SCS-C02 Management and Security Governance Practice Test 14 — 15 Questions

Question 1

A company uses AWS CloudFormation to deploy infrastructure. The security team requires that all CloudTrail trails be encrypted with a customer-managed KMS key. Which CloudFormation template snippet correctly enforces this requirement?

Accepted Answer

Trail with KMSKeyId set to 'arn:aws:kms:us-east-1:123456789012:key/abcd1234-...'. Option C sets KMSKeyId to a customer-managed key, ensuring encryption. Option A uses AWS managed key (default). Option B does not encrypt. Option D uses an alias but could be AWS managed; the KMSKeyId must be a customer-managed key ARN.

Answer

Trail with KMSKeyId set to 'aws/cloudtrail'

Answer

Trail with KMSKeyId set to 'alias/my-cloudtrail-key'

Answer

Trail without KMSKeyId specified

Question 2

A security engineer is investigating a potential data exfiltration incident. The engineer notices that an EC2 instance in a private subnet is making outbound connections to an external IP address on port 443. The VPC has a NAT gateway in a public subnet, and the route table for the private subnet directs 0.0.0.0/0 to the NAT gateway. The security group for the instance allows all outbound traffic. Which AWS service can the engineer use to determine which IAM role or user is responsible for launching the instance?

Accepted Answer

AWS CloudTrail. AWS CloudTrail logs all API calls, including RunInstances, capturing the user or role that launched the instance. Option A (VPC Flow Logs) shows IP traffic but not user identity. Option C (AWS Config) shows resource configuration but not who launched it. Option D (IAM Access Analyzer) analyzes policies.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

IAM Access Analyzer

Question 3

A company has a requirement that all S3 buckets must block public access. The security engineer needs to continuously monitor for compliance and automatically remediate any noncompliant buckets. Which combination of AWS services should the engineer use?

Accepted Answer

AWS Config and AWS Lambda (or SSM Automation). AWS Config with a managed rule (s3-bucket-public-read-prohibited or s3-bucket-public-write-prohibited) can detect noncompliant buckets, and an automatic remediation action (e.g., Lambda or SSM Automation) can apply the block public access settings. Option A is for governance not detection. Option C is reactive and manual. Option D is preventive but not continuous monitoring.

Answer

Amazon GuardDuty and AWS Security Hub

Answer

AWS Organizations SCPs and AWS CloudTrail

Answer

AWS Trusted Advisor and Amazon SNS

Question 4

A company uses AWS Key Management Service (KMS) to encrypt data. The security team needs to ensure that KMS keys cannot be deleted accidentally. Which action should be taken?

Accepted Answer

Create an IAM policy that denies kms:ScheduleKeyDeletion for the key.. Enabling key rotation does not prevent deletion; disabling and scheduling deletion is the way to delete. To prevent accidental deletion, you must disable the option to schedule key deletion via an IAM policy or use a multi-region key? The best practice is to use an IAM policy that denies kms:ScheduleKeyDeletion for specific keys or to use a CloudWatch alarm. Among the options, setting a CloudWatch alarm on the deletion event is a detective control, but the question asks to prevent accidental deletion. The correct answer is to use an IAM policy to deny the schedule key deletion action. Option B (enabling deletion protection) does not exist for KMS. Option A (rotation) does not prevent deletion. Option D (SCP) can help but at org level. The best is IAM policy.

Answer

Apply an SCP that denies kms:ScheduleKeyDeletion for all accounts.

Answer

Enable automatic key rotation.

Answer

Enable deletion protection on the key.

Question 5

A company uses AWS Organizations with a multi-account strategy. The security team wants to ensure that no EC2 instances are launched without an approved Amazon Machine Image (AMI) ID. Which approach should the team take to enforce this requirement across all accounts?

Accepted Answer

Create an SCP that denies ec2:RunInstances if the AMI ID is not in a specified list.. Using an SCP to deny RunInstances with a condition on the AMI ID is the most direct way to enforce at the organization level. Option A (IAM policy in each account) is less manageable. Option C (AWS Config) detects but does not prevent. Option D (Lambda) is reactive.

