SCS-C02 Management and Security Governance Practice Test 14 — 15 Questions

Question 1

A security team needs to centralize audit logs from multiple AWS accounts into a single S3 bucket. The solution must be scalable and support future account additions. Which approach meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS Organizations to create a CloudTrail trail that applies to all accounts in the organization.. AWS Organizations allows you to create an organization-wide CloudTrail trail that automatically applies to all existing and future accounts in the organization. This is the most scalable approach because new accounts added to the organization are automatically covered without manual configuration per account. The trail delivers logs to a central S3 bucket, meeting the requirement to centralize audit logs.

Answer

Use Amazon CloudWatch Logs to stream logs from each account to a central account.

Answer

Use AWS Trusted Advisor to collect logs from all accounts.

Answer

Configure CloudTrail in each account to deliver logs to the same S3 bucket.

Question 2

This SCP is attached to an organizational unit (OU). A developer in an account within the OU tries to launch a t2.small instance. What is the outcome?

Accepted Answer

The launch fails because the SCP denies non-t2.micro instances.. The SCP denies ec2:RunInstances if the instance type is not t2.micro. Since t2.small is not t2.micro, the condition matches, and the action is denied. Option A is wrong because the SCP does not deny all RunInstances actions; it only denies those that do not match the condition. Option B is wrong because the launch fails, not succeeds. Option D is wrong because SCPs apply to all principals in the account, including developers.

Answer

The launch fails because the SCP denies all RunInstances actions.

Answer

The launch succeeds because the SCP allows t2.micro only.

Answer

The launch succeeds because SCPs do not apply to developers.

Question 3

A company has an AWS account with multiple S3 buckets that contain sensitive data. The security team wants to ensure that no public access is granted to any bucket. The team has enabled AWS Config and set up a rule to detect public buckets. The rule reports that all buckets are compliant. However, during a security review, a team member finds that one bucket has a bucket policy that grants 's3:GetObject' to 'Principal': '*'. Why did the AWS Config rule not detect this?

Accepted Answer

The AWS Config rule only checks ACLs, not bucket policies.. The AWS Config managed rule 's3-bucket-public-read-prohibited' only checks for public read access via ACLs, not bucket policies. Therefore, a bucket policy granting 's3:GetObject' to 'Principal': '*' would not be flagged as non-compliant by this rule. To detect public access via bucket policies, a custom AWS Config rule or other mechanisms like IAM Access Analyzer are needed. Option A is incorrect because CloudTrail logs API calls but does not evaluate compliance. Option C is incorrect because the bucket is in the same account as per the scenario. Option D is incorrect because IAM Access Analyzer can analyze policies but does not enforce compliance rules.

Answer

AWS CloudTrail must be enabled for Config to evaluate policies.

Answer

The bucket is in a different AWS account.

Answer

IAM Access Analyzer must be enabled first.

Question 4

A security engineer is auditing an S3 bucket policy that allows cross-account access. The engineer wants to ensure that only encrypted connections are permitted. Which condition should be added to the policy?

Accepted Answer

aws:SecureTransport. The aws:SecureTransport condition key evaluates to true when the request is made over HTTPS/TLS and false over HTTP. Adding a Deny statement with 'aws:SecureTransport: false' ensures that any non-TLS request to the bucket is rejected, enforcing encrypted connections.

Answer

aws:SourceIp

Answer

aws:Referer

Answer

s3:x-amz-server-side-encryption

Question 5

A company uses AWS Organizations with all features enabled. The security team needs to ensure that no member account can disable AWS CloudTrail logging or delete CloudTrail logs stored in S3. Which combination of preventive controls should be implemented?

Accepted Answer

Apply a service control policy (SCP) at the root OU to deny CloudTrail and S3 delete actions, and enable CloudTrail organizational trail.. The most effective preventive controls are applying a Service Control Policy (SCP) at the root OU to deny CloudTrail stop/delete and S3 delete actions, combined with enabling an organizational trail in CloudTrail. SCPs enforce guardrails across all member accounts, preventing even account administrators from disabling logging or deleting logs, while the organizational trail ensures centralized logging to a protected S3 bucket.

Answer

Set up CloudWatch alarms to notify when CloudTrail is modified or logs are deleted.

Answer

Use IAM policies in each member account to deny CloudTrail and S3 delete actions.

Answer

Apply an S3 bucket policy denying delete actions, and enable CloudTrail organizational trail.

