SCS-C02 Management and Security Governance Practice Test 17 — 15 Questions

Question 1

Which TWO AWS services can be used to detect and alert on unauthorized API calls in real time?

Accepted Answer

Amazon CloudWatch Alarms. Amazon CloudWatch Alarms (A) is correct because you can create metric filters on CloudTrail log groups that match unauthorized API calls (e.g., AccessDenied or specific error codes), and the alarm triggers an SNS notification in near real time. Amazon EventBridge (C) is correct because it can receive CloudTrail management events, match patterns for unauthorized API activity (such as errorCode values), and route them to targets like SNS, Lambda, or SQS for immediate alerting. AWS KMS (B) is a key management service, not an API-call detection or alerting service. AWS IAM (D) controls authentication and authorization but does not itself detect or alert on unauthorized calls. AWS Config (E) evaluates resource configuration compliance and records configuration changes, not real-time API-call alerting.

Answer

AWS KMS

Answer

AWS IAM

Answer

AWS Config

Question 2

Refer to the exhibit. An IAM policy is attached to a user. The user attempts to upload an object to my-bucket using server-side encryption with AWS KMS (SSE-KMS). What is the outcome?

Accepted Answer

The upload fails because the Deny statement denies any PutObject that does not use AES256 encryption.. The policy contains an explicit Deny for s3:PutObject when the request does not use AES256 server-side encryption. In IAM, an explicit Deny always overrides any Allow, so a PutObject using SSE-KMS (aws:kms) fails even though the Allow statement matches the action and resource. The Deny condition effectively whitelists only AES256, making any other encryption mode—including SSE-KMS—blocked.

Answer

The upload fails because the Allow statement requires AES256 encryption.

Answer

The upload succeeds because the policy does not explicitly deny SSE-KMS.

Answer

The upload succeeds because the Allow statement matches the s3:PutObject action.

Question 3

Refer to the exhibit. A company uses this CloudFormation template. What security best practice is being violated?

Accepted Answer

The security group allows SSH access from all IP addresses.. The security group allows SSH access from all IP addresses (0.0.0.0/0), which is a significant security risk that exposes the instance to unauthorized access. Option A is wrong because the instance type is a performance consideration, not a security best practice. Option C is wrong because specifying the AMI ID as a parameter is not a security requirement; it is a parameterization best practice but not security-related. Option D is wrong because while encryption is a security best practice, the most critical violation here is the open SSH access, as it directly exposes the instance to potential attacks.

Answer

The instance type is too small for production workloads.

Answer

The AMI ID is not specified as a parameter.

Answer

The EBS volume is not encrypted.

Question 4

A company needs to audit all changes to IAM policies in their AWS account. Which AWS service should they use to record these changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity in an AWS account, including all changes to IAM policies (CreatePolicy, PutRolePolicy, AttachRolePolicy, etc.). CloudTrail captures the identity of the caller, the time, the source IP, and the request parameters, making it the authoritative service for auditing IAM policy changes. It is enabled by default for management events and can be configured for multi-region and organization-wide trails.

Answer

Amazon S3

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Question 5

A company has a multi-account AWS Organization with hundreds of accounts. The security team wants to prevent any IAM user from creating access keys in any account. What is the most scalable and secure approach?

Accepted Answer

Apply an SCP that denies the IAM:CreateAccessKey action to all accounts in the organization.. Service Control Policies (SCPs) applied at the organization or OU level deny the IAM:CreateAccessKey action across every account in one place, which is the most scalable and preventive control. Because SCPs are inherited, a single policy blocks access key creation in all current and future accounts without per-account configuration.

Answer

Use IAM Access Analyzer to generate findings when access keys are created.

Answer

Configure IAM password policies in each account to disallow access keys.

Answer

Create an AWS Config rule in each account to automatically delete access keys.

Question 6

A company wants to ensure that all S3 buckets in their AWS account have encryption enabled. Which AWS service can continuously evaluate compliance and automatically remediate non-compliant buckets?

Accepted Answer

AWS Config. AWS Config is the service that continuously evaluates resource configurations against desired policies and can automatically remediate non-compliant resources. It can monitor S3 bucket encryption settings and trigger remediation actions (e.g., via SSM Automation) to enable encryption. AWS Config rules can be configured to check for encryption and automatically remediate using remediation actions.

Answer

AWS CloudTrail

Answer

AWS IAM

Answer

Amazon S3

Question 7

A security auditor needs to view a list of all IAM users, including their last activity timestamps, for a compliance review. Which AWS service provides this information natively?

Accepted Answer

AWS IAM credential report. The AWS IAM credential report is a native feature that generates a CSV containing all IAM users, their access keys, password status, MFA status, and key rotation dates including last activity timestamps. It is specifically designed for auditing user credentials and activity, making it the correct choice for a compliance review of last activity.

Answer

AWS CloudTrail

Answer

IAM Access Analyzer

Answer

AWS Config

Question 8

A security engineer is designing a system to detect and respond to IAM policy changes that could grant excessive permissions. The solution must alert within minutes of the change and automatically revert the change if it violates a predefined baseline. Which combination of services should the engineer use?

Accepted Answer

AWS CloudTrail, Amazon CloudWatch Events, and AWS Lambda. AWS CloudTrail logs IAM policy changes. Amazon CloudWatch Events (now EventBridge) can match specific API calls (e.g., PutRolePolicy) and trigger an AWS Lambda function within minutes. The Lambda function can evaluate the change against a baseline and automatically revert it if it violates the policy, providing both detection and remediation.

Answer

AWS CloudTrail and Amazon S3

Answer

AWS Config and AWS Systems Manager

Answer

IAM Access Analyzer and AWS Lambda

Question 9

What is the purpose of an AWS Service Control Policy (SCP) in AWS Organizations?

