SCS-C02 Management and Security Governance Practice Test 16 — 15 Questions

Question 1

A company wants to centrally manage and enforce encryption on all EBS volumes across multiple AWS accounts. Which AWS service can be used to define and enforce encryption policies at the organizational level?

Accepted Answer

AWS Organizations. Option A is correct: AWS Organizations can use SCPs or, more specifically, the EBS encryption by default policy can be enforced via a combination of SCP and AWS Config. However, the most direct service is AWS Organizations for centralized policy management. Option B is wrong because IAM is per-account. Option C is wrong because AWS KMS manages keys, not enforcement. Option D is wrong because AWS Config evaluates but cannot enforce encryption by default across accounts without additional automation.

Answer

AWS Config

Answer

AWS IAM

Answer

AWS Key Management Service (KMS)

Question 2

A security engineer is designing a system to detect and respond to IAM policy changes that could grant excessive permissions. The solution must alert within minutes of the change and automatically revert the change if it violates a predefined baseline. Which combination of services should the engineer use?

Accepted Answer

AWS CloudTrail, Amazon CloudWatch Events, and AWS Lambda. Option D is correct: AWS CloudTrail logs the change, CloudWatch Events triggers a Lambda function that compares the new policy to a baseline stored in S3, and if a violation is detected, the function reverts the change. Option A is wrong because AWS Config does not auto-remediate quickly and is not event-driven in real time. Option B is wrong because S3 does not process events. Option C is wrong because IAM Access Analyzer does not auto-remediate.

Answer

AWS CloudTrail and Amazon S3

Answer

AWS Config and AWS Systems Manager

Answer

IAM Access Analyzer and AWS Lambda

Question 3

What is the purpose of an AWS Service Control Policy (SCP) in AWS Organizations?

Accepted Answer

To set permission guardrails that restrict what actions accounts in the organization can perform.. Option A is correct: SCPs are used to centrally control the maximum available permissions for all accounts in an organization. Option B is wrong because SCPs do not grant permissions. Option C is wrong because SCPs apply to all users and roles, not just root. Option D is wrong because SCPs are not for monitoring.

Answer

To grant specific permissions to users in member accounts.

Answer

To restrict only the root user of each member account.

Answer

To monitor and log API activity across the organization.

Question 4

A company wants to implement a least-privilege access model for their AWS resources. Which TWO of the following are best practices for achieving this?

Accepted Answer

Grant permissions only for the specific actions required.. Option A is correct: granting only the necessary permissions is the core of least-privilege. Option D is correct: using conditions to restrict access based on attributes like IP or time. Option B is wrong because using a single role for all users violates least-privilege. Option C is wrong because attaching policies to groups is good, but not specifically for least-privilege. Option E is wrong because using managed policies alone does not ensure least-privilege.

Answer

Use a single IAM role for all users in the account.

Answer

Attach IAM policies to groups rather than individual users.

Answer

Always use AWS managed policies instead of customer managed policies.

Question 5

A security engineer is designing a solution to detect and alert on any S3 bucket that is publicly accessible. Which THREE services can be used together to achieve this?

Accepted Answer

AWS Security Hub. Option A is correct: CloudTrail logs S3 bucket policy changes. Option B is correct: AWS Config can evaluate bucket policies against a rule for public access. Option D is correct: S3 itself can block public access via account-level settings, but that is not detection. Option C is correct: Security Hub aggregates findings from Config. Option E is wrong: VPC Flow Logs do not deal with S3 bucket policies.

Answer

Amazon S3 Block Public Access settings

Answer

Amazon VPC Flow Logs

Question 6

Which TWO of the following are valid AWS IAM security best practices?

Accepted Answer

Implement a strong password policy for IAM users.. Option A is correct: a password policy enforces complexity. Option D is correct: MFA adds an extra layer of security. Option B is wrong: access keys should not be shared. Option C is wrong: root user should be avoided for daily tasks. Option E is wrong: deleting users is not a best practice; deactivating is better.

Answer

Share IAM user access keys among team members for convenience.

Answer

Delete IAM users instead of disabling them when not needed.

Answer

Use the AWS account root user for everyday administrative tasks.

Question 7

A company is implementing a multi-account strategy using AWS Organizations. The security team wants to enforce that all newly created member accounts automatically have an IAM role that allows read-only access to the management account. Which configuration should be used?

Accepted Answer

Configure an SCP with the 'iam_role' setting to specify a role name and path to be automatically created in new accounts.. Option B is correct because AWS Organizations allows you to create a service control policy (SCP) that specifies a default IAM role for new accounts. Option A is wrong because CloudFormation StackSets can deploy resources but not automatically create roles for new accounts. Option C is wrong because AWS Config rules evaluate existing resources but do not provision roles for new accounts. Option D is wrong because AWS Lambda can be triggered by AWS CloudTrail events but is not the native mechanism for automatic role creation on new account creation.

Answer

Create an AWS Lambda function that listens for AWS CloudTrail CreateAccount events and creates the role in the new account.

Answer

Use AWS CloudFormation StackSets to deploy the role to all existing and future accounts.

Answer

Use an AWS Config managed rule to evaluate new accounts and trigger a remediation action to create the role.

Question 8

A security engineer is reviewing an SCP that denies access to a specific AWS service. The engineer notices that the SCP has an Effect of 'Deny' for 's3:PutObject' but the condition block uses 'StringEquals' with 'aws:SourceIp' set to an IP range. Users in the account are still able to upload objects to S3 from IP addresses outside the range. What is the most likely reason?

