SCS-C02 Management and Security Governance Practice Test 16 — 15 Questions

Question 1

A company is using AWS Organizations and wants to delegate the administration of certain accounts to different teams. For example, the finance team should be able to manage billing-related accounts, but not development accounts. Which AWS feature allows this type of delegation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Organizations delegated administrator. AWS Organizations delegated administrator allows a member account to be designated as the administrator for a specific AWS service (e.g., AWS Billing, AWS CloudFormation StackSets, AWS Config) across the organization. This enables the finance team's account to manage billing-related accounts without granting them full management over development accounts. It is the only feature that provides service-specific administrative delegation within Organizations.

Answer

AWS IAM Identity Center (AWS SSO)

Answer

Service control policies (SCPs)

Answer

IAM roles in each account

Question 2

A company wants to receive real-time notifications when an IAM user in their AWS account performs a console login. Which AWS service should be used to monitor and alert on this activity?

Accepted Answer

AWS CloudTrail and Amazon EventBridge. AWS CloudTrail logs console login events, and Amazon EventBridge can be used to create rules that trigger notifications (e.g., via SNS) in real-time when such events occur. Option A is incorrect because IAM does not provide monitoring capabilities. Option B is incorrect because AWS Config is designed for tracking resource configuration changes, not API call activity. Option C is incorrect because Trusted Advisor offers best-practice recommendations and does not provide real-time monitoring of login events.

Answer

AWS IAM

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 3

A security engineer is auditing the AWS Organizations structure. The engineer notices that the 'Management' account (111111111111) has a status of 'ACTIVE' and joined method 'CREATED'. The engineer is concerned about potential security risks. Which action should the engineer take to improve security?

Accepted Answer

Enable multi-factor authentication (MFA) for the root user of the management account.. The management account in AWS Organizations is the account that created the organization and has full administrative access. It is critical to secure this account, and enabling multi-factor authentication (MFA) for the root user is a fundamental security best practice. Option A is incorrect because you cannot remove the management account from the organization; it is the foundational account. Option B is incorrect because you cannot delete the management account; you would need to delete the entire organization. Option C is incorrect because you cannot delete the root user; it is a built-in user that cannot be removed. Therefore, enabling MFA on the root user of the management account is the appropriate action to improve security.

Answer

Remove the management account from the organization.

Answer

Delete the management account and create a new one.

Answer

Create a new root user for the management account and delete the old one.

Question 4

A security engineer applies the above bucket policy to an S3 bucket. What is the effect of this policy?

Accepted Answer

All requests to the bucket must be made over HTTPS.. The bucket policy includes a statement that denies all actions (s3:*) when the request does not use HTTPS (aws:SecureTransport is false). This effectively requires all requests to the bucket to be made over HTTPS. Therefore, option B is correct. Option A is incorrect because the policy does not deny all requests; it only denies non-HTTPS requests. Option C is incorrect because the condition does have an effect. Option D is incorrect because HTTP requests are denied.

Answer

All requests to the bucket are denied regardless of protocol.

Answer

The policy has no effect because it uses a condition.

Answer

All requests to the bucket must be made over HTTP.

Question 5

A security engineer is investigating a potential data exfiltration incident. The engineer notices that an EC2 instance in a private subnet is making outbound connections to an external IP address on port 443. The VPC has a NAT gateway in a public subnet, and the route table for the private subnet directs 0.0.0.0/0 to the NAT gateway. The security group for the instance allows all outbound traffic. Which AWS service can the engineer use to determine which IAM role or user is responsible for launching the instance?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity, including the RunInstances call that launched the EC2 instance, along with the identity (IAM user or role) that made the request. By querying CloudTrail events for the instance ID, the engineer can determine which principal launched it. This directly answers the attribution question.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

IAM Access Analyzer

Question 6

A company has a requirement that all S3 buckets must block public access. The security engineer needs to continuously monitor for compliance and automatically remediate any noncompliant buckets. Which combination of AWS services should the engineer use?