Question 6

A security engineer is designing a system to centrally manage IAM users and roles across multiple AWS accounts. The company uses AWS Organizations. Which AWS service should be used to manage permissions across accounts?

Accepted Answer

AWS IAM Identity Center (AWS SSO). AWS IAM Identity Center (formerly AWS SSO) is the service for centrally managing user access to multiple accounts. Option A is wrong because AWS Config is for resource compliance. Option B is wrong because AWS Artifact is for compliance reports. Option C is wrong because AWS CloudTrail is for auditing API activity.

Answer

AWS Config

Answer

AWS Artifact

Answer

AWS CloudTrail

Question 7

A company has a requirement to automatically rotate secrets for an RDS database every 90 days. The secrets are stored in AWS Secrets Manager. Which resource should be configured to perform the rotation?

Accepted Answer

AWS Lambda function. AWS Secrets Manager uses a Lambda function to perform the actual rotation of secrets. When you configure rotation for a secret, you specify a Lambda function that implements the rotation logic, including creating a new secret version, updating the database credentials, and testing the new credentials. The Lambda function is invoked by Secrets Manager on the schedule you define (e.g., every 90 days). Thus, the resource that performs the rotation is the Lambda function.

Answer

CloudWatch Logs subscription filter

Answer

Amazon EventBridge scheduled rule

Answer

AWS Config rule

Question 8

A security engineer is implementing a data classification policy for an S3 bucket that contains sensitive customer data. The policy requires that all objects be encrypted at rest using AWS KMS and that any attempt to upload an unencrypted object be denied. Which THREE steps should the engineer take to enforce this policy? (Choose THREE.)

Accepted Answer

Create a customer managed KMS key.. Option B is correct because the policy requires AWS KMS encryption, and a customer managed KMS key gives the engineer control over the key policy, rotation, and permissions needed to encrypt the sensitive objects. Option D is correct because a bucket policy with a Deny on s3:PutObject when the s3:x-amz-server-side-encryption condition is not aws:kms actively blocks any upload that does not request SSE-KMS, which is exactly the enforcement mechanism the policy demands. Option E is correct because enabling S3 default encryption with the KMS key ensures that objects are encrypted at rest with SSE-KMS even when a request does not explicitly specify encryption headers, satisfying the baseline encryption requirement. Option A is not correct because S3 Bucket Keys only reduce KMS API call costs and request throttling; they do not enforce encryption or deny unencrypted uploads. Option C is not correct because enforcing aws:SecureTransport only requires TLS in transit and does nothing to guarantee encryption at rest with KMS or to reject unencrypted object uploads.

Answer

Enable S3 bucket keys to reduce KMS API calls.

Answer

Enable bucket policy to enforce SSL (aws:SecureTransport).

Question 9

A company is using AWS Organizations and wants to restrict the use of specific AWS services in member accounts. Which TWO approaches can be used to enforce these restrictions? (Choose TWO.)

Accepted Answer

Apply a service control policy (SCP) to the organizational unit (OU).. Option C is correct because service control policies (SCPs) in AWS Organizations define the maximum available permissions for accounts in an OU, and an SCP that denies access to specific AWS services will block those services for all principals in the affected member accounts (except the management account). Option D is correct because IAM policies attached to users, groups, or roles in each member account can include explicit Deny statements for the actions of the services to be restricted, thereby enforcing the restriction at the identity level within that account. Option A is not correct because Service Quotas only cap the quantity of resources or API rates per service; they do not block the use of a service. Option B is not correct because AWS CloudTrail only records API activity for auditing and does not enforce any restriction. Option E is not correct because AWS Config rules evaluate and report on resource compliance; they detect and can trigger remediation, but they do not themselves prevent or terminate service usage as an enforcement mechanism.

Answer

Use Service Quotas to limit the number of resources per service.

Answer

Enable AWS CloudTrail to log service usage.

Answer

Use AWS Config rules to automatically terminate resources.

Question 10

A security engineer runs the above CloudTrail lookup command to investigate a change to the S3 bucket policy. The command only returns one event, but the engineer knows that the bucket policy was changed multiple times. What is the most likely reason?

Accepted Answer

The command is limiting results to one event.. The command uses --max-results 1, limiting output to one event. Option A is wrong because changes through the AWS Management Console are logged by CloudTrail. Option B is wrong because PutBucketPolicy is supported by CloudTrail and the event shown confirms it. Option C is wrong because filtering by ResourceName is not the issue; the --max-results parameter is the cause.

Answer

The bucket policy changes were made through the AWS Management Console, which is not logged.