Accepted Answer

The SCP condition key 'aws:SourceIp' is not available for use in SCPs; SCPs only support condition keys that are global and listed in the AWS Global Condition Context Keys documentation for SCPs.. Option D is correct because SCPs do not support the aws:SourceIp condition key; they only support condition keys that are global in the context of the service control policy. Option A is wrong because SCPs are not limited to IAM users and groups; they apply to all principals in the account. Option B is wrong because SCPs support conditions, but not all condition keys are available. Option C is wrong because SCPs are evaluated before IAM policies and can deny actions.

Answer

The SCP condition key 'aws:SourceIp' is not supported for SCPs; SCPs only support conditions that are resource-based.

Answer

The SCP only applies to IAM users and groups, not to the root user.

Answer

The SCP is evaluated after IAM policies, so an IAM policy allowing the action overrides the SCP.

Question 9

A company has a requirement to audit all API calls made to AWS services in their account. Which AWS service should be used to meet this requirement?

Accepted Answer

AWS CloudTrail. Option B is correct because AWS CloudTrail records API activity in the account. Option A is wrong because Amazon GuardDuty is a threat detection service. Option C is wrong because AWS Config records resource configuration changes, not API calls. Option D is wrong because Amazon Inspector is a vulnerability assessment service.

Answer

AWS Config

Answer

Amazon Inspector

Answer

Amazon GuardDuty

Question 10

A company uses AWS Organizations with multiple accounts. The security team wants to prevent all users in the production account from disabling AWS CloudTrail or modifying its configuration. What is the MOST effective way to achieve this?

Accepted Answer

Create an SCP in AWS Organizations that denies cloudtrail:StopLogging, cloudtrail:DeleteTrail, cloudtrail:UpdateTrail, and similar actions.. Option C is correct because an SCP can deny actions related to CloudTrail across the entire account. Option A is wrong because IAM permissions boundaries limit permissions but can be overridden by an SCP. Option B is wrong because CloudTrail itself cannot prevent modifications to its configuration. Option D is wrong because it only prevents deletion, not modification.

Answer

Use IAM policies to deny only cloudtrail:DeleteTrail for all users.

Answer

Enable CloudTrail log file validation and use AWS Config to detect changes.

Answer

Attach an IAM permissions boundary to all IAM roles in the production account that denies CloudTrail modifications.

Question 11

A security engineer creates the IAM policy shown in the exhibit. The policy is attached to an IAM role. When a user assumes the role and attempts to upload an object to the bucket without specifying server-side encryption, what is the expected behavior?

Accepted Answer

The request is denied because the condition is not met.. Option A is correct because the policy requires the condition s3:x-amz-server-side-encryption to be equal to aws:kms. If the request does not include encryption, the condition fails and the request is denied. Option B is wrong because the policy does not allow requests without encryption. Option C is wrong because the condition applies to PutObject as well. Option D is wrong because the condition is not ignored.

Answer

The request succeeds because the condition is ignored for PutObject.

Answer

The request is denied only if the object is publicly accessible.

Answer

The request succeeds because the condition is only for GetObject.

Question 12

A company wants to ensure that all IAM users have multi-factor authentication (MFA) enabled. Which AWS service can be used to detect users without MFA and automatically send a notification?

Accepted Answer

AWS Config. Option B is correct because AWS Config has a managed rule 'iam-user-mfa-enabled' that can evaluate IAM users and trigger an SNS notification. Option A is wrong because IAM itself does not have automatic detection and notification. Option C is wrong because CloudTrail records events but does not evaluate configuration. Option D is wrong because Trusted Advisor checks for MFA on root account but not on all IAM users.

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Answer

AWS IAM

Question 13

A security engineer is designing a system to centrally manage security rules across multiple AWS accounts. The engineer wants to ensure that any resources that are non-compliant with security policies are automatically remediated. Which combination of services should the engineer use?

Accepted Answer

AWS Config with AWS Lambda for automatic remediation. Option A is correct because AWS Config can detect non-compliant resources and trigger Lambda functions for remediation. Option B is wrong because Security Hub provides findings but does not automatically remediate. Option C is wrong because CloudTrail logs events but does not evaluate compliance. Option D is wrong because GuardDuty provides threat detection but not configuration compliance.

Answer

AWS CloudTrail with Amazon SNS

Answer

Amazon GuardDuty with AWS Step Functions

Answer

AWS Security Hub with Amazon EventBridge

Question 14

A company uses AWS Organizations with many accounts. The security team wants to ensure that no account can disable AWS CloudTrail or stop logging. Which configuration should be used?

Accepted Answer

Apply an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail.. Option A is correct because an SCP can deny the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions at the organizational level. Option B is wrong because AWS Config rules can detect but not prevent. Option C is wrong because IAM policies in the master account do not affect member accounts. Option D is wrong because CloudTrail itself cannot prevent its own modification.

Answer

Enable CloudTrail log file validation.

Answer

Attach an IAM policy to the root user in each account.

Answer

Use AWS Config rules to detect and alert when CloudTrail is modified.

Question 15

A company needs to centrally manage access to AWS resources across multiple accounts. Which AWS service should be used to define and enforce a set of common permissions for all accounts in the organization?

Accepted Answer

AWS Organizations with SCPs. Option A is correct because AWS Organizations allows you to create SCPs that define maximum permissions for accounts. Option B is wrong because IAM is per-account. Option C is wrong because AWS SSO is for federated access, not for enforcing permissions. Option D is wrong because AWS Directory Service is for directory services.

Answer

AWS Directory Service

Answer

AWS IAM

Answer

AWS Single Sign-On (SSO)