SCS-C02 Management and Security Governance Practice Test 16 — 15 Questions

Question 1

A security engineer is auditing IAM policies. The engineer wants to identify if any policy grants 'Effect: Allow' with 'Action: *' and 'Resource: *'. Which TWO AWS services can be used to detect such overly permissive policies?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Config. IAM Access Analyzer can analyze policies for broad permissions. AWS Config can evaluate custom rules to check for such policies. Option A (CloudTrail) logs usage, not policy content. Option B (Trusted Advisor) checks some but not all policies. Option E (GuardDuty) does not analyze IAM policies.

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Question 2

A company is using AWS Organizations to manage multiple accounts. The security team wants to prevent any IAM user from creating access keys. Which type of policy should be used to enforce this control across all accounts?

Accepted Answer

Service Control Policy (SCP). A Service Control Policy (SCP) can be applied to the organization root or OUs to centrally deny the IAM action 'CreateAccessKey' across all member accounts, preventing any IAM user from creating access keys. Option B is incorrect because CloudTrail only logs actions, it does not enforce policies. Option C is incorrect because an AWS Config rule can detect non-compliant changes but cannot prevent them. Option D is incorrect because IAM permissions boundaries are applied per account and cannot enforce a blanket denial across all accounts in an organization.

Answer

AWS CloudTrail trail

Answer

AWS Config managed rule

Answer

IAM permissions boundary

Question 3

Which TWO actions are valid ways to enforce the principle of least privilege in an AWS environment?

Accepted Answer

Grant only the necessary actions in IAM policies. Options C and D are correct. Option C is correct because IAM policies should grant only the necessary actions, adhering to least privilege. Option D is correct because SCPs can deny actions that are not required across accounts, enforcing least privilege at the organization level. Option A is wrong because using the root user for daily administration grants unrestricted access, violating least privilege. Option B is wrong because S3 bucket policies that allow all IAM users do not restrict permissions per user. Option E is wrong because assigning the AdministratorAccess managed policy grants full access, contradicting least privilege.

Answer

Use the root user for daily administration

Answer

Use S3 bucket policies to allow all IAM users

Answer

Assign the AdministratorAccess managed policy to all users

Question 4

Which THREE AWS services can be used to centrally manage and audit permissions across multiple accounts in AWS Organizations?

Accepted Answer

AWS IAM Access Analyzer. The correct answers are C: AWS IAM Access Analyzer, D: AWS CloudTrail, and E: AWS Config. IAM Access Analyzer helps identify resources shared with external entities by analyzing resource policies across accounts in AWS Organizations. CloudTrail logs API activity across accounts and can be aggregated into a single trail for auditing. AWS Config allows you to aggregate compliance data and configuration changes from multiple accounts and regions using an aggregator. AWS Security Hub is another service but is not listed. Options A and B are incorrect because Amazon Inspector is a vulnerability assessment service, and AWS Shield is a DDoS protection service; neither centrally manages or audits permissions.

Answer

Amazon Inspector

Answer

AWS Shield

Question 5

Which TWO AWS services can be used to detect and alert on unauthorized API calls in real time?

Accepted Answer

Amazon CloudWatch Alarms. Options A and C are correct. Amazon CloudWatch Alarms can be set on CloudWatch Logs metric filters that detect patterns from CloudTrail logs, enabling real-time alerting on unauthorized API calls. Amazon EventBridge can also process CloudTrail events and trigger alerts or automated actions based on patterns indicating unauthorized API calls. Option B is incorrect because AWS KMS is for encryption key management. Option D is incorrect because IAM is for identity and access management, not monitoring or alerting. Option E is incorrect because AWS Config is for compliance evaluation and configuration tracking, not real-time alerting on API calls.

Answer

AWS KMS

Answer

AWS IAM

Answer

AWS Config

Question 6

Refer to the exhibit. A security engineer runs the CLI command to determine if the IAM user 'testuser' created a key pair in January 2023. The output shows one event. What can be concluded from this output?

