SCS-C02 Management and Security Governance Practice Test 14 — 15 Questions

Question 1

A company needs to centrally manage access to AWS resources across multiple accounts. Which AWS service should be used to define and enforce a set of common permissions for all accounts in the organization?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Organizations with SCPs. AWS Organizations with Service Control Policies (SCPs) allows you to centrally manage and enforce permissions across all accounts in an organization. SCPs define the maximum permissions for accounts and can be applied to the root, OUs, or individual accounts. Option A (AWS Directory Service) is for managed directory services, not for permissions management. Option B (IAM) is per-account and does not centrally manage multiple accounts. Option C (AWS SSO) is for federated access, not for enforcing permissions boundaries.

Answer

AWS Directory Service

Answer

AWS IAM

Answer

AWS Single Sign-On (SSO)

Question 2

Which TWO actions are effective for detecting and responding to unauthorized access in an AWS environment? (Choose two.)

Accepted Answer

Enable AWS CloudTrail and monitor logs for suspicious activity.. AWS CloudTrail records all API activity in your AWS environment, including management and data plane events. By enabling CloudTrail and monitoring its logs for suspicious activity (e.g., unusual API calls, failed authentication attempts, or access from unexpected IP addresses), you can detect unauthorized access. This is a foundational detective control that provides the audit trail necessary for incident response.

Answer

Use AWS Security Hub to automatically block suspicious IP addresses.

Answer

Enable VPC Flow Logs to capture all network traffic.

Answer

Enable IAM Access Analyzer to detect unauthorized access attempts.

Question 3

Which THREE are best practices for managing security in a multi-account AWS environment? (Choose three.)

Accepted Answer

Use SCPs to restrict permissions across accounts.. Options A, C, and D are correct. Using SCPs, centralizing logs, and using a dedicated security account are best practices. Option B is incorrect because disabling AWS CloudTrail in production accounts reduces visibility and is not a security best practice. Option E is incorrect because using the root user of each account for administrative tasks violates least privilege and is not a security best practice.

Answer

Disable AWS CloudTrail in production accounts to reduce costs.

Answer

Use the root user of each account for administrative tasks.

Question 4

Which TWO AWS services can be used to automatically enforce policies on resources at the time of creation? (Choose two.)

Accepted Answer

AWS Service Catalog. Options D and E are correct. AWS Service Catalog allows you to create and manage pre-approved portfolios of resources, enforcing policies through templates at the time of creation. AWS Config with automatic remediation can evaluate resources against desired configurations and automatically remediate non-compliant resources after creation, effectively enforcing policies upon creation when integrated with AWS Config rules. Option A (AWS KMS) is for managing encryption keys, not policy enforcement. Option B (AWS CloudTrail) is for logging API activity, not enforcing policies. Option C (AWS IAM) manages permissions but does not automatically enforce policies on resources at creation; it controls who can create resources but not the resource configuration itself.

Answer

AWS Key Management Service (KMS)

Answer

AWS CloudTrail

Answer

AWS IAM

Question 5

A company has a multi-account AWS Organization with 50 accounts. The security team uses AWS CloudTrail to log all API calls and sends the logs to a central S3 bucket in the security account. The team wants to ensure that any attempt to disable CloudTrail logging or delete the trail is detected and automatically remediated within 5 minutes. They have configured an AWS Config rule that triggers an AWS Lambda function when the CloudTrail configuration changes. However, the Lambda function is not being invoked when they test by stopping the trail. The Lambda function's IAM role has permissions to start and update CloudTrail. CloudTrail logs show that the Config rule is evaluating the resource, but the Lambda function is not triggered. What is the most likely cause?

Accepted Answer

The AWS Config service does not have permission to invoke the Lambda function.. AWS Config must have permission to invoke the Lambda function. Even though the Lambda function's IAM role has permissions to modify CloudTrail, the issue is that Config itself is not authorized to trigger the Lambda function. This is why the Lambda function is not invoked when the trail is stopped. Options A, B, and C are incorrect because they relate to different permission issues that are not the root cause.

Answer

The S3 bucket policy does not allow CloudTrail to write logs.

Answer

The Lambda function's IAM role does not have permission to modify CloudTrail.

Answer

The CloudTrail trail does not have permission to send logs to the S3 bucket.

Question 6

A company is using AWS Organizations with a management account and several member accounts. The security team has created an SCP that denies access to all actions for the 'ec2:*' service unless the request comes from a specific VPC endpoint. The SCP is attached to the organization root. However, users in a member account are still able to launch EC2 instances from the AWS Management Console, which does not use a VPC endpoint. The SCP is as follows:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": "ec2:*",
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "aws:sourceVpce": "vpce-12345678"
        }
      }
    }
  ]
}

What is the most likely reason the SCP is not preventing the users from launching instances?

