SCS-C02 Management and Security Governance Practice Test 15 — 15 Questions

Question 1

A company uses AWS Organizations and wants to centrally manage CloudTrail trails across all accounts. Which feature should be enabled?

Accepted Answer

CloudTrail organization trail. CloudTrail organization trails allow a single trail to log events for all accounts in an AWS Organization, enabling centralized management. Option B is incorrect because cross-account CloudTrail is not a native feature; an organization trail is the mechanism to aggregate logs from multiple accounts. Option C is incorrect because Service Control Policies (SCPs) are used to manage permissions, not logging. Option D is incorrect because AWS Config aggregators are designed for configuration compliance, not centralized CloudTrail logging.

Answer

Cross-account CloudTrail

Answer

Service Control Policy for CloudTrail

Answer

AWS Config aggregator

Question 2

A company has a requirement that all IAM users must use strong passwords. The security engineer needs to enforce a password policy that requires minimum 12 characters, at least one uppercase letter, and at least one number. The engineer sets the password policy in IAM. However, existing users with weak passwords are not forced to change them. What should the engineer do to enforce the policy for existing users?

Accepted Answer

Set the password expiration period to 0 to force immediate password change.. Setting the password policy to expire existing passwords will force users to change them on next login. Option A is wrong because the policy is already set; users are not forced to change. Option B is wrong because allowing users to change passwords does not enforce the policy. Option C is wrong because resetting passwords manually is not scalable and not required.

Answer

Manually reset each user's password to a strong password.

Answer

Enable 'Allow users to change their own password' in the policy.

Answer

Re-apply the password policy to each user.

Question 3

A company has a multi-account AWS environment managed with AWS Organizations. The security team wants to ensure that no EC2 instance in any account can be launched without a specific tag 'CostCenter'. The team has created a Service Control Policy (SCP) that denies the ec2:RunInstances action if the request does not include the tag 'CostCenter'. However, they find that instances are still being launched without the tag in some accounts. What is the most likely reason?

Accepted Answer

The accounts launching instances without tags are the management account.. The most likely reason is that the accounts launching instances without the tag are the management account. Service Control Policies (SCPs) do not affect the management account in AWS Organizations; they only apply to member accounts. Therefore, if the security team is testing from the management account, the SCP denying ec2:RunInstances without the 'CostCenter' tag will not be enforced. Option A is incorrect because 'aws:RequestTag' is the correct condition key for tagging requests, not 'aws:ResourceTag'. Option C is incorrect because SCPs work by denying actions, not by requiring explicit allows. Option D is incorrect because the SCP would still prevent unauthorized launches even without an explicit allow. The issue is specifically that SCPs do not apply to the management account.

Answer

The SCP uses the wrong condition key; it should use 'aws:ResourceTag' instead.

Answer

The SCP does not include an explicit allow for the action.

Answer

The SCP is not attached to the organizational units containing the accounts.

Question 4

A company wants to implement a least-privilege security model for its AWS environment. The security team has identified that many IAM users have overly permissive policies. The team wants to use AWS IAM Access Analyzer to identify policies that grant access to external principals. However, the team is not seeing any findings. What is the most likely reason?

Accepted Answer

IAM Access Analyzer is not enabled for the account.. A is correct because IAM Access Analyzer must be enabled for the account to generate findings. If it is not enabled, no findings will appear. B is incorrect because IAM Access Analyzer analyzes a variety of resource types, including IAM policies, not just S3 bucket policies. C is incorrect because IAM Access Analyzer does not require AWS Organizations; it can be used in a single account. D is incorrect because the company has identified overly permissive policies, so the absence of findings is unlikely to be due to all policies being least-privilege.

Answer

IAM Access Analyzer only analyzes S3 bucket policies, not IAM policies.

Answer

IAM Access Analyzer requires AWS Organizations to be enabled.

Answer

All policies are already least-privilege and do not grant access to external principals.

Question 5

A financial services company uses AWS Organizations to manage multiple accounts. The Security team has enabled AWS CloudTrail in all accounts and logs are delivered to a central S3 bucket in the management account. The company has a requirement to detect and alert on any IAM user or role that performs a console login without multi-factor authentication (MFA) across all accounts. Currently, the team manually reviews CloudTrail logs, which is time-consuming and error-prone. They want an automated solution that uses AWS services and follows AWS best practices for security governance. The solution must be cost-effective and should not require custom code or third-party tools. What should the Security team do to meet this requirement?