Accepted Answer

AWS Config and AWS Lambda (or SSM Automation). AWS Config continuously evaluates S3 bucket configurations against a managed rule such as 's3-bucket-public-read-prohibited' or 's3-bucket-level-public-access-prohibited', detecting any bucket that becomes noncompliant. Config can then trigger an EventBridge event that invokes a Lambda function or SSM Automation document to re-apply the Block Public Access settings, delivering both continuous monitoring and automatic remediation. This is the canonical AWS pattern for compliance enforcement.

Answer

Amazon GuardDuty and AWS Security Hub

Answer

AWS Organizations SCPs and AWS CloudTrail

Answer

AWS Trusted Advisor and Amazon SNS

Question 7

A security engineer is tasked with ensuring that all S3 buckets in an AWS account have versioning enabled. The engineer needs to identify buckets that do not have versioning enabled. Which AWS service is BEST suited for this task?

Accepted Answer

AWS Config. AWS Config is the best-suited service because it continuously evaluates resource configurations against desired rules. You can use the managed rule 's3-bucket-versioning-enabled' to identify buckets that do not have versioning enabled, and AWS Config will flag them as non-compliant. This provides an automated, scalable way to audit all buckets in an account.

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Answer

IAM Access Analyzer

Question 8

A security engineer is auditing IAM policies. The engineer wants to identify if any policy grants 'Effect: Allow' with 'Action: *' and 'Resource: *'. Which TWO AWS services can be used to detect such overly permissive policies?

Accepted Answer

AWS Config. AWS Config [CORRECT] is right because it continuously evaluates IAM policies against managed or custom rules (e.g., iam-policy-no-statements-with-admin-access) and can flag policies containing Effect: Allow with Action: * and Resource: *, which is exactly the overly permissive pattern being audited. IAM Access Analyzer [CORRECT] is also correct because its policy validation and findings (including checks for overly permissive policies such as those granting full administrative access) can identify policies with Action: * and Resource: * on Allow statements. AWS CloudTrail is not correct because it records API activity and events, not policy permission analysis. AWS Trusted Advisor is not correct because its security checks focus on broad best-practice items like open ports or MFA, not parsing IAM policy statements for wildcard Action/Resource. Amazon GuardDuty is not correct because it detects suspicious activity and threats from logs, not static IAM policy permissiveness.

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Question 9

A company wants to enforce that all IAM users must use multi-factor authentication (MFA) to access the AWS Management Console. Which policy should be attached to the IAM users or group to enforce this requirement?

Accepted Answer

Deny access if MFA is not present. The correct policy is to explicitly deny access when MFA is not present. In IAM, an explicit Deny overrides any Allow, so attaching a policy with a Deny statement conditioned on 'aws:MultiFactorAuthPresent' being false ensures that users without MFA are blocked from accessing the console. This is the standard pattern to enforce MFA because it cannot be bypassed by other permissive policies.

Answer

Allow access if MFA is present

Answer

Deny access if MFA is present

Answer

Grant access with a condition requiring MFA

Question 10

A company is using AWS Organizations to manage multiple accounts. The security team wants to prevent any IAM user from creating access keys. Which type of policy should be used to enforce this control across all accounts?

Accepted Answer

Service Control Policy (SCP). Service Control Policies (SCPs) are the only AWS Organizations policy type that can centrally restrict what IAM principals in member accounts are allowed to do, including denying iam:CreateAccessKey across every account in the OU. Because SCPs set the maximum permissions boundary for all identities in the account, an explicit Deny in an SCP overrides any IAM policy that would otherwise grant the action. This makes SCPs the correct mechanism for enforcing a blanket, organization-wide control.

Answer

AWS CloudTrail trail

Answer

AWS Config managed rule

Answer

IAM permissions boundary

Question 11

A company uses AWS KMS to encrypt data in S3 buckets. The security team needs to ensure that KMS keys can only be used by specific IAM roles within the same account. Which key policy should be applied?