Accepted Answer

The condition key 'aws:sourceVpce' is not present in requests from the AWS Management Console.. The condition key 'aws:sourceVpce' is supported in SCPs. However, requests from the AWS Management Console do not include this condition key. In SCPs, when the 'aws:sourceVpce' key is absent, the 'StringNotEquals' condition operator evaluates to false, causing the Deny statement to not apply. Therefore, the SCP fails to block actions from the console because the condition does not match. Option C correctly identifies this as the reason the SCP is not preventing users from launching instances. Options A, B, and D are incorrect: A) SCPs do apply to the root user in member accounts; B) SCPs attached to the organization root apply to all member accounts; D) the users are in a member account, and management account SCP behavior is irrelevant here.

Answer

The SCP is not applied to the root user in the member account.

Answer

The SCP is attached to the organization root but not to the member account.

Answer

The management account is not affected by SCPs, and the users are using the management account.

Question 7

A company has a single AWS account with several IAM users. The security team wants to ensure that all IAM users have strong passwords and that passwords are rotated every 90 days. The team also wants to receive a notification if any user's password is older than 90 days. The team has enabled an IAM password policy that requires strong passwords and sets a maximum password age of 90 days. However, they are not receiving notifications about expired passwords. Which additional step should the security team take to receive notifications?

Accepted Answer

Create an AWS Config rule that checks the password policy and triggers an SNS notification.. AWS Config can evaluate IAM user password age using a custom rule and trigger an SNS notification when a user's password exceeds 90 days. Option B is incorrect because IAM does not have a feature to automatically email when passwords expire; the password policy only applies during login. Option C is incorrect because CloudTrail logs API calls but does not evaluate password age; CloudWatch Events would need to be combined with a custom solution to check password age. Option D is incorrect because AWS Trusted Advisor checks the overall password policy but does not monitor individual user password age or send notifications.

Answer

Configure IAM to automatically send an email when a password expires.

Answer

Enable AWS CloudTrail to log password changes and use Amazon CloudWatch Events to monitor.

Answer

Use AWS Trusted Advisor to check password policy and send notifications.

Question 8

A company has an AWS environment with multiple accounts managed under AWS Organizations. The security team wants to enforce that all newly created S3 buckets in any account have encryption enabled by default. Which approach should the security team take?

Accepted Answer

Create a Service Control Policy (SCP) that denies the creation of S3 buckets without encryption.. A Service Control Policy (SCP) can be applied at the organizational level to deny the creation of S3 buckets without encryption, enforcing the policy across all accounts proactively. Option A is wrong because AWS Config rules are reactive and only detect violations after buckets are created. Option B is wrong because S3 default encryption is a bucket-level setting that must be configured per bucket, not an organization-wide enforcement. Option C is wrong because IAM policies are account-specific and cannot be centrally enforced across all accounts in the organization.

Answer

Use AWS Config rules to detect unencrypted buckets and send alerts.

Answer

Enable S3 default encryption in each account's S3 settings.

Answer

Apply an IAM policy to the root user of each account to enforce bucket encryption.

Question 9

A security engineer is troubleshooting a situation where an IAM user is unable to assume a role in a different account. The trust policy of the role allows the user's account to assume the role, and the user has permissions to call AssumeRole. However, the user receives an 'AccessDenied' error. What is the most likely cause?

Accepted Answer

The user's IAM policy does not grant sts:AssumeRole for the target role.. The user's IAM permissions must explicitly allow the sts:AssumeRole action for the specific role ARN. Option A is wrong because the error would be different if the role did not exist. Option C is wrong because SCPs apply to all principals in the account, but the user already has a policy allowing AssumeRole. Option D is wrong because MFA would result in a different error message.

Answer

The role ARN is incorrect.

Answer

An SCP in the user's account denies sts:AssumeRole.

Answer

The role requires MFA and the user has not authenticated with MFA.

Question 10

A company wants to centrally manage backups for Amazon RDS instances across multiple AWS accounts. Which AWS service should be used to automate the creation and enforcement of backup policies?

Accepted Answer

AWS Backup. AWS Backup allows centralized backup policies across accounts and regions. Option A is wrong because S3 Lifecycle policies are for object lifecycle, not RDS backups. Option C is wrong because CloudTrail is for auditing API calls. Option D is wrong because Systems Manager is for operational management, not backup policies.

Answer

S3 Lifecycle policies

Answer

AWS CloudTrail

Answer

AWS Systems Manager

Question 11

A security team needs to ensure that all API calls made in the AWS account are logged and the logs are stored in a central S3 bucket that is encrypted with a KMS key. Which combination of steps should the team take to achieve this?