Accepted Answer

Configure CloudTrail to deliver logs to Amazon CloudWatch Logs. Create a metric filter for the event name 'ConsoleLogin' with additionalEventData.MFAUsed != 'Yes'. Create a CloudWatch Alarm on the metric to send a notification via Amazon SNS.. It uses AWS CloudTrail with Amazon CloudWatch Logs and a metric filter to detect console logins without MFA, and then creates a CloudWatch Alarm to trigger an SNS notification. This approach is automated, serverless, and follows AWS best practices without custom code. Option A is incorrect because AWS Config managed rules can evaluate resource configurations but cannot evaluate CloudTrail events like console login MFA status. Option C is incorrect because Amazon GuardDuty focuses on threat detection (e.g., unusual API calls, compromised instances), not IAM MFA compliance. Option D is incorrect because AWS IAM Access Analyzer analyzes resource policies for external access, not user behavior such as MFA usage during login.

Answer

Enable Amazon GuardDuty and create a custom rule to detect console logins without MFA.

Answer

Create an AWS Config managed rule to check for console logins without MFA across all accounts.

Answer

Use AWS IAM Access Analyzer to generate findings when IAM users log in without MFA.

Question 6

A global e-commerce company operates in three AWS Regions: us-east-1, eu-west-1, and ap-southeast-1. The company uses AWS Organizations with 50 member accounts grouped by business unit. The security team recently discovered that several S3 buckets containing customer data were accidentally made public due to misconfigured bucket policies. The team wants to implement a preventive control that blocks any S3 bucket from becoming public across all accounts, while still allowing authorized cross-account access. The solution must be centrally managed and not require changes to existing IAM policies. Additionally, the team needs to be notified immediately when a public bucket is attempted. Which solution meets all requirements?

Accepted Answer

Create an SCP that denies s3:PutBucketPolicy and s3:PutBucketAcl when the condition includes making the bucket public, and use CloudTrail and CloudWatch Events to send notifications on denied API calls.. It uses an SCP to centrally deny the s3:PutBucketPolicy and s3:PutBucketAcl actions when the request would make a bucket public, which is a preventive control that blocks the operation before it happens. The requirement for immediate notification is met by using CloudTrail to log the denied API calls and CloudWatch Events to trigger alerts, all without modifying existing IAM policies or requiring per-account changes.

Answer

Use Amazon Macie to discover public buckets and alert the security team.

Answer

Create an SCP that denies s3:PutBucketPolicy only for policies that specify 'Principal': '*' or 'Principal': {'AWS': '*'}

Answer

Deploy an AWS Config rule in each account that triggers a Lambda function to make non-compliant buckets private.

Question 7

A company uses AWS Organizations with multiple accounts and wants to ensure that all newly created S3 buckets have encryption enabled. The Security team needs a solution that automatically remediates non-compliant buckets without manual intervention. What should they do?

Accepted Answer

Enable AWS Config with the s3-bucket-server-side-encryption-enabled rule and set up automatic remediation using Systems Manager Automation.. AWS Config can continuously evaluate S3 buckets against the s3-bucket-server-side-encryption-enabled rule and automatically remediate non-compliant buckets using Systems Manager Automation, requiring no manual intervention. Option A is incorrect because a service control policy (SCP) cannot enforce encryption on bucket creation; the described SCP is circular and unenforceable since it denies s3:PutBucketEncryption unless encryption is already enabled, which is impossible to satisfy at creation time.

Answer

Apply a service control policy (SCP) that denies the s3:PutBucketPublicAccessBlock and s3:PutBucketEncryption actions unless the bucket has encryption enabled.

Answer

Use an S3 bucket policy that denies PutObject unless the request includes the x-amz-server-side-encryption header.

Answer

Create an IAM role with permissions to enforce encryption and attach it to all accounts in the organization.

Question 8

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that all IAM users in the organization have multi-factor authentication (MFA) enabled. Which combination of actions should be taken to enforce this requirement?

Accepted Answer

Create an SCP that denies IAM actions without MFA and attach it to the root organizational unit (OU).. Service Control Policies (SCPs) in AWS Organizations can be attached to the root organizational unit (OU) to apply a blanket denial of IAM actions when MFA is not present, affecting all accounts and users within the organization. This leverages the `aws:MultiFactorAuthPresent` condition key in an SCP to enforce MFA at the organization level, ensuring that even if IAM users are created in member accounts, they cannot perform IAM actions without MFA. Attaching the SCP to the root OU ensures the policy cascades down to all child OUs and accounts, providing centralized enforcement.

Answer

Create an SCP that denies IAM actions without MFA and attach it to the IAM group that contains all users.

Answer

Create an SCP that denies IAM actions without MFA and attach it to each IAM user.

Answer

Create an SCP that denies IAM actions without MFA and attach it to the management account.

Question 9

Refer to the exhibit. A security engineer applied the bucket policy shown. What is the effect of this policy?

Accepted Answer

Only GetObject requests that use HTTP are denied.. The bucket policy includes a Deny statement for s3:GetObject requests that are not using HTTPS. The condition `aws:SecureTransport` is set to false, meaning the request is over HTTP. Therefore, any GetObject request made over HTTP is denied. PutObject requests are not affected, and GetObject requests over HTTPS are allowed regardless of IP address.