Accepted Answer

"Principal": {"AWS": "arn:aws:iam::123456789012:role/AllowedRole"}. A KMS key policy that names a specific IAM role ARN as the principal grants key usage only to that role, which directly satisfies the requirement to restrict key usage to specific IAM roles within the account. The key policy is the primary access control for a KMS key, and explicit role ARNs enforce least privilege at the key level.

Answer

"Principal": {"AWS": "arn:aws:iam::123456789012:*"}

Answer

"Principal": {"AWS": "*"}

Answer

"Principal": {"AWS": "arn:aws:iam::123456789012:root"}

Question 12

A company wants to centrally manage access keys for all IAM users across multiple accounts. Which AWS service should be used to rotate access keys automatically?

Accepted Answer

AWS IAM. AWS IAM is the service that manages IAM users and access keys. While there is no built-in automatic rotation feature in IAM, you can automate access key rotation using IAM APIs or the AWS CLI. Among the given options, AWS IAM is the correct choice because it directly handles access keys. AWS STS provides temporary credentials, not access key management. AWS Secrets Manager can store secrets but cannot automatically rotate IAM access keys. AWS CloudHSM is for hardware-based cryptographic key storage.

Answer

AWS STS

Answer

AWS Secrets Manager

Answer

AWS CloudHSM

Question 13

A security engineer is configuring an S3 bucket policy to restrict access to only requests that originate from a specific VPC endpoint. Which condition key should be used?

Accepted Answer

aws:SourceVpce. The aws:SourceVpce condition key is the correct choice because it evaluates the VPC endpoint ID (e.g., vpce-12345678) through which the request reached S3. When you attach a bucket policy that includes a condition like "aws:SourceVpce": "vpce-abc123", S3 only allows requests that traverse that specific endpoint, effectively locking the bucket to your private VPC endpoint and blocking all public internet access. This is the standard pattern for enforcing private-only access to S3 from a VPC.

Answer

aws:VpcSourceIp

Answer

aws:SourceVpc

Answer

aws:SourceIp

Question 14

Which TWO actions are valid ways to enforce the principle of least privilege in an AWS environment?

Accepted Answer

Grant only the necessary actions in IAM policies. Option C is correct because least privilege means granting identities only the specific IAM actions and resources they actually need, so scoping IAM policy statements to the minimum required actions directly enforces that principle. Option D is correct because AWS Organizations Service Control Policies (SCPs) set a permissions boundary that can explicitly deny actions not required across accounts or OUs, preventing even otherwise-allowed IAM permissions from being used. Option A is wrong because using the root user for daily administration violates least privilege, as root has unrestricted access and should be reserved for a few account-level tasks. Option B is wrong because an S3 bucket policy allowing all IAM users grants broad access rather than the minimum necessary. Option E is wrong because attaching AdministratorAccess to all users gives full administrative permissions, the opposite of least privilege.

Answer

Use the root user for daily administration

Answer

Use S3 bucket policies to allow all IAM users

Answer

Assign the AdministratorAccess managed policy to all users

Question 15

Which THREE AWS services can be used to centrally manage and audit permissions across multiple accounts in AWS Organizations?

Accepted Answer

AWS IAM Access Analyzer. AWS IAM Access Analyzer (C) is correct because it continuously analyzes resource policies across accounts in AWS Organizations to identify resources shared with external entities, helping centrally manage and audit permissions. AWS CloudTrail (D) is correct because it records API activity across all accounts in an organization into a centralized trail, enabling auditing of who did what and when for permission-related changes. AWS Config (E) is correct because it continuously assesses and records resource configurations and policy compliance across accounts, allowing centralized auditing of permission-related configuration drift. Amazon Inspector (A) is not correct because it is a vulnerability management service for EC2, Lambda, and container images, not a permissions auditing tool. AWS Shield (B) is not correct because it is a managed DDoS protection service, unrelated to centrally managing or auditing permissions.

Answer

Amazon Inspector

Answer

AWS Shield