Accepted Answer

The user 'testuser' created the key pair 'my-key-pair' on January 15, 2023.. The CloudTrail event shows the user 'testuser' performed a CreateKeyPair action on January 15, 2023, resulting in the key pair 'my-key-pair'. Option A is incorrect because the event is logged in the same account (the user's ARN is from the same account). Option C is incorrect because the command specifically queries for CreateKeyPair events, not all actions. Option D is incorrect because CreateKeyPair is a write operation (indicated by ReadOnly: false).

Answer

The key pair 'my-key-pair' was created in a different AWS account.

Answer

The user 'testuser' performed all actions in January 2023.

Answer

The user 'testuser' performed a read-only operation.

Question 7

Refer to the exhibit. A company uses this CloudFormation template. What security best practice is being violated?

Accepted Answer

The security group allows SSH access from all IP addresses.. The security group allows SSH access from all IP addresses (0.0.0.0/0), which is a significant security risk that exposes the instance to unauthorized access. Option A is wrong because the instance type is a performance consideration, not a security best practice. Option C is wrong because specifying the AMI ID as a parameter is not a security requirement; it is a parameterization best practice but not security-related. Option D is wrong because while encryption is a security best practice, the most critical violation here is the open SSH access, as it directly exposes the instance to potential attacks.

Answer

The instance type is too small for production workloads.

Answer

The AMI ID is not specified as a parameter.

Answer

The EBS volume is not encrypted.

Question 8

A company needs to audit all changes to IAM policies in their AWS account. Which AWS service should they use to record these changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls, including IAM policy changes. Option D is correct because CloudTrail logs all IAM policy modifications. Option A (Amazon S3) is wrong because S3 is a storage service and does not record API calls. Option B (Amazon CloudWatch Logs) is wrong because CloudWatch Logs stores logs but does not directly record API calls for audit purposes. Option C (AWS Config) is wrong because AWS Config records resource state changes but not the API calls that caused those changes.

Answer

Amazon S3

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Question 9

A security engineer notices that an IAM user has permissions to launch EC2 instances but the engineer wants to ensure that all new instances are automatically tagged with the creator's user name. What is the most efficient way to enforce this?

Accepted Answer

Add an IAM policy to the user that uses a condition key 'aws:RequestTag/Creator' with a value '${aws:username}'.. Using an IAM policy with a condition key 'aws:RequestTag/Creator' set to '${aws:username}' ensures that any EC2 RunInstances request must include the tag 'Creator' with the IAM user's name, otherwise the request is denied. This enforces tagging at the time of instance creation. Option A (CloudTrail) only provides auditing, not enforcement. Option C (AWS Config rules) can detect and remediate after creation but is less efficient than proactive enforcement. Option D (SCP) can deny based on missing tags but cannot enforce the tag value to match the user name; also, SCPs are used for account-wide policies, not per-user.

Answer

Use AWS CloudTrail to monitor and alert on untagged instances.

Answer

Use AWS Config rules to automatically tag resources after creation.

Answer

Create an SCP that denies EC2:RunInstances unless the request includes a 'Creator' tag with the user name.

Question 10

A company has a multi-account AWS Organization with hundreds of accounts. The security team wants to prevent any IAM user from creating access keys in any account. What is the most scalable and secure approach?

Accepted Answer

Apply an SCP that denies the IAM:CreateAccessKey action to all accounts in the organization.. A service control policy (SCP) applied at the root or OU level can deny the IAM:CreateAccessKey action across all accounts in the organization, providing a scalable and preventive control. Option A is wrong: IAM Access Analyzer only generates findings, it does not block the creation of access keys. Option B is wrong: IAM password policies can control password requirements but do not restrict IAM user permissions to create access keys. Option D is wrong: AWS Config rules can detect and auto-remediate, but they are reactive and require per-account configuration, making them less scalable and secure than a preventive SCP.

Answer

Use IAM Access Analyzer to generate findings when access keys are created.

Answer

Configure IAM password policies in each account to disallow access keys.

Answer

Create an AWS Config rule in each account to automatically delete access keys.

Question 11

A company wants to ensure that all S3 buckets in their AWS account have encryption enabled. Which AWS service can continuously evaluate compliance and automatically remediate non-compliant buckets?

