SCS-C02 Management and Security Governance Practice Test 15 — 15 Questions

Question 1

A security engineer is configuring an S3 bucket policy to restrict access to only requests that originate from a specific VPC endpoint. Which condition key should be used?

Accepted Answer

aws:SourceVpce. Option C is correct because 'aws:SourceVpce' restricts access to a specific VPC endpoint. Option A is wrong because 'aws:SourceVpc' restricts to a VPC, not the endpoint. Option B is wrong because 'aws:SourceIp' restricts by IP address. Option D is wrong because 'aws:VpcSourceIp' is not a valid condition key.

Answer

aws:VpcSourceIp

Answer

aws:SourceVpc

Answer

aws:SourceIp

Question 2

A company is using AWS Config to evaluate resource compliance. They need to ensure that all EC2 instances have a specific tag key 'Environment' with a value of 'Production' or 'Development'. Which type of AWS Config rule should be used?

Accepted Answer

Custom AWS Config rule using AWS Lambda. Option B is correct because a custom AWS Config rule (Lambda function) can evaluate the required tags. Option A is wrong because managed rules may not have the exact logic. Option C is wrong because AWS Config does not have a built-in 'required-tags' rule with custom values. Option D is wrong because AWS Config rules cannot be written in Python directly; they use Lambda.

Answer

Custom AWS Config rule written in Python

Answer

AWS Config managed rule 'ec2-instance-tags'

Answer

AWS Config managed rule 'required-tags'

Question 3

A company needs to grant an IAM user permissions to start and stop specific EC2 instances. Which IAM policy element should be used to restrict actions to specific instances?

Accepted Answer

Condition. Option B is correct because a Condition element can use 'ec2:ResourceTag' to restrict to instances with specific tags. Option A is wrong because 'NotAction' is for actions, not resources. Option C is wrong because 'Resource' can specify instance ARNs but not dynamically based on tags. Option D is wrong because 'Principal' is for specifying who.

Answer

Resource

Answer

Principal

Answer

NotAction

Question 4

Which TWO actions are valid ways to enforce the principle of least privilege in an AWS environment?

Accepted Answer

Grant only the necessary actions in IAM policies. Options A and C are correct. Option A is correct because IAM policies should grant the minimum required permissions. Option C is correct because SCPs can restrict permissions across accounts. Option B is wrong because S3 bucket policies are resource-based and not a direct least privilege method for users. Option D is wrong because assigning full access is against least privilege. Option E is wrong because root user has unrestricted access.

Answer

Use the root user for daily administration

Answer

Use S3 bucket policies to allow all IAM users

Answer

Assign the AdministratorAccess managed policy to all users

Question 5

Which THREE AWS services can be used to centrally manage and audit permissions across multiple accounts in AWS Organizations?

Accepted Answer

AWS IAM Access Analyzer. Options A, B, and D are correct. Option A is correct because IAM Access Analyzer can analyze resource policies across accounts. Option B is correct because AWS CloudTrail logs can be aggregated from multiple accounts. Option D is correct because AWS Config aggregator can aggregate compliance data. Option C is wrong because Inspector is for vulnerability assessments, not permission management. Option E is wrong because Shield is for DDoS protection.

Answer

Amazon Inspector

Answer

AWS Shield

Question 6

Which TWO AWS services can be used to detect and alert on unauthorized API calls in real time?

Accepted Answer

Amazon CloudWatch Alarms. Options B and D are correct. Option B is correct because CloudTrail delivers events to CloudWatch Logs, and CloudWatch Alarms can trigger on metric filters. Option D is correct because EventBridge can process CloudTrail events and trigger alerts. Option A is wrong because IAM is for identity management, not monitoring. Option C is wrong because Config is for compliance evaluation, not real-time alerting on API calls. Option E is wrong because KMS is for encryption key management.

Answer

AWS KMS

Answer

AWS IAM

Answer

AWS Config

Question 7

Refer to the exhibit. An IAM policy is attached to a user. The user attempts to upload an object to my-bucket using server-side encryption with AWS KMS (SSE-KMS). What is the outcome?

Accepted Answer

The upload fails because the Deny statement denies any PutObject that does not use AES256 encryption.. Option D is correct because the Deny statement applies when encryption is not AES256, and SSE-KMS is not AES256. The Allow statement allows only AES256. Since SSE-KMS does not match, the Deny overrides. Option A is wrong because the Deny statement denies. Option B is wrong because the Allow only allows AES256. Option C is wrong because the Deny is explicit.

Answer

The upload fails because the Allow statement requires AES256 encryption.

Answer

The upload succeeds because the policy does not explicitly deny SSE-KMS.

Answer

The upload succeeds because the Allow statement matches the s3:PutObject action.

Question 8

Refer to the exhibit. A security engineer runs the CLI command to determine if the IAM user 'testuser' created a key pair in January 2023. The output shows one event. What can be concluded from this output?

Accepted Answer

The user 'testuser' created the key pair 'my-key-pair' on January 15, 2023.. Option A is correct because the event is logged with the user's ARN. Option B is wrong because the event is not read-only (ReadOnly: false). Option C is wrong because the command only checks for CreateKeyPair events, not all events. Option D is wrong because the command does not show resource ARN filtering; it shows the key pair ARN.

