SCS-C02 Management and Security Governance Practice Test 17 — 15 Questions

Question 1

A company has a requirement that all Amazon EC2 instances must be launched with an IAM role that grants least-privilege permissions. The security team wants to prevent users from launching instances without a role, and also want to ensure that the role used is one of a set of approved roles. How can this be enforced?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Attach an IAM policy to users that denies ec2:RunInstances unless the ec2:InstanceProfile condition matches an approved profile ARN.. Option B uses an IAM policy with a condition on the ec2:InstanceProfile key to ensure that only approved instance profiles are used. This satisfies both requirements: a role must be attached, and it must be one of the approved roles.

Option A is incorrect because an SCP that requires an IAM role cannot restrict the role to a specific set of approved roles; it would allow any role.

Option C is incorrect because SCPs require AWS Organizations and apply to all principals in the account. While SCPs can technically use the ec2:InstanceProfile condition key, they are typically used for broad guardrails and not for user-specific restrictions. An IAM policy with a condition is the recommended method for this use case.

Option D is incorrect because AWS Config is a detective service; it cannot prevent unauthorized launches, only detect them after the fact.

Answer

Use an SCP to require that all EC2 instances have an IAM role attached.

Answer

Use an SCP to deny ec2:RunInstances unless the instance profile is in a specific list of ARNs.

Answer

Use AWS Config to detect instances without a role and automatically terminate them.

Question 2

A company's security team is implementing a solution to automatically revoke public access to Amazon S3 buckets that become public. The solution must be serverless and use native AWS services. Which combination of services should be used?

Accepted Answer

Amazon EventBridge (CloudWatch Events) to detect PutBucketPolicy events and invoke an AWS Lambda function to remove the policy. Amazon EventBridge (option B) can detect S3 bucket policy changes via CloudTrail (e.g., PutBucketPolicy events) and invoke an AWS Lambda function to remove the public policy, providing automatic remediation. Option A is incorrect because S3 event notifications on ObjectCreated only respond to object-level events, not bucket policy changes. Option C is incorrect because CloudWatch Logs with a metric filter and alarm can only send notifications, not directly remediate the bucket policy. Option D is incorrect because while AWS Config can detect non-compliant buckets with the managed rule 's3-bucket-public-read-prohibited', automatic remediation typically requires a custom Lambda function or Systems Manager Automation, and the option specifies Systems Manager, which is not as serverless-native as using Lambda directly; moreover, the combination described does not automatically revoke access without additional components.

Answer

Amazon S3 event notifications on ObjectCreated events to invoke a Lambda function

Answer

Amazon CloudWatch Logs with a metric filter and alarm to trigger an SNS notification

Answer

AWS Config with managed rule 's3-bucket-public-read-prohibited' and auto-remediation via Systems Manager

Question 3

The exhibit shows an SCP attached to an organizational unit. What is the effect of this policy?

Accepted Answer

It allows s3:PutBucketPolicy only if the bucket ACL is set to bucket-owner-full-control.. The SCP denies s3:PutBucketPolicy only when the bucket ACL is not set to 'bucket-owner-full-control'. If the ACL is set to that value, the action is allowed. Thus, it ensures that when a bucket policy is created, the ACL must grant full control to the bucket owner. It does not deny all PutBucketPolicy actions.

Answer

It denies all s3:PutBucketPolicy actions on all buckets.

Answer

It denies s3:PutBucketPolicy for any bucket that does not have an ACL.

Answer

It allows s3:PutBucketPolicy for buckets owned by the management account.

Question 4

The exhibit shows an S3 bucket policy. The security team wants to ensure that only users from account 123456789012 can access objects in the bucket. What is a potential security issue with this policy?

Accepted Answer

The policy grants access to all IAM users in the account, not just specific ones.. The policy uses a Principal of "123456789012" which effectively grants access to all IAM users and roles within that AWS account. This means any user in the account who has permission to call s3:GetObject can access the bucket objects, making it overly permissive. The correct answer is A because this is the security issue—no restriction to specific users or roles.

Answer

The policy does not restrict access to a specific VPC.

Answer

The policy uses a wildcard in the resource ARN.

Answer

The policy does not require MFA.

Question 5

A security team is reviewing IAM roles and policies. They want to ensure that any new IAM role created in the account must include a specific managed policy (e.g., SecurityAudit). What AWS service can enforce this requirement?

Accepted Answer

Service control policy (SCP) in AWS Organizations. AWS CloudTrail logs API calls but does not enforce policies. Option B is incorrect because AWS Config rules can detect noncompliant roles after creation but cannot prevent their creation. Option C is correct because Service Control Policies (SCPs) in AWS Organizations can deny the creation of IAM roles that do not have a specific managed policy attached, using a condition like `aws:RequestedManagedPolicy`. Option D is incorrect because IAM permissions boundaries limit the maximum permissions a role can have but do not enforce attachment of a specific managed policy.