Answer

All PutObject requests are denied.

Answer

Only GetObject requests from specific IP ranges are denied.

Answer

All GetObject requests to the bucket are denied.

Question 10

Match each AWS VPC flow log type to its description.

Accepted Answer

VPC flow logs: Captures network traffic to and from all network interfaces in a VPC. AWS VPC flow logs can be created at three levels: VPC (captures traffic for all interfaces in the VPC), subnet (captures traffic for interfaces in a specific subnet), and ENI (captures traffic for a single elastic network interface). Common confusions include mistaking the scope of each log type.

Answer

VPC flow logs: Captures network traffic for a specific subnet only

Answer

Subnet flow logs: Captures network traffic for a specific ENI only

Question 11

A security engineer notices that an S3 bucket contains objects that are accessible to authenticated users from other AWS accounts. The bucket policy allows access to the 'aws:SourceArn' condition that references an Amazon Resource Name (ARN) from another account. What is the MOST effective way to restrict access to only users from the company's own account?

Accepted Answer

Add a condition using 'aws:SourceAccount' with the company's account ID.. Using the 'aws:SourceAccount' condition key with the company's account ID ensures that only requests originating from that account are allowed, effectively blocking cross-account access from other accounts. Option A is incorrect because SCPs apply to principals within the organization and cannot restrict access from external accounts ('aws:SourceAccount' is not evaluated for SCPs). Option B is incorrect because simply removing the bucket policy would break all cross-account access but also removes any existing policy-based permissions within the account; adding IAM policies alone does not grant cross-account access and may not be the most effective solution. Option C is incorrect because 'aws:SourceArn' is typically used for service-to-service access (e.g., SNS to S3) and does not reliably restrict by account; the proper condition key for account-level restriction is 'aws:SourceAccount'.

Answer

Apply an SCP to deny s3:GetObject for any principal outside the organization.

Answer

Remove the bucket policy and add an IAM policy to the company's users.

Answer

Modify the condition to use 'aws:SourceArn' with an ARN from the company's account.

Question 12

A developer has created an S3 bucket policy that grants public read access. The security team wants to prevent any S3 bucket from becoming public. Which AWS service can enforce this restriction across all accounts?

Accepted Answer

A service control policy (SCP) denying s3:PutBucketPolicy. A service control policy (SCP) is the correct choice because it operates at the AWS Organizations level to centrally restrict permissions across all accounts. By creating an SCP that denies the s3:PutBucketPolicy action, you prevent any account in the organization from modifying bucket policies to grant public access, regardless of individual account settings. This enforces a guardrail that cannot be overridden by account administrators.

Answer

AWS CloudTrail with a metric filter

Answer

S3 Block Public Access settings on each account

Answer

IAM permissions boundary

Question 13

A security engineer discovers that an IAM user has a policy that allows them to delete any S3 bucket in the account. The engineer wants to audit all delete actions performed by this user. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail logs all API calls made to the AWS API, including S3 bucket deletions, and is the appropriate service for auditing user actions. Option C (CloudTrail) is correct. Option A (GuardDuty) is a threat detection service that monitors for malicious activity but does not log all API calls. Option B (AWS Config) evaluates resource configurations and changes but does not log API calls. Option D (CloudWatch Logs) stores logs from various sources but does not capture API calls by default.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 14

A security engineer needs to automatically detect and respond to unauthorized API calls in an AWS account. Which two services should be used together?

Accepted Answer

AWS CloudTrail and Amazon EventBridge. CloudTrail logs API calls, and Amazon EventBridge can trigger automated responses based on those logs. Option A is correct. Option B (GuardDuty + SNS) provides threat detection alerts but not automated response. Option C (Config + Lambda) is for configuration compliance, not API call detection. Option D (Inspector + S3) is for vulnerability assessment, not API monitoring.

Answer

Amazon GuardDuty and Amazon SNS

Answer

AWS Config and AWS Lambda

Answer

Amazon Inspector and Amazon S3

Question 15

A company uses AWS Organizations with multiple accounts. The security team needs to enforce that all S3 buckets in the organization block public access. Which policy should be attached to the root organizational unit to achieve this?

Accepted Answer

Attach a service control policy (SCP) that denies s3:PutBucketPublicAccessBlock.. Attach a service control policy (SCP) that denies s3:PutBucketPublicAccessBlock. SCPs can be applied at the root organizational unit to centrally restrict permissions across all accounts, preventing any account from allowing public access to S3 buckets. Option A (CloudTrail) only logs events, not block access. Option B (AWS Config) can detect non-compliance but requires additional automation to enforce; the question asks for enforcement directly. Option D (IAM role) is account-specific and cannot enforce globally.

Answer

Enable AWS CloudTrail to log public access attempts and alert the security team.

Answer

Use AWS Config rules to remediate non-compliant buckets automatically.

Answer

Create an IAM role with a bucket policy that blocks public access.