SCS-C02 Management and Security Governance Practice Test 15 — 15 Questions

Question 1

A security engineer notices that an IAM user has been inactive for 90 days. What is the best way to identify and disable such users?

Accepted Answer

Use IAM Credential Report and disable users with no activity in 90 days. The IAM Credential Report provides a comprehensive CSV export of all IAM users in the account, including the `password_last_used` and `access_key_last_used_date` columns. This allows a security engineer to directly identify users who have had no activity for 90 days and then disable them by applying an IAM policy with a `Deny` effect or removing their credentials. It is the most straightforward, native, and accurate method for this specific task.

Answer

Use CloudTrail to identify users with no recent events

Answer

Use AWS Config rule to detect inactive users

Answer

Use AWS Organizations to disable users

Question 2

A security engineer needs to monitor for unauthorized API calls in real-time. Which combination of services should be used?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Logs with metric filters. AWS CloudTrail records all API calls in an AWS account, and CloudWatch Logs can ingest those logs. By creating metric filters on CloudWatch Logs, you can define patterns that match unauthorized API calls (e.g., AccessDenied errors) and trigger alarms in real time. This combination provides the necessary logging and real-time monitoring capability.

Answer

Amazon S3 event notifications and AWS Lambda

Answer

AWS Config and Amazon SNS

Answer

Amazon GuardDuty and AWS CloudTrail

Question 3

Which AWS service allows you to create and manage encryption keys for your AWS resources?

Accepted Answer

AWS Key Management Service (KMS). AWS Key Management Service (KMS) is the managed service designed specifically for creating, storing, and managing encryption keys used to encrypt data across AWS services. It integrates with AWS CloudTrail for auditing key usage and supports symmetric and asymmetric keys, with automatic key rotation and fine-grained access control via IAM and key policies.

Answer

AWS CloudHSM

Answer

AWS Certificate Manager

Answer

AWS Secrets Manager

Question 4

Which TWO actions should a security engineer take to protect root user credentials? (Select TWO.)

Accepted Answer

Do not create access keys for the root user. AWS strongly recommends that you do not create access keys for the root user. Access keys provide programmatic access to the AWS API, and if compromised, an attacker would have unrestricted access to all AWS resources and billing information. By not creating access keys, you eliminate this high-risk attack vector.

Answer

Use the root user only for billing

Answer

Share the root user credentials with the security team

Answer

Delete the root user account

Question 5

Which THREE AWS services can be used to centrally manage security across multiple accounts? (Select THREE.)

Accepted Answer

AWS Config. AWS Config is correct because it provides a centralized view of resource configurations and compliance across multiple accounts when integrated with AWS Organizations. By enabling Config in the management account and using aggregation authorizations, you can aggregate configuration and compliance data from all member accounts into a single administrator account, enabling centralized security governance.

Answer

AWS Shield

Answer

Amazon GuardDuty

Question 6

Which TWO are best practices for managing IAM policies? (Select TWO.)

Accepted Answer

Grant least privilege by using specific actions and resources. The principle of least privilege is a foundational security best practice in AWS IAM. By specifying exact actions (e.g., s3:GetObject) and resources (e.g., arn:aws:s3:::example-bucket/*) instead of using wildcards, you minimize the blast radius of a compromised credential or misconfigured policy. This aligns with the AWS Well-Architected Framework's security pillar, which mandates granting only the permissions required to perform a task.

Answer

Use wildcards (*) to simplify policy management

Answer

Use inline policies instead of managed policies

Answer

Use SCPs to enforce permissions

Question 7

Refer to the exhibit. An IAM policy attached to a user allows s3:GetObject only from a specific IP range and denies all S3 actions if not using HTTPS. What happens when the user makes a GET request from IP 10.0.0.5 using HTTP?

Accepted Answer

Denied because the Deny statement matches. IAM policies evaluate all matching statements, and an explicit Deny always wins over any Allow. The policy denies all S3 actions when the request is not using HTTPS (aws:SecureTransport is false). Since the user made the request over HTTP, the Deny statement matches, so the request is denied regardless of the IP-based Allow.

Answer

Allowed because the IP is in the range

Answer

Allowed because the condition does not match

Answer

Denied because the IP is not in the range

Question 8

A security engineer is designing a solution to enforce that all S3 buckets in an AWS account have server-side encryption enabled. The engineer needs to automatically remediate any non-compliant buckets. Which AWS service should be used to implement this requirement?

Accepted Answer

AWS Config with managed rules and auto-remediation. AWS Config continuously evaluates resource configurations against rules, and managed rules such as s3-bucket-server-side-encryption-enabled detect non-compliant buckets; Config remediation actions can then invoke SSM Automation documents or Lambda to automatically re-enable encryption. This provides both detection and automatic remediation in a single managed service, which is exactly what the requirement asks for.

Answer

AWS Lambda with S3 events

Answer

AWS IAM policy to deny PutBucketEncryption without encryption

Answer

AWS CloudTrail

Question 9

A company uses AWS Key Management Service (KMS) to encrypt sensitive data in Amazon S3. The security team needs to ensure that the KMS key can only be used from within the company's VPC and not from the public internet. How can this be achieved?

Accepted Answer

Create a VPC endpoint for KMS and modify the KMS key policy to allow usage only from the specified VPC endpoint.. To restrict KMS key usage to a VPC, you create a VPC endpoint for KMS (an interface endpoint powered by AWS PrivateLink) and then modify the KMS key policy to allow usage only from that VPC endpoint. This ensures that requests to KMS must come through the VPC endpoint, not the public internet.

Answer

Use an SCP to deny kms:Encrypt unless the request comes from the VPC.

Answer

Use AWS CloudTrail to monitor KMS calls and alert if they come from outside the VPC.