Answer

The event is not logged because PutBucketPolicy is not supported by CloudTrail.

Answer

The command is filtering by the wrong attribute.

Question 11

A startup is deploying a web application on AWS. The application runs on EC2 instances behind an Application Load Balancer (ALB). The security team wants to ensure that all traffic to the EC2 instances is encrypted. They configure the ALB to listen on HTTPS (port 443) and forward traffic to the EC2 instances on HTTP (port 80). Additionally, they create a security group for the EC2 instances that only allows inbound traffic from the ALB's security group on port 80. However, a security audit reveals that the traffic between the ALB and EC2 instances is not encrypted. Which step should the security team take to encrypt the traffic between the ALB and EC2 instances?

Accepted Answer

Configure the target group to use HTTPS protocol and install a certificate on the EC2 instances.. To encrypt traffic between the ALB and EC2 instances, configure the target group to use HTTPS protocol and install a certificate on the EC2 instances. This ensures the ALB sends HTTPS requests to the instances, encrypting the traffic. Option A is wrong because opening port 443 on the EC2 security group alone does not enable encryption; the listener must also use HTTPS for target traffic. Option B is wrong because encryption at rest protects data stored on disk, not data in transit. Option D is wrong because changing the ALB listener to TCP would terminate TLS at the ALB and forward unencrypted traffic to the targets, which defeats the purpose.

Answer

Update the EC2 security group to allow traffic on port 443 from the ALB.

Answer

Enable encryption at rest on the EC2 instances.

Answer

Change the ALB listener to use TCP instead of HTTPS.

Question 12

A company uses AWS Organizations and has a requirement to enforce that all EC2 instances launched in any account must have a specific tag "Environment" with value "Production". The security team wants to prevent any instance without this tag from being launched. They implement a service control policy (SCP) that denies the ec2:RunInstances action if the request does not include the required tag. However, they find that users are still able to launch instances without the tag. The SCP is attached to the root OU. The team also has an IAM policy that allows ec2:RunInstances with no conditions. What is the most likely reason the SCP is not preventing the launches?

Accepted Answer

The SCP uses ec2:ResourceTag instead of aws:RequestTag for the condition.. The SCP uses the condition key ec2:ResourceTag, which evaluates tags on the EC2 instance resource, but at the time of RunInstances, the instance does not yet exist, so the tag is not present. To enforce tagging at launch, the SCP must use the aws:RequestTag condition key, which checks tags included in the request. Therefore, the SCP fails to deny launches without the required tag.

Answer

The SCP does not apply to the root user in member accounts.

Answer

The IAM policy allows the action, which overrides the SCP deny.

Answer

The SCP is applied to the management account, not the member accounts.

Question 13

A security engineer needs to ensure that all API calls made to AWS services are logged for auditing. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to AWS services, capturing details such as the identity of the caller, the time of the call, the source IP address, request parameters, and response elements. This provides a complete audit trail of user activity and API usage, which is essential for security auditing and compliance.

Answer

AWS Config

Answer

Amazon VPC Flow Logs

Answer

Amazon CloudWatch Logs

Question 14

A company wants to enforce that all S3 buckets are encrypted with SSE-KMS. Which AWS service can be used to automatically remediate non-compliant buckets?

Accepted Answer

AWS Config with auto-remediation. AWS Config with auto-remediation can enforce that all S3 buckets are encrypted with SSE-KMS. You create an AWS Config rule (e.g., s3-bucket-server-side-encryption-enabled) that evaluates bucket encryption settings, and attach an AWS Systems Manager Automation document (e.g., AWS-EnableS3BucketEncryption) as a remediation action. When a non-compliant bucket is detected, AWS Config automatically triggers the remediation action to enable SSE-KMS encryption on that bucket.

Answer

AWS CloudTrail with CloudWatch Events

Answer

AWS Service Catalog

Answer

AWS Organizations

Question 15

A security team needs to centrally manage permissions for multiple AWS accounts. Which AWS service should they use?

Accepted Answer

AWS Organizations with service control policies (SCPs). AWS Organizations with service control policies (SCPs) is the correct choice because SCPs allow you to centrally manage permissions across multiple AWS accounts by defining maximum permissions for member accounts. Unlike IAM policies that are attached to users or roles within a single account, SCPs act as a guardrail at the organization or organizational unit (OU) level, restricting what actions accounts and their IAM principals can perform, even if the account's own IAM policies allow more.

Answer

AWS IAM

Answer

AWS Config

Answer

AWS CloudTrail