SCS-C02 Management and Security Governance Practice Test 13 — 15 Questions

Question 1

A security team is reviewing IAM roles and policies. They want to ensure that any new IAM role created in the account must include a specific managed policy (e.g., SecurityAudit). What AWS service can enforce this requirement?

Accepted Answer

Service control policy (SCP) in AWS Organizations. Option C is correct because SCPs can deny IAM role creation if the role does not have a specific policy attached. Option A is wrong because IAM policies define permissions, not enforce role creation rules. Option B is wrong because AWS Config can detect noncompliant roles but cannot prevent their creation. Option D is wrong because CloudTrail logs API calls but does not enforce policies.

Answer

AWS CloudTrail

Answer

AWS Config rules

Answer

IAM permissions boundary

Question 2

A company uses AWS Organizations with a management account and several member accounts. The security team wants to restrict the use of specific AWS services (e.g., EC2, Lambda) in certain accounts based on the account's environment (dev, test, prod). Which approach should be used to implement this requirement?

Accepted Answer

Use AWS Organizations to tag accounts (e.g., Environment=Dev) and use SCPs with conditions to deny access to services based on tags.. Option A is correct because tagging accounts in Organizations and using SCPs with conditions allows granular control based on account tags. Option B is wrong because IAM roles are per-user, not per-account service restrictions. Option C is wrong because Config rules detect usage but do not prevent it. Option D is wrong because CloudTrail logs but does not enforce restrictions.

Answer

Use AWS CloudTrail to monitor API calls and revoke access after the fact.

Answer

Create IAM roles in each account with policies that deny access to services.

Answer

Use AWS Config rules to detect and alert when restricted services are used.

Question 3

A company wants to centralize the management of IAM users and groups for multiple AWS accounts. Which AWS service should be used to allow users to access multiple accounts with a single set of credentials?

Accepted Answer

AWS IAM Identity Center (AWS SSO). Option B is correct because AWS IAM Identity Center (successor to AWS SSO) allows users to sign in once and access multiple accounts using role assignments. Option A is wrong because IAM users are per-account. Option C is wrong because Cognito is for customer-facing identity. Option D is wrong because Organizations does not provide single sign-on.

Answer

AWS Organizations

Answer

IAM users and groups in each account

Answer

Amazon Cognito

Question 4

A security engineer needs to ensure that all EC2 instances launched in an account have a specific tag (e.g., CostCenter) applied. If an instance is launched without the tag, it should be automatically terminated. Which solution meets these requirements with minimal effort?

Accepted Answer

Use AWS Config rules with an automatic remediation action that invokes a Lambda function to terminate the instance.. Option D is correct because AWS Config rules can detect untagged instances and trigger a Lambda function to terminate them. Option A is wrong because SCPs cannot enforce tagging on EC2 instances. Option B is wrong because Tag Policies only enforce tagging on resources that support tags, but they do not auto-remediate. Option C is wrong because CloudTrail can detect launch events but cannot automatically terminate instances.

Answer

Use an SCP to deny ec2:RunInstances if the request does not include the required tag.

Answer

Use AWS Organizations Tag Policies to enforce the tag.

Answer

Use AWS CloudTrail to detect RunInstances events and send alerts to the security team.

Question 5

A company is using AWS Organizations and wants to delegate the administration of certain accounts to different teams. For example, the finance team should be able to manage billing-related accounts, but not development accounts. Which AWS feature allows this type of delegation?

Accepted Answer

AWS Organizations delegated administrator. Option A is correct because AWS Organizations delegated administrator allows you to register member accounts as delegated administrators for specific services, giving them limited administrative permissions. Option B is wrong because SCPs are for denying permissions, not for delegation. Option C is wrong because IAM roles are for users, not for account-level delegation. Option D is wrong because AWS SSO provides user access, not account management delegation.

Answer

AWS IAM Identity Center (AWS SSO)

Answer

Service control policies (SCPs)

Answer

IAM roles in each account

Question 6

A company wants to receive real-time notifications when an IAM user in their AWS account performs a console login. Which AWS service should be used to monitor and alert on this activity?

Accepted Answer

AWS CloudTrail and Amazon EventBridge. Option C is correct because CloudTrail logs console login events, and CloudWatch Events (now Amazon EventBridge) can trigger a notification based on those events. Option A is wrong because IAM does not provide real-time monitoring. Option B is wrong because Config is for resource configuration changes, not API calls. Option D is wrong because Trusted Advisor provides best-practice checks, not real-time monitoring.

Answer

AWS IAM

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 7

A security engineer is configuring AWS Config to track changes to security groups in a VPC. The engineer wants to be notified when a security group is modified. Which TWO steps are required to achieve this?

Accepted Answer

Configure an SNS topic and subscribe to it to receive notifications when the Config rule triggers.. Options A and B are correct. Option A: AWS Config rule with a custom or managed rule can track security group changes. Option B: Config rule can trigger a Lambda function via SNS to send notifications. Option C is wrong because CloudTrail is not needed for Config. Option D is wrong because VPC Flow Logs are for network traffic. Option E is wrong because GuardDuty is for threat detection.

Answer

Enable AWS CloudTrail to log security group changes.

Answer

Enable Amazon GuardDuty to detect security group modifications.

Answer

Enable VPC Flow Logs to capture security group activity.

Question 8

A company is implementing a data classification policy using AWS. The policy requires that all S3 objects containing personally identifiable information (PII) be automatically tagged and encrypted. Which THREE services should be used together to meet this requirement?

Accepted Answer

Amazon Macie. Options A, B, and D are correct. Option A: Amazon Macie can automatically discover and classify PII in S3. Option B: AWS Lambda can process Macie findings and apply tags. Option D: S3 default encryption ensures objects are encrypted. Option C is wrong because AWS Config does not classify data. Option E is wrong because CloudTrail is for logging.