Accepted Answer

Enable CloudTrail and configure it to deliver logs to an encrypted S3 bucket.. CloudTrail logs all API calls and can deliver them to an encrypted S3 bucket. Option A is incorrect because AWS Config records resource configuration changes, not API calls. Option B is incorrect because CloudWatch Logs logs application and system events but does not natively store logs directly in S3; it would require additional configuration. Option C is incorrect because VPC Flow Logs capture network traffic metadata, not API calls.

Answer

Enable AWS Config and have it deliver configuration history to an encrypted S3 bucket.

Answer

Enable CloudWatch Logs and stream logs to an encrypted S3 bucket.

Answer

Enable VPC Flow Logs and publish to an encrypted S3 bucket.

Question 12

A company is using AWS Organizations to manage multiple accounts. The security team wants to prevent the creation of Amazon EC2 instances with public IP addresses in all accounts. Which TWO actions should the team take to implement this control using Service Control Policies (SCPs)?

Accepted Answer

Create an SCP with a Deny effect for ec2:RunInstances where the request parameter ec2:AssociatePublicIpAddress is true.. An SCP with a Deny effect for ec2:RunInstances can use the condition key ec2:AssociatePublicIpAddress to block instance creation when a public IP is requested. Option D is correct because attaching the SCP to the root OU ensures it applies to all accounts in the organization. Option A is wrong because the condition key ec2:LaunchTemplate is used to restrict based on launch templates, not public IP assignment. Option B is wrong because SCPs do not add IAM policies; they set permission boundaries that deny or allow actions. Option E is wrong because SCPs can deny actions based on tags but the condition key for public IP is ec2:AssociatePublicIpAddress, not a tag.

Answer

Use the condition key 'ec2:LaunchTemplate' to deny public IPs.

Answer

Create an SCP that adds an IAM policy to deny ec2:RunInstances.

Answer

Create an SCP that requires the tag 'PublicIP' to be set to 'false'.

Question 13

A company wants to ensure that all Amazon S3 buckets are encrypted at rest. Which THREE services can be used together to automatically remediate unencrypted S3 buckets?

Accepted Answer

Amazon EventBridge. D, and E. AWS Config can detect unencrypted S3 buckets (D). Amazon EventBridge can trigger a remediation action (C). AWS Lambda can execute the remediation (E). Option A (Amazon S3 default encryption) is not a service that automatically remediates; it can be configured per bucket but does not detect or remediate across all buckets. Option B (AWS CloudTrail) is for auditing, not remediation.

Answer

Amazon S3 default encryption

Answer

AWS CloudTrail

Question 14

Refer to the exhibit. An IAM policy is attached to a user. The user reports that they cannot upload files to the S3 bucket 'example-bucket' using the AWS CLI with HTTPS. What is the most likely reason?

Accepted Answer

The user does not have an explicit allow for s3:PutObject.. The policy contains a Deny statement that applies only when SecureTransport is false (i.e., HTTP). Since the user is using HTTPS, the Deny does not apply. However, there is no explicit Allow for s3:PutObject, so the default implicit deny causes the AccessDenied error. Option A is incorrect because the condition is not triggered. Option B is incorrect because the Deny does not apply to HTTPS. Option D is incorrect because the error is not about encryption.

Answer

The bucket requires server-side encryption and the user did not specify it.

Answer

The policy denies all S3 actions when using HTTPS.

Answer

The bucket name is incorrect in the policy.

Question 15

A company's security team discovers that an EC2 instance in the production account has been compromised. The instance has an IAM role attached that allows it to read from an S3 bucket containing sensitive data. The team needs to immediately stop the data exfiltration while preserving the evidence. What should the team do first?

Accepted Answer

Apply an inline policy to the IAM role that denies all S3 actions.. The correct first step because applying an inline policy that denies all S3 actions to the IAM role immediately stops the compromised instance from accessing the S3 bucket, preventing data exfiltration while preserving the instance's state for forensic investigation. Option A is incorrect because detaching the S3 bucket from the VPC endpoint does not affect the instance's ability to access S3 through the internet or other endpoints. Option C is incorrect because removing the IAM role from the instance may not take effect immediately if the role's credentials are cached, and it could disrupt evidence collection. Option D is incorrect because terminating the instance would destroy volatile evidence and might not stop exfiltration in time if the instance is already sending data.

Answer

Detach the S3 bucket from the VPC endpoint.

Answer

Remove the IAM role from the EC2 instance.

Answer

Terminate the compromised EC2 instance immediately.