Answer

Create a VPC endpoint for KMS and attach a bucket policy that requires the endpoint.

Question 10

Which TWO AWS services can be used to centrally manage and audit permissions across multiple AWS accounts? (Choose two.)

Accepted Answer

AWS Organizations. AWS Organizations provides a central view of all accounts and can apply SCPs. IAM Access Analyzer analyzes resource policies across accounts to identify public or cross-account access. AWS Config evaluates resource configurations but does not centrally manage permissions. AWS CloudTrail logs API calls but does not manage permissions. AWS SSO manages user access but not resource permissions.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

AWS Single Sign-On

Question 11

A security engineer runs the get-account-authorization-details command and sees the exhibit output. The engineer wants to ensure that the 'admin' user does not have administrative access. Which steps should be taken?

Accepted Answer

Detach the AdministratorAccess policy from the 'admin' user and attach a custom policy with read-only permissions.. The 'admin' user has the AdministratorAccess policy attached, granting full administrative rights. To remove administrative access, the engineer should detach this policy and attach a custom policy with read-only permissions (Option C). Option A is unnecessary because deleting the user is not required; detaching the policy is sufficient. Option B is incorrect because modifying the AdministratorAccess policy to deny all actions would still leave the policy attached, potentially causing confusion or unintended effects; better to detach it. Option D is wrong because attaching a permissions boundary does not remove the existing AdministratorAccess policy; the user would still have administrative access via that policy.

Answer

Delete the 'admin' user and create a new user with limited permissions.

Answer

Modify the AdministratorAccess policy to deny all actions.

Answer

Attach a permissions boundary that denies all actions.

Question 12

A security engineer is designing a centralized logging solution for a multi-account AWS environment using AWS Organizations. The solution must ensure that all CloudTrail logs from all accounts are delivered to a single S3 bucket in the security account. Additionally, the logs must be encrypted with a KMS key that is managed by the security account. Which combination of steps is required?

Accepted Answer

Create a trail in each account, each delivering to the same S3 bucket. Use a bucket policy to allow cross-account writes. Use a single KMS key with appropriate key policy.. It uses individual trails in each account, all configured to deliver to the same centralized S3 bucket in the security account. A bucket policy can grant CloudTrail write permissions from all accounts, and a single KMS key (managed by the security account) with appropriate key policy ensures encryption. This approach meets the centralized logging and encryption requirements without violating organization trail constraints. Option B is incorrect because AWS Config does not deliver CloudTrail logs, and CloudWatch Logs streaming is not the required solution. Option C is incorrect because the trail is created in the management account but delivers to a bucket in the management account, not the security account, and it uses default encryption instead of a customer-managed KMS key from the security account. Option D is incorrect because organization trails can only be created in the management account; creating one in the security account is not allowed.

Answer

Use AWS Config to deliver logs to a central bucket. Enable CloudWatch Logs in each account and stream to the security account.

Answer

Create a trail in the management account with organization trail enabled, delivering to a bucket in the management account. Use KMS default encryption.

Answer

Create a trail in the security account with organization trail enabled, delivering to a bucket in the security account. Configure bucket policy and KMS key policy to allow CloudTrail and S3 from all accounts.

Question 13

A company wants to automate the enforcement of security best practices across all AWS accounts in an organization. The solution should automatically remediate noncompliant resources. Which AWS service should be used to achieve this?

Accepted Answer

AWS Config rules with auto-remediation. AWS Config rules evaluate resource configurations against desired states and can trigger automatic remediation via SSM Automation documents when a resource is noncompliant. With AWS Organizations integration, Config can aggregate compliance across all accounts and apply remediation centrally, making it the correct choice for automated enforcement with remediation.

Answer

AWS Organizations service control policies (SCPs)

Answer

AWS IAM Access Analyzer

Answer

Amazon GuardDuty

Question 14

A company uses AWS Organizations with a management account and several member accounts. The security team wants to restrict the use of specific AWS services (e.g., EC2, Lambda) in certain accounts based on the account's environment (dev, test, prod). Which approach should be used to implement this requirement?

Accepted Answer

Use AWS Organizations to tag accounts (e.g., Environment=Dev) and use SCPs with conditions to deny access to services based on tags.. By tagging accounts in AWS Organizations (e.g., Environment=Dev) and using Service Control Policies (SCPs) with conditions based on those tags, the security team can restrict usage of specific AWS services per account environment. SCPs are applied at the organization level and affect all users and roles in the account, providing preventive controls. Option A is incorrect because CloudTrail only logs API calls and does not prevent usage; revoking access after the fact is not a preventive measure. Option B is incorrect because IAM roles are identity-based and do not restrict services at the account level; also, managing roles per account would be cumbersome. Option D is incorrect because AWS Config rules detect non-compliant resource configurations but do not prevent the use of services; they are detective controls.

Answer

Use AWS CloudTrail to monitor API calls and revoke access after the fact.

Answer

Create IAM roles in each account with policies that deny access to services.

Answer

Use AWS Config rules to detect and alert when restricted services are used.

Question 15

A company wants to centralize the management of IAM users and groups for multiple AWS accounts. Which AWS service should be used to allow users to access multiple accounts with a single set of credentials?

Accepted Answer

AWS IAM Identity Center (AWS SSO). AWS IAM Identity Center (successor to AWS SSO) is purpose-built to centralize workforce access across multiple AWS accounts using a single set of credentials. It integrates with AWS Organizations to enumerate accounts and permission sets, and can federate with an external IdP (e.g., Okta, Microsoft Entra ID) or use its own identity store. Users sign in once and pick from assigned accounts/roles, eliminating per-account IAM users.

Answer

AWS Organizations

Answer

IAM users and groups in each account

Answer

Amazon Cognito