Answer

The key pair 'my-key-pair' was created in a different AWS account.

Answer

The user 'testuser' performed all actions in January 2023.

Answer

The user 'testuser' performed a read-only operation.

Question 9

Refer to the exhibit. A company uses this CloudFormation template. What security best practice is being violated?

Accepted Answer

The security group allows SSH access from all IP addresses.. Option C is correct because the security group allows SSH from anywhere (0.0.0.0/0), which is a security risk. Option A is wrong because the instance type is not inherently a security issue. Option B is wrong because the AMI ID is not necessarily a vulnerability. Option D is wrong because there is no encryption setting; the EBS volume has Encrypted: false, which is a best practice violation, but the most critical is the open SSH.

Answer

The instance type is too small for production workloads.

Answer

The AMI ID is not specified as a parameter.

Answer

The EBS volume is not encrypted.

Question 10

A company needs to audit all changes to IAM policies in their AWS account. Which AWS service should they use to record these changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls, including IAM policy changes. Option B is correct because CloudTrail logs all IAM policy modifications. Option A is wrong because AWS Config records resource state changes but not API calls. Option C is wrong because CloudWatch Logs stores logs but does not record API calls. Option D is wrong because S3 is a storage service.

Answer

Amazon S3

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Question 11

A security engineer notices that an IAM user has permissions to launch EC2 instances but the engineer wants to ensure that all new instances are automatically tagged with the creator's user name. What is the most efficient way to enforce this?

Accepted Answer

Add an IAM policy to the user that uses a condition key 'aws:RequestTag/Creator' with a value '${aws:username}'.. Using a service control policy (SCP) with a condition that requires tagging on EC2 RunInstances is not possible because SCPs cannot enforce tagging; they can only deny if tags are missing. Option B is the most efficient: using IAM policy with a condition that requires the tag 'Creator' to equal the IAM user name. Option A is incorrect because SCPs cannot enforce tagging. Option C is overly complex. Option D is incorrect because CloudTrail does not enforce tagging.

Answer

Use AWS CloudTrail to monitor and alert on untagged instances.

Answer

Use AWS Config rules to automatically tag resources after creation.

Answer

Create an SCP that denies EC2:RunInstances unless the request includes a 'Creator' tag with the user name.

Question 12

A company has a multi-account AWS Organization with hundreds of accounts. The security team wants to prevent any IAM user from creating access keys in any account. What is the most scalable and secure approach?

Accepted Answer

Apply an SCP that denies the IAM:CreateAccessKey action to all accounts in the organization.. Option A is correct: a service control policy (SCP) at the root or OU level can deny the IAM:CreateAccessKey action, which applies to all accounts in the organization. Option B is wrong because it does not prevent users in other accounts from creating keys. Option C is wrong because IAM Access Analyzer does not block actions. Option D is wrong because it requires manual updates and is not scalable.

Answer

Use IAM Access Analyzer to generate findings when access keys are created.

Answer

Configure IAM password policies in each account to disallow access keys.

Answer

Create an AWS Config rule in each account to automatically delete access keys.

Question 13

A company wants to ensure that all S3 buckets in their AWS account have encryption enabled. Which AWS service can continuously evaluate compliance and automatically remediate non-compliant buckets?

Accepted Answer

AWS Config. Option D is correct: AWS Config with a managed rule 's3-bucket-server-side-encryption-enabled' can evaluate compliance and trigger an auto-remediation action to enable encryption. Option A is wrong because CloudTrail only logs. Option B is wrong because IAM does not manage bucket encryption. Option C is wrong because S3 itself does not auto-remediate.

Answer

AWS CloudTrail

Answer

AWS IAM

Answer

Amazon S3

Question 14

An organization uses AWS Organizations with multiple OUs. The security team wants to ensure that any new account created in the 'Production' OU automatically gets a set of mandatory tags (CostCenter, Environment) and that these tags cannot be removed. What is the most effective approach?

Accepted Answer

Apply an SCP that denies changes to the specified tags for all accounts in the Production OU.. Option B is correct: using an SCP with a condition that denies modification of those specific tags. SCPs can prevent any IAM actions that remove or modify tags. Option A is wrong because AWS Config rules only detect, not prevent. Option C is wrong because SCPs cannot be used to automatically add tags. Option D is wrong because IAM policies in each account are less centralized.

Answer

Use AWS Service Catalog to provision accounts with pre-defined tags.

Answer

Use AWS Config rules to detect untagged resources and send alerts.

Answer

Create an IAM policy in each account that prohibits tag removal.

Question 15

A security auditor needs to view a list of all IAM users, including their last activity timestamps, for a compliance review. Which AWS service provides this information natively?

Accepted Answer

AWS IAM credential report. Option B is correct: IAM's credential report includes last activity timestamps for each user. Option A is wrong because CloudTrail logs events but not a consolidated report. Option C is wrong because AWS Config does not provide activity timestamps. Option D is wrong because Access Analyzer analyzes resource policies, not user activity.

Answer

AWS CloudTrail

Answer

IAM Access Analyzer

Answer

AWS Config