Answer

Use AWS Config to detect EC2 instances with noncompliant AMI IDs and send notifications.

Answer

Create an IAM policy in each account that denies ec2:RunInstances unless the AMI ID is in an approved list.

Answer

Deploy a Lambda function that terminates any EC2 instance with a noncompliant AMI ID.

Question 6

A security engineer is tasked with ensuring that all S3 buckets in an AWS account have versioning enabled. The engineer needs to identify buckets that do not have versioning enabled. Which AWS service is BEST suited for this task?

Accepted Answer

AWS Config. AWS Config has a managed rule (s3-bucket-versioning-enabled) that can evaluate S3 buckets and report compliance. Option A (CloudTrail) logs API calls. Option B (IAM Access Analyzer) analyzes policies. Option C (Trusted Advisor) has limited checks and may not cover all buckets.

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Answer

IAM Access Analyzer

Question 7

A company is implementing a data retention policy for CloudTrail logs. The logs are stored in an S3 bucket. The policy requires that logs be retained for 7 years and then automatically deleted. Which TWO actions should the security engineer take to meet this requirement?

Accepted Answer

Configure the S3 bucket policy to deny s3:DeleteObject actions for all principals.. Combining S3 lifecycle expiration with object lock or bucket policy is not needed. The simplest is to use S3 lifecycle policy to expire objects after 7 years. Option D ensures that logs are not deleted prematurely before the retention period ends.

Answer

Use AWS Backup to manage retention and deletion.

Answer

Enable S3 Object Lock in compliance mode on the bucket.

Answer

Enable S3 Versioning and create a lifecycle policy to delete noncurrent versions.

Question 8

A company uses AWS Organizations with 50 accounts. The security team wants to centrally manage IAM roles that grant cross-account access to a central security account. Which THREE steps are required to set up this cross-account access?

Accepted Answer

Create an IAM role in each member account with a trust policy that allows the security account to assume the role.. The correct approach: create IAM roles in each member account with a trust policy allowing the security account to assume them, create an IAM user or role in the security account with sts:AssumeRole permissions, and use an SCP to prevent member accounts from modifying the trust policy. Option D is not needed because AWS Organizations can be used but not required. Option E is not necessary.

Answer

Create an IAM group in the security account with permissions to assume roles in member accounts.

Answer

Enable AWS Organizations trusted access with AWS IAM Access Analyzer.

Question 9

A security engineer is auditing IAM policies. The engineer wants to identify if any policy grants 'Effect: Allow' with 'Action: *' and 'Resource: *'. Which TWO AWS services can be used to detect such overly permissive policies?

Accepted Answer

AWS Config. IAM Access Analyzer can analyze policies for broad permissions. AWS Config can evaluate custom rules to check for such policies. Option A (CloudTrail) logs usage, not policy content. Option C (GuardDuty) does not analyze IAM policies. Option E (Trusted Advisor) checks some but not all policies.

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Question 10

A company wants to enforce that all IAM users must use multi-factor authentication (MFA) to access the AWS Management Console. Which policy should be attached to the IAM users or group to enforce this requirement?

Accepted Answer

Deny access if MFA is not present. Option B is correct because the condition 'aws:MultiFactorAuthPresent':'true' in a Deny statement ensures that if MFA is not present, access is denied. Option A is wrong because it allows access without MFA. Option C is wrong because it only denies when MFA is present. Option D is wrong because it allows access with MFA but does not deny without it.

Answer

Allow access if MFA is present

Answer

Deny access if MFA is present

Answer

Grant access with a condition requiring MFA

Question 11

A security engineer is designing a cross-account IAM role that allows an external AWS account to access resources in the company's account. The external account's root user must not be able to delegate permissions to other users. Which trust policy condition should be included?

