourceIp' set to an IP range. Users in the account are still able to upload objects to S3 from IP addresses outside the range. What is the most likely reason?

Accepted Answer

The SCP condition key 'aws:SourceIp' is not available for use in SCPs; SCPs only support condition keys that are global and listed in the AWS Global Condition Context Keys documentation for SCPs.. SCPs do not support the 'aws:SourceIp' condition key because it is not a global condition key listed in the AWS Global Condition Context Keys documentation for SCPs. SCPs only support condition keys that are global and applicable to all services. Therefore, the condition block in the SCP is ignored, and the 'Deny' effect does not apply, allowing users to upload objects from any IP. Option A is incorrect because SCPs do support conditions, but only specific global condition keys. Option B is incorrect because SCPs apply to all principals in the account, including IAM users, groups, and roles. Option D is incorrect because SCPs are evaluated before IAM policies and can deny actions regardless of IAM permissions.

Answer

The SCP condition key 'aws:SourceIp' is not supported for SCPs; SCPs only support conditions that are resource-based.

Answer

The SCP only applies to IAM users and groups, not to the root user.

Answer

The SCP is evaluated after IAM policies, so an IAM policy allowing the action overrides the SCP.

Question 11

A company has a requirement to audit all API calls made to AWS services in their account. Which AWS service should be used to meet this requirement?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity in the account, which meets the requirement to audit all API calls. Option A (AWS Config) is incorrect because it records resource configuration changes, not API calls. Option B (Amazon Inspector) is incorrect because it is a vulnerability assessment service. Option C (Amazon GuardDuty) is incorrect because it is a threat detection service.

Answer

AWS Config

Answer

Amazon Inspector

Answer

Amazon GuardDuty

Question 12

A security engineer creates the IAM policy shown in the exhibit. The policy is attached to an IAM role. When a user assumes the role and attempts to upload an object to the bucket without specifying server-side encryption, what is the expected behavior?

Accepted Answer

The request is denied because the condition is not met.. The policy requires the condition s3:x-amz-server-side-encryption to be equal to aws:kms. If the request does not include encryption, the condition fails and the request is denied. Option B is wrong because the policy does not allow requests without encryption. Option C is wrong because the condition applies to PutObject as well. Option D is wrong because the condition is not ignored.

Answer

The request succeeds because the condition is ignored for PutObject.

Answer

The request is denied only if the object is publicly accessible.

Answer

The request succeeds because the condition is only for GetObject.

Question 13

A company wants to ensure that all IAM users have multi-factor authentication (MFA) enabled. Which AWS service can be used to detect users without MFA and automatically send a notification?

Accepted Answer

AWS Config. AWS Config is the correct answer because it provides a managed rule 'iam-user-mfa-enabled' that can evaluate whether IAM users have MFA enabled. When a non-compliant user is detected, AWS Config can trigger an SNS notification to alert administrators. AWS Trusted Advisor (option A) only checks MFA on the root account, not all IAM users. AWS CloudTrail (option B) records API activity but does not evaluate configuration rules. AWS IAM (option D) itself does not have automatic detection and notification capabilities for MFA status.

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Answer

AWS IAM

Question 14

A security engineer is designing a system to centrally manage security rules across multiple AWS accounts. The engineer wants to ensure that any resources that are non-compliant with security policies are automatically remediated. Which combination of services should the engineer use?

Accepted Answer

AWS Config with AWS Lambda for automatic remediation. AWS Config continuously evaluates resource configurations against desired policies and can trigger AWS Lambda functions for automatic remediation when non-compliant resources are detected. Option A is incorrect because AWS CloudTrail logs API calls but does not evaluate or enforce compliance. Option B is incorrect because Amazon GuardDuty provides threat detection, not configuration compliance. Option C is incorrect because AWS Security Hub aggregates security findings but does not automatically remediate; it requires integration with other services like AWS Config and Lambda for remediation.

Answer

AWS CloudTrail with Amazon SNS

Answer

Amazon GuardDuty with AWS Step Functions

Answer

AWS Security Hub with Amazon EventBridge

Question 15

A company uses AWS Organizations with many accounts. The security team wants to ensure that no account can disable AWS CloudTrail or stop logging. Which configuration should be used?

Accepted Answer

Apply an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail.. An SCP (Service Control Policy) applied at the organizational level can deny the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions, preventing any account from disabling CloudTrail or stopping logging. Option A is incorrect because CloudTrail log file validation ensures integrity of log files but does not prevent stopping logging. Option B is incorrect because IAM policies attached to the root user can be overridden by the root user itself and do not prevent actions at the account level. Option C is incorrect because AWS Config rules can detect and alert when CloudTrail is modified, but they cannot prevent the modification.

Answer

Enable CloudTrail log file validation.

Answer

Attach an IAM policy to the root user in each account.

Answer

Use AWS Config rules to detect and alert when CloudTrail is modified.