Accepted Answer

AWS Config. (AWS Config) is correct: AWS Config with the managed rule 's3-bucket-server-side-encryption-enabled' can continuously evaluate S3 buckets for encryption compliance and trigger auto-remediation actions to enable encryption on non-compliant buckets. Option A (AWS CloudTrail) is incorrect because CloudTrail records API activity but does not evaluate configuration compliance or auto-remediate. Option C (AWS IAM) is incorrect because IAM manages user permissions, not bucket encryption configurations. Option D (Amazon S3) is incorrect because S3 itself does not provide automatic compliance evaluation or remediation; it requires an external service like AWS Config.

Answer

AWS CloudTrail

Answer

AWS IAM

Answer

Amazon S3

Question 12

An organization uses AWS Organizations with multiple OUs. The security team wants to ensure that any new account created in the 'Production' OU automatically gets a set of mandatory tags (CostCenter, Environment) and that these tags cannot be removed. What is the most effective approach?

Accepted Answer

Apply an SCP that denies changes to the specified tags for all accounts in the Production OU.. An SCP can be applied to the Production OU in AWS Organizations to deny actions that modify the specified tags (using the aws:TagKeys condition key). This prevents removal or modification of CostCenter and Environment tags. Option A is wrong because AWS Service Catalog can provision resources but does not enforce tag immutability across accounts. Option B is wrong because AWS Config rules are detective, not preventive. Option C is wrong because IAM policies in each account are less centralized and harder to manage; SCPs provide a central control.

Answer

Use AWS Service Catalog to provision accounts with pre-defined tags.

Answer

Use AWS Config rules to detect untagged resources and send alerts.

Answer

Create an IAM policy in each account that prohibits tag removal.

Question 13

A security auditor needs to view a list of all IAM users, including their last activity timestamps, for a compliance review. Which AWS service provides this information natively?

Accepted Answer

AWS IAM credential report. IAM's credential report includes last activity timestamps for each user. Option A is wrong because CloudTrail logs API events but does not provide a consolidated report of user activity timestamps. Option B is wrong because IAM Access Analyzer analyzes resource policies, not user activity. Option D is wrong because AWS Config evaluates resource configurations, not user activity.

Answer

AWS CloudTrail

Answer

IAM Access Analyzer

Answer

AWS Config

Question 14

A company wants to centrally manage and enforce encryption on all EBS volumes across multiple AWS accounts. Which AWS service can be used to define and enforce encryption policies at the organizational level?

Accepted Answer

AWS Organizations. AWS Organizations enables centralized management of policies across multiple accounts. Through Service Control Policies (SCPs), you can enforce EBS encryption by default at the organizational level, ensuring all EBS volumes are encrypted across all member accounts. Option A (AWS Config) can evaluate compliance but does not enforce policies natively across accounts. Option B (IAM) is account-specific and cannot define org-wide policies. Option C (AWS KMS) manages encryption keys but does not enforce encryption policies on EBS volumes.

Answer

AWS Config

Answer

AWS IAM

Answer

AWS Key Management Service (KMS)

Question 15

A security engineer is designing a system to detect and respond to IAM policy changes that could grant excessive permissions. The solution must alert within minutes of the change and automatically revert the change if it violates a predefined baseline. Which combination of services should the engineer use?

Accepted Answer

AWS CloudTrail, Amazon CloudWatch Events, and AWS Lambda. AWS CloudTrail logs IAM policy changes, and Amazon CloudWatch Events monitors those logs in near real-time. When a change is detected, CloudWatch Events triggers an AWS Lambda function that evaluates the new policy against a predefined baseline (e.g., stored in S3). If the policy violates the baseline, the Lambda function automatically reverts the change. Option A is wrong because Amazon S3 alone cannot process events or trigger remediation. Option C is wrong because AWS Config evaluates resources periodically, not in real-time, and Systems Manager is not designed for automatic IAM policy rollback. Option D is wrong because IAM Access Analyzer identifies resources shared with external entities but does not provide event-driven auto-remediation.

Answer

AWS CloudTrail and Amazon S3

Answer

AWS Config and AWS Systems Manager

Answer

IAM Access Analyzer and AWS Lambda