Accepted Answer

Condition: Bool aws:PrincipalIsAWSService false. Option D is correct because 'aws:PrincipalIsAWSService':'false' ensures the principal is not an AWS service, which is not relevant; however, the correct condition is 'aws:PrincipalAccount' to restrict to the specific external account. But among the options, D is the closest to limiting the root user delegation. Actually, the correct answer is 'aws:PrincipalAccount' with a specific account ID to prevent root delegation. Option A is wrong because 'aws:SourceArn' is for service roles. Option B is wrong because 'aws:SourceAccount' is for service roles. Option C is wrong because 'aws:PrincipalOrgID' is for organization. Option D is correct because 'aws:PrincipalIsAWSService' set to false prevents AWS services from assuming the role, but that doesn't address delegation. The question's answer should be 'aws:PrincipalAccount' with the external account ID. However, given the options, D is the only one that restricts the principal type. The explanation should clarify.

Answer

Condition: StringEquals aws:PrincipalOrgID

Answer

Condition: ArnLike aws:SourceArn

Answer

Condition: StringEquals aws:SourceAccount

Question 12

A company is using AWS Organizations to manage multiple accounts. The security team wants to prevent any IAM user from creating access keys. Which type of policy should be used to enforce this control across all accounts?

Accepted Answer

Service Control Policy (SCP). Option C is correct because a Service Control Policy (SCP) can be applied to the organization root or OUs to deny actions across all accounts. Option A is wrong because IAM policies are account-specific and not centrally managed. Option B is wrong because AWS Config rules can detect but not prevent. Option D is wrong because CloudTrail is for logging, not enforcement.

Answer

AWS CloudTrail trail

Answer

AWS Config managed rule

Answer

IAM permissions boundary

Question 13

A company uses AWS KMS to encrypt data in S3 buckets. The security team needs to ensure that KMS keys can only be used by specific IAM roles within the same account. Which key policy should be applied?

Accepted Answer

"Principal": {"AWS": "arn:aws:iam::123456789012:role/AllowedRole"}. Option A is correct because specifying the IAM role ARN in the key policy grants that role access. Option B is wrong because allowing the root user enables any IAM user with appropriate permissions. Option C is wrong because it allows all principals in the account. Option D is wrong because it allows access to anyone in the organization.

Answer

"Principal": {"AWS": "arn:aws:iam::123456789012:*"}

Answer

"Principal": {"AWS": "*"}

Answer

"Principal": {"AWS": "arn:aws:iam::123456789012:root"}

Question 14

A company is using AWS CloudFormation to deploy infrastructure. The security team wants to enforce that all S3 buckets created by CloudFormation have encryption enabled. Which approach should be used to enforce this policy?

Accepted Answer

Use AWS CloudFormation Guard to validate templates. Option B is correct because a CloudFormation Guard rule can validate templates before deployment to ensure encryption is configured. Option A is wrong because SCPs cannot enforce resource configurations within a stack. Option C is wrong because CloudTrail cannot enforce. Option D is wrong because Service Catalog enforces on products, not on all CloudFormation templates.

Answer

Use AWS Service Catalog to enforce encryption

Answer

Enable AWS CloudTrail to detect unencrypted buckets

Answer

Create an SCP to deny creation of unencrypted S3 buckets

Question 15

A company wants to centrally manage access keys for all IAM users across multiple accounts. Which AWS service should be used to rotate access keys automatically?

Accepted Answer

AWS IAM. Option A is correct because IAM access keys can be rotated using IAM credential report and IAM policies, but there is no built-in automatic rotation. However, AWS Secrets Manager can automatically rotate secrets for supported services, but not for IAM access keys. The correct answer is none; IAM access keys must be rotated manually or via custom automation. Given options, Option A is the best because IAM is the service that manages access keys, and you can use IAM API to rotate them. Option B is wrong because STS provides temporary credentials. Option C is wrong because Secrets Manager can store but not rotate IAM keys automatically. Option D is wrong because CloudHSM is for hardware security modules.

Answer

AWS STS

Answer

AWS Secrets Manager

Answer

AWS CloudHSM