Answer

AWS CloudTrail

Answer

AWS Config rules

Answer

IAM permissions boundary

Question 6

A company uses AWS Organizations with a management account and several member accounts. The security team wants to restrict the use of specific AWS services (e.g., EC2, Lambda) in certain accounts based on the account's environment (dev, test, prod). Which approach should be used to implement this requirement?

Accepted Answer

Use AWS Organizations to tag accounts (e.g., Environment=Dev) and use SCPs with conditions to deny access to services based on tags.. By tagging accounts in AWS Organizations (e.g., Environment=Dev) and using Service Control Policies (SCPs) with conditions based on those tags, the security team can restrict usage of specific AWS services per account environment. SCPs are applied at the organization level and affect all users and roles in the account, providing preventive controls. Option A is incorrect because CloudTrail only logs API calls and does not prevent usage; revoking access after the fact is not a preventive measure. Option B is incorrect because IAM roles are identity-based and do not restrict services at the account level; also, managing roles per account would be cumbersome. Option D is incorrect because AWS Config rules detect non-compliant resource configurations but do not prevent the use of services; they are detective controls.

Answer

Use AWS CloudTrail to monitor API calls and revoke access after the fact.

Answer

Create IAM roles in each account with policies that deny access to services.

Answer

Use AWS Config rules to detect and alert when restricted services are used.

Question 7

A security engineer needs to ensure that all EC2 instances launched in an account have a specific tag (e.g., CostCenter) applied. If an instance is launched without the tag, it should be automatically terminated. Which solution meets these requirements with minimal effort?

Accepted Answer

Use AWS Config rules with an automatic remediation action that invokes a Lambda function to terminate the instance.. AWS Config rules can detect EC2 instances that are missing the required tag and trigger an automatic remediation action via a Lambda function to terminate them, providing a fully automated solution with minimal effort. Option A is wrong because SCPs cannot enforce tagging on individual EC2 instances at launch time; they can only deny actions based on conditions, but tagging conditions are not supported for ec2:RunInstances. Option B is wrong because AWS Organizations Tag Policies enforce tagging on resources but do not automatically remediate non-compliant resources; they only prevent creation of resources without tags if applied at the service level, which is not the case here. Option D is wrong because CloudTrail logs events but cannot automatically terminate instances; it would require manual intervention or additional automation.

Answer

Use an SCP to deny ec2:RunInstances if the request does not include the required tag.

Answer

Use AWS Organizations Tag Policies to enforce the tag.

Answer

Use AWS CloudTrail to detect RunInstances events and send alerts to the security team.

Question 8

A security engineer is configuring AWS Config to track changes to security groups in a VPC. The engineer wants to be notified when a security group is modified. Which TWO steps are required to achieve this?

Accepted Answer

Configure an SNS topic and subscribe to it to receive notifications when the Config rule triggers.. Options A and D are correct. To monitor security group changes with AWS Config, you need to create an AWS Config rule (option D) that tracks changes to security groups. To receive notifications when the rule triggers, you configure an SNS topic and subscribe to it (option A). Option B is incorrect because AWS CloudTrail logs API calls to security groups, but Config itself monitors resource configuration changes without requiring CloudTrail. Option C is incorrect because Amazon GuardDuty is a threat detection service, not a configuration change monitor. Option E is incorrect because VPC Flow Logs capture network traffic, not configuration changes. The common pitfall is assuming CloudTrail or GuardDuty is necessary, but Config's built-in change tracking suffices.

Answer

Enable AWS CloudTrail to log security group changes.

Answer

Enable Amazon GuardDuty to detect security group modifications.

Answer

Enable VPC Flow Logs to capture security group activity.

Question 9

A company is using AWS Organizations to manage multiple accounts. The security team needs to enforce that all newly created S3 buckets across the organization have server-side encryption (SSE-S3) enabled by default. Which solution is MOST operationally efficient?

Accepted Answer

Apply an SCP to the root organizational unit that denies s3:CreateBucket if the bucket lacks encryption settings.. Applying an SCP to the root organizational unit that denies s3:CreateBucket unless encryption settings are specified is the most operationally efficient because it prevents noncompliant buckets from being created at the organizational level. Option A (Lambda triggered by S3 events) is reactive and requires ongoing management. Option B (setting default encryption per account) does not enforce across all accounts and can be overridden. Option D (AWS Config rule with remediation) only detects and fixes noncompliant buckets after creation, which is less efficient than prevention.

Answer

Create an AWS Lambda function that is triggered by S3 event notifications to enable encryption on any new bucket.

Answer

Set a default bucket encryption policy in each account’s S3 console.

Answer

Use AWS Config with a managed rule s3-bucket-server-side-encryption-enabled to trigger remediation.

Question 10

A security engineer is designing a solution to automatically remediate noncompliant EC2 security groups. The company uses AWS Organizations with multiple accounts. The engineer wants to deploy an AWS Config rule and a custom Lambda function in a central security account to evaluate and remediate security groups across all accounts. Which combination of steps is REQUIRED to allow the Lambda function to modify security groups in member accounts? (Choose TWO.)

