SCS-C02 Management and Security Governance Practice Test 18 — 15 Questions

Question 1

A security engineer is designing a system to centrally manage security rules across multiple AWS accounts. The engineer wants to ensure that any resources that are non-compliant with security policies are automatically remediated. Which combination of services should the engineer use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Config with AWS Lambda for automatic remediation. AWS Config continuously evaluates resource configurations against desired policies (Config Rules), and its remediation action feature can invoke an AWS Lambda function automatically when a resource is found non-compliant. This combination provides both centralized, multi-account compliance evaluation (via a Config aggregator) and automated remediation, which is exactly what the question requires. Lambda gives the custom logic needed to fix the non-compliant resource, making this the only option that delivers automatic remediation based on compliance state.

Answer

AWS CloudTrail with Amazon SNS

Answer

Amazon GuardDuty with AWS Step Functions

Answer

AWS Security Hub with Amazon EventBridge

Question 2

A company uses AWS Organizations with many accounts. The security team wants to ensure that no account can disable AWS CloudTrail or stop logging. Which configuration should be used?

Accepted Answer

Apply an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail.. Service Control Policies (SCPs) in AWS Organizations are the only mechanism that can enforce a hard deny across all accounts in an organization, preventing even account root users from performing specified actions. By applying an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail, the security team ensures no account can disable or delete CloudTrail trails, regardless of IAM permissions within the account. SCPs define the maximum available permissions for accounts in the organization.

Answer

Enable CloudTrail log file validation.

Answer

Attach an IAM policy to the root user in each account.

Answer

Use AWS Config rules to detect and alert when CloudTrail is modified.

Question 3

A company needs to centrally manage access to AWS resources across multiple accounts. Which AWS service should be used to define and enforce a set of common permissions for all accounts in the organization?

Accepted Answer

AWS Organizations with SCPs. AWS Organizations with Service Control Policies (SCPs) allows you to centrally manage and enforce permissions across all accounts in an organization. SCPs define the maximum permissions for accounts and can be applied to the root, OUs, or individual accounts. Option A (AWS Directory Service) is for managed directory services, not for permissions management. Option B (IAM) is per-account and does not centrally manage multiple accounts. Option C (AWS SSO) is for federated access, not for enforcing permissions boundaries.

Answer

AWS Directory Service

Answer

AWS IAM

Answer

AWS Single Sign-On (SSO)

Question 4

Which TWO actions are effective for detecting and responding to unauthorized access in an AWS environment? (Choose two.)

Accepted Answer

Enable AWS CloudTrail and monitor logs for suspicious activity.. AWS CloudTrail records all API activity in your AWS environment, including management and data plane events. By enabling CloudTrail and monitoring its logs for suspicious activity (e.g., unusual API calls, failed authentication attempts, or access from unexpected IP addresses), you can detect unauthorized access. This is a foundational detective control that provides the audit trail necessary for incident response.

Answer

Use AWS Security Hub to automatically block suspicious IP addresses.

Answer

Enable VPC Flow Logs to capture all network traffic.

Answer

Enable IAM Access Analyzer to detect unauthorized access attempts.

Question 5

Which THREE are best practices for managing security in a multi-account AWS environment? (Choose three.)

Accepted Answer

Use SCPs to restrict permissions across accounts.. Option A is correct because AWS Organizations Service Control Policies (SCPs) are applied at the OU or account level and set the maximum available permissions for all IAM principals in member accounts, providing a centralized guardrail to restrict permissions across accounts. Option C is correct because a dedicated security account isolates security tooling (such as GuardDuty, Security Hub, and IAM Access Analyzer) and audit activities from production workloads, following AWS's recommended multi-account security structure. Option D is correct because centralizing logs in a dedicated security account (often via AWS Organizations CloudTrail organization trails and cross-account log destinations) protects audit data from tampering by account owners and enables unified monitoring and retention. Option B is incorrect because disabling CloudTrail removes the audit trail needed for incident response, compliance, and forensics; CloudTrail is a foundational detective control, not an optional cost to cut. Option E is incorrect because the root user has unrestricted access that cannot be limited by SCPs or IAM policies, so it should be locked away with MFA and never used for routine administrative tasks; least-privilege IAM roles or federated identities should be used instead.

Answer

Disable AWS CloudTrail in production accounts to reduce costs.

Answer

Use the root user of each account for administrative tasks.

Question 6

A company has a multi-account AWS Organization with 50 accounts. The security team uses AWS CloudTrail to log all API calls and sends the logs to a central S3 bucket in the security account. The team wants to ensure that any attempt to disable CloudTrail logging or delete the trail is detected and automatically remediated within 5 minutes. They have configured an AWS Config rule that triggers an AWS Lambda function when the CloudTrail configuration changes. However, the Lambda function is not being invoked when they test by stopping the trail. The Lambda function's IAM role has permissions to start and update CloudTrail. CloudTrail logs show that the Config rule is evaluating the resource, but the Lambda function is not triggered. What is the most likely cause?

Accepted Answer

The AWS Config service does not have permission to invoke the Lambda function.. AWS Config uses a service-linked role or a configured IAM role to invoke the Lambda function as the remediation action. If the Config service does not have permission to invoke the Lambda function — typically because the Lambda function's resource-based policy does not grant config.amazonaws.com the lambda:InvokeFunction permission, or the Config service role lacks the necessary trust — the rule will evaluate the resource but the remediation action will silently fail to trigger the Lambda. The question states the Lambda role already has CloudTrail permissions, so the missing link is Config's ability to invoke Lambda.