Answer

AWS Config

Answer

AWS CloudTrail

Question 9

A company is using AWS Organizations to manage multiple accounts. The security team wants to ensure that no root user credentials are used for any account. Which TWO actions should be taken to enforce this?

Accepted Answer

Create a service control policy (SCP) that denies all actions for the root user.. Options A and B are correct. Option A: SCP can deny all actions from the root user. Option B: IAM password policy does not apply to root user, but enabling multi-factor authentication (MFA) for root user is a best practice. Option C is wrong because deleting root user is not possible. Option D is wrong because IAM roles cannot prevent root user actions. Option E is wrong because AWS Config cannot prevent root user usage.

Answer

Delete the root user from all accounts.

Answer

Use AWS Config rules to detect root user activity.

Answer

Create an IAM role that prevents root user actions.

Question 10

A security engineer has attached the above IAM policy to a user. The user reports that they cannot upload objects to the S3 bucket from their office, which has a public IP address of 198.51.100.50. What is the MOST likely reason for the failure?

Accepted Answer

The policy restricts access to the 10.0.0.0/8 IP range, but the user's IP is outside that range.. Option D is correct because the policy only allows access from the 10.0.0.0/8 IP range, but the user's office IP is 198.51.100.50, which is outside that range. Option A is wrong because the policy allows s3:PutObject. Option B is wrong because the policy applies to the user. Option C is wrong because the bucket is not specified as the resource for the action s3:PutObject, but the resource is the bucket contents (*).

Answer

The policy does not specify the bucket resource for the PutObject action.

Answer

The policy is not attached to the user.

Answer

The policy does not allow the s3:PutObject action.

Question 11

A security engineer is auditing the AWS Organizations structure. The engineer notices that the 'Management' account (111111111111) has a status of 'ACTIVE' and joined method 'CREATED'. The engineer is concerned about potential security risks. Which action should the engineer take to improve security?

Accepted Answer

Enable multi-factor authentication (MFA) for the root user of the management account.. Option A is correct because the root user of the management account should have MFA enabled to protect the account that can modify SCPs and manage other accounts. Option B is wrong because removing the management account is not possible. Option C is wrong because deleting the management account is not possible. Option D is wrong because the root user cannot be deleted.

Answer

Remove the management account from the organization.

Answer

Delete the management account and create a new one.

Answer

Create a new root user for the management account and delete the old one.

Question 12

A security engineer applies the above bucket policy to an S3 bucket. What is the effect of this policy?

Accepted Answer

All requests to the bucket must be made over HTTPS.. Option A is correct because the policy denies all actions to the bucket if the request is not made over HTTPS (SecureTransport is false). This ensures only encrypted connections are allowed. Option B is wrong because it denies non-HTTPS requests, not allows them. Option C is wrong because it denies all actions, not just a few. Option D is wrong because the policy explicitly denies non-HTTPS requests.

Answer

All requests to the bucket are denied regardless of protocol.

Answer

The policy has no effect because it uses a condition.

Answer

All requests to the bucket must be made over HTTP.

Question 13

A company is using AWS Organizations to manage multiple accounts. The security team needs to enforce that all newly created S3 buckets across the organization have server-side encryption (SSE-S3) enabled by default. Which solution is MOST operationally efficient?

Accepted Answer

Apply an SCP to the root organizational unit that denies s3:CreateBucket if the bucket lacks encryption settings.. Using an SCP to deny creation of buckets without encryption is the most efficient because it prevents noncompliant buckets from being created at the root level. Option A (Lambda on CloudTrail) is reactive and less efficient. Option C (AWS Config rule) only detects noncompliant buckets after creation. Option D (IAM permissions) does not block at the organization level.

Answer

Create an AWS Lambda function that is triggered by S3 event notifications to enable encryption on any new bucket.

Answer

Set a default bucket encryption policy in each account’s S3 console.

Answer

Use AWS Config with a managed rule s3-bucket-server-side-encryption-enabled to trigger remediation.

Question 14

A security engineer is designing a solution to automatically remediate noncompliant EC2 security groups. The company uses AWS Organizations with multiple accounts. The engineer wants to deploy an AWS Config rule and a custom Lambda function in a central security account to evaluate and remediate security groups across all accounts. Which combination of steps is REQUIRED to allow the Lambda function to modify security groups in member accounts? (Choose TWO.)

Accepted Answer

Create an IAM role in each member account that allows the central security account to assume it.. The correct approach is to use AWS Config aggregated rules with remediation actions that invoke Lambda cross-account. Option A is required to allow the central account to assume a role in member accounts; Option C is required to invoke the Lambda function from Config. Option B (same account) is not cross-account. Option D is not required because Config aggregates can work with individual accounts. Option E is redundant.

Answer

Use AWS CloudFormation StackSets to deploy the Lambda function to all member accounts.

Answer

Attach a resource-based policy to the Lambda function granting access to Config from all member accounts.

Answer

Create the Lambda function in each member account and configure Config rules in each account.

Question 15

A company wants to ensure that all IAM users in an account have multi-factor authentication (MFA) enabled. A security administrator needs to identify users who do not have MFA. Which AWS service should the administrator use?

Accepted Answer

IAM Credential Report. AWS IAM Credential Report lists all IAM users and their MFA status, providing a quick way to identify users without MFA. Option A (IAM Access Analyzer) focuses on resource policies. Option C (CloudTrail) logs events. Option D (AWS Config) can check compliance but requires a rule; the credential report is more direct.

Answer

AWS CloudTrail

Answer

IAM Access Analyzer

Answer

AWS Config