Accepted Answer

Create an IAM role in each member account that allows the central security account to assume it.. The correct approach is to use AWS Config aggregated rules with remediation actions that invoke Lambda cross-account. Option A is required to allow the central account to assume a role in member accounts; Option C is required to invoke the Lambda function from Config. Option B (same account) is not cross-account. Option D is not required because Config aggregates can work with individual accounts. Option E is redundant.

Answer

Use AWS CloudFormation StackSets to deploy the Lambda function to all member accounts.

Answer

Attach a resource-based policy to the Lambda function granting access to Config from all member accounts.

Answer

Create the Lambda function in each member account and configure Config rules in each account.

Question 11

A company uses AWS CloudFormation to deploy infrastructure. The security team requires that all CloudTrail trails be encrypted with a customer-managed KMS key. Which CloudFormation template snippet correctly enforces this requirement?

Accepted Answer

Trail with KMSKeyId set to 'arn:aws:kms:us-east-1:123456789012:key/abcd1234-...'. It uses the full ARN of a specific customer-managed KMS key, ensuring the encryption requirement is met. Option C uses an alias, which could point to either an AWS managed key or a customer-managed key, so it does not guarantee compliance. Option A uses the AWS managed key 'aws/cloudtrail', not customer-managed. Option D omits encryption entirely.

Answer

Trail with KMSKeyId set to 'aws/cloudtrail'

Answer

Trail with KMSKeyId set to 'alias/my-cloudtrail-key'

Answer

Trail without KMSKeyId specified

Question 12

A company uses AWS Key Management Service (KMS) to encrypt data. The security team needs to ensure that KMS keys cannot be deleted accidentally. Which action should be taken?

Accepted Answer

Create an IAM policy that denies kms:ScheduleKeyDeletion for the key.. To prevent accidental deletion of KMS keys, you must deny the kms:ScheduleKeyDeletion permission. An IAM policy attached to the key (key policy) or to the user/role can explicitly deny this action. Option B is correct because it directly denies the permission needed to schedule deletion. Option A (SCP denying kms:ScheduleKeyDeletion) can be used at the organizational level but is not the most direct per-key control. Option C (automatic key rotation) does not prevent deletion. Option D is invalid because KMS does not have a deletion protection toggle; protection is achieved through IAM/key policies.

Answer

Apply an SCP that denies kms:ScheduleKeyDeletion for all accounts.

Answer

Enable automatic key rotation.

Answer

Enable deletion protection on the key.

Question 13

A company is implementing a data retention policy for CloudTrail logs. The logs are stored in an S3 bucket. The policy requires that logs be retained for 7 years and then automatically deleted. Which TWO actions should the security engineer take to meet this requirement?

Accepted Answer

Enable S3 Object Lock in compliance mode on the bucket.. To retain logs for 7 years and then automatically delete, the security engineer should enable S3 Object Lock in compliance mode (B) to prevent any deletion during the retention period, and create an S3 Lifecycle policy to expire objects after 2555 days (E). The Object Lock ensures logs cannot be deleted prematurely, while the lifecycle policy handles automatic deletion after 7 years. Option C is incorrect because denying s3:DeleteObject to all principals would block the lifecycle policy from deleting objects. Options A and D are not suitable for this requirement.

Answer

Use AWS Backup to manage retention and deletion.

Answer

Configure the S3 bucket policy to deny s3:DeleteObject actions for all principals.

Answer

Enable S3 Versioning and create a lifecycle policy to delete noncurrent versions.

Question 14

A security engineer is auditing IAM policies. The engineer wants to identify if any policy grants 'Effect: Allow' with 'Action: *' and 'Resource: *'. Which TWO AWS services can be used to detect such overly permissive policies?

Accepted Answer

AWS Config. IAM Access Analyzer can analyze policies for broad permissions. AWS Config can evaluate custom rules to check for such policies. Option A (CloudTrail) logs usage, not policy content. Option B (Trusted Advisor) checks some but not all policies. Option E (GuardDuty) does not analyze IAM policies.

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Question 15

Which TWO actions are valid ways to enforce the principle of least privilege in an AWS environment?

Accepted Answer

Grant only the necessary actions in IAM policies. Options C and D are correct. Option C is correct because IAM policies should grant only the necessary actions, adhering to least privilege. Option D is correct because SCPs can deny actions that are not required across accounts, enforcing least privilege at the organization level. Option A is wrong because using the root user for daily administration grants unrestricted access, violating least privilege. Option B is wrong because S3 bucket policies that allow all IAM users do not restrict permissions per user. Option E is wrong because assigning the AdministratorAccess managed policy grants full access, contradicting least privilege.

Answer

Use the root user for daily administration

Answer

Use S3 bucket policies to allow all IAM users

Answer

Assign the AdministratorAccess managed policy to all users