Answer

The S3 bucket policy does not allow CloudTrail to write logs.

Answer

The Lambda function's IAM role does not have permission to modify CloudTrail.

Answer

The CloudTrail trail does not have permission to send logs to the S3 bucket.

Question 7

A company wants to centrally manage backups for Amazon RDS instances across multiple AWS accounts. Which AWS service should be used to automate the creation and enforcement of backup policies?

Accepted Answer

AWS Backup. AWS Backup allows centralized backup policies across accounts and regions. Option A is wrong because S3 Lifecycle policies are for object lifecycle, not RDS backups. Option C is wrong because CloudTrail is for auditing API calls. Option D is wrong because Systems Manager is for operational management, not backup policies.

Answer

S3 Lifecycle policies

Answer

AWS CloudTrail

Answer

AWS Systems Manager

Question 8

A security team needs to ensure that all API calls made in the AWS account are logged and the logs are stored in a central S3 bucket that is encrypted with a KMS key. Which combination of steps should the team take to achieve this?

Accepted Answer

Enable CloudTrail and configure it to deliver logs to an encrypted S3 bucket.. AWS CloudTrail records all API calls made in an AWS account, including management events and optionally data events, and can be configured to deliver log files to a central S3 bucket. By enabling CloudTrail with an S3 bucket destination and configuring the bucket with SSE-KMS encryption using a KMS key, the team meets both requirements: logging all API calls and storing logs encrypted with KMS. This is the standard AWS approach for API activity auditing.

Answer

Enable AWS Config and have it deliver configuration history to an encrypted S3 bucket.

Answer

Enable CloudWatch Logs and stream logs to an encrypted S3 bucket.

Answer

Enable VPC Flow Logs and publish to an encrypted S3 bucket.

Question 9

A company wants to ensure that all Amazon S3 buckets are encrypted at rest. Which THREE services can be used together to automatically remediate unencrypted S3 buckets?

Accepted Answer

Amazon EventBridge. AWS Config (D) is correct because it continuously evaluates S3 bucket configuration against a managed rule such as s3-bucket-server-side-encryption-enabled and flags buckets that are not encrypted at rest. Amazon EventBridge (C) is correct because it can receive the AWS Config compliance-change event (or a Config rule evaluation result) and route it to a target for automated remediation. AWS Lambda (E) is correct because it serves as the remediation target, running code that calls PutBucketEncryption to enable default encryption on the noncompliant bucket. Amazon S3 default encryption (A) is not a remediation mechanism by itself; it only defines encryption applied to objects when the bucket setting is enabled, so it cannot detect or fix an unencrypted bucket. AWS CloudTrail (B) records API activity for auditing but does not evaluate resource compliance or trigger automatic remediation.

Answer

Amazon S3 default encryption

Answer

AWS CloudTrail

Question 10

A company's security team discovers that an EC2 instance in the production account has been compromised. The instance has an IAM role attached that allows it to read from an S3 bucket containing sensitive data. The team needs to immediately stop the data exfiltration while preserving the evidence. What should the team do first?

Accepted Answer

Apply an inline policy to the IAM role that denies all S3 actions.. The correct first step because applying an inline policy that denies all S3 actions to the IAM role immediately stops the compromised instance from accessing the S3 bucket, preventing data exfiltration while preserving the instance's state for forensic investigation. Option A is incorrect because detaching the S3 bucket from the VPC endpoint does not affect the instance's ability to access S3 through the internet or other endpoints. Option C is incorrect because removing the IAM role from the instance may not take effect immediately if the role's credentials are cached, and it could disrupt evidence collection. Option D is incorrect because terminating the instance would destroy volatile evidence and might not stop exfiltration in time if the instance is already sending data.

Answer

Detach the S3 bucket from the VPC endpoint.

Answer

Remove the IAM role from the EC2 instance.

Answer

Terminate the compromised EC2 instance immediately.

Question 11

A company uses AWS Organizations and wants to centrally manage CloudTrail trails across all accounts. Which feature should be enabled?

Accepted Answer

CloudTrail organization trail. A CloudTrail organization trail is a trail created in the management account of an AWS Organization that automatically applies to all member accounts. It logs events from every account in the organization to a single S3 bucket, enabling centralized management and compliance. This is the native feature designed for multi-account CloudTrail governance, requiring no per-account configuration.

Answer

Cross-account CloudTrail

Answer

Service Control Policy for CloudTrail

Answer

AWS Config aggregator

Question 12

A company has a requirement that all IAM users must use strong passwords. The security engineer needs to enforce a password policy that requires minimum 12 characters, at least one uppercase letter, and at least one number. The engineer sets the password policy in IAM. However, existing users with weak passwords are not forced to change them. What should the engineer do to enforce the policy for existing users?

Accepted Answer

Set the password expiration period to 0 to force immediate password change.. Setting the password policy to expire existing passwords will force users to change them on next login. Option A is wrong because the policy is already set; users are not forced to change. Option B is wrong because allowing users to change passwords does not enforce the policy. Option C is wrong because resetting passwords manually is not scalable and not required.

Answer

Manually reset each user's password to a strong password.

Answer

Enable 'Allow users to change their own password' in the policy.

Answer

Re-apply the password policy to each user.

Question 13

A company has a multi-account AWS environment managed with AWS Organizations. The security team wants to ensure that no EC2 instance in any account can be launched without a specific tag 'CostCenter'. The team has created a Service Control Policy (SCP) that denies the ec2:RunInstances action if the request does not include the tag 'CostCenter'. However, they find that