Accepted Answer

To set permission guardrails that restrict what actions accounts in the organization can perform.. SCPs are used to centrally control the maximum available permissions for all accounts in an organization. Option A is wrong because SCPs do not grant permissions; they restrict them. Option B is wrong because SCPs apply to all users and roles, not just root. Option C is wrong because SCPs are not for monitoring; they are permission guardrails.

Answer

To grant specific permissions to users in member accounts.

Answer

To restrict only the root user of each member account.

Answer

To monitor and log API activity across the organization.

Question 10

A company wants to implement a least-privilege access model for their AWS resources. Which TWO of the following are best practices for achieving this?

Accepted Answer

Grant permissions only for the specific actions required.. Granting only the necessary permissions is the core of least-privilege. Option D is correct because using conditions to restrict access based on attributes like source IP or time further enforces least-privilege. Option A is wrong because using a single IAM role for all users violates the least-privilege principle by granting excessive permissions. Option C is wrong because attaching policies to groups is a best practice for manageability, but it does not directly address least-privilege. Option E is wrong because using only AWS managed policies may grant more permissions than needed; customer managed policies can be tailored to specific requirements.

Answer

Use a single IAM role for all users in the account.

Answer

Attach IAM policies to groups rather than individual users.

Answer

Always use AWS managed policies instead of customer managed policies.

Question 11

Which TWO of the following are valid AWS IAM security best practices?

Accepted Answer

Implement a strong password policy for IAM users.. Option A is correct because implementing a strong IAM account password policy enforces complexity requirements such as minimum length, uppercase/lowercase, numbers, symbols, and rotation, which reduces the risk of brute-force and credential-guessing attacks against IAM user sign-ins. Option D is correct because enabling MFA for privileged users adds a second authentication factor, so a compromised password alone is insufficient to perform sensitive actions, which is a core AWS IAM best practice. Option B is not a best practice because IAM access keys are long-term credentials tied to a specific identity and must never be shared; sharing them breaks accountability and complicates rotation and revocation. Option C is not correct as stated because AWS recommends disabling (deactivating) credentials and removing permissions before deleting users, and deletion should be done only when the identity is truly no longer needed. Option E is not a best practice because the root user has unrestricted access and should be used only for the few tasks that require it, with MFA enabled and access keys removed.

Answer

Share IAM user access keys among team members for convenience.

Answer

Delete IAM users instead of disabling them when not needed.

Answer

Use the AWS account root user for everyday administrative tasks.

Question 12

A company is implementing a multi-account strategy using AWS Organizations. The security team wants to enforce that all newly created member accounts automatically have an IAM role that allows read-only access to the management account. Which configuration should be used?

Accepted Answer

Use AWS CloudFormation StackSets to deploy the role to all existing and future accounts.. AWS CloudFormation StackSets is the correct service for deploying a common IAM role across multiple accounts, including automatically to new accounts as they are added to the organization. When you create a StackSet with service-managed permissions, you can enable automatic deployments so that the stack instance is created in every new account that joins the target organizational unit (OU). This directly satisfies the requirement to enforce the role's presence in all newly created member accounts without custom automation.

Answer

Create an AWS Lambda function that listens for AWS CloudTrail CreateAccount events and creates the role in the new account.

Answer

Use an AWS Config managed rule to evaluate new accounts and trigger a remediation action to create the role.

Answer

Configure an SCP with the 'iam_role' setting to specify a role name and path to be automatically created in new accounts.

Question 13

A company has a requirement to audit all API calls made to AWS services in their account. Which AWS service should be used to meet this requirement?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records all API calls made to AWS services in an account, capturing the identity of the caller, the time, the source IP, the request parameters, and the response. It is the authoritative service for auditing API activity across the AWS account, and it can deliver logs to S3, CloudWatch Logs, or EventBridge for analysis and alerting. Enabling CloudTrail in all regions with log file validation is a standard compliance requirement.

Answer

AWS Config

Answer

Amazon Inspector

Answer

Amazon GuardDuty

Question 14

A company uses AWS Organizations with multiple accounts. The security team wants to prevent all users in the production account from disabling AWS CloudTrail or modifying its configuration. What is the MOST effective way to achieve this?

Accepted Answer

Create an SCP in AWS Organizations that denies cloudtrail:StopLogging, cloudtrail:DeleteTrail, cloudtrail:UpdateTrail, and similar actions.. Service Control Policies (SCPs) in AWS Organizations provide centralized, preventive control over the maximum permissions for all accounts in an organization or OU. By creating an SCP that denies CloudTrail actions such as StopLogging, DeleteTrail, and UpdateTrail, the security team can ensure that no user or role in the production account can disable or modify CloudTrail, even if they have IAM permissions. This is the most effective and scalable way to enforce this restriction across the account.

Answer

Use IAM policies to deny only cloudtrail:DeleteTrail for all users.

Answer

Enable CloudTrail log file validation and use AWS Config to detect changes.

Answer

Attach an IAM permissions boundary to all IAM roles in the production account that denies CloudTrail modifications.

Question 15

A company wants to ensure that all IAM users have multi-factor authentication (MFA) enabled. Which AWS service can be used to detect users without MFA and automatically send a notification?

Accepted Answer

AWS Config. AWS Config is the correct answer because it provides a managed rule 'iam-user-mfa-enabled' that can evaluate whether IAM users have MFA enabled. When a non-compliant user is detected, AWS Config can trigger an SNS notification to alert administrators. AWS Trusted Advisor (option A) only checks MFA on the root account, not all IAM users. AWS CloudTrail (option B) records API activity but does not evaluate configuration rules. AWS IAM (option D) itself does not have automatic detection and notification capabilities for MFA status.

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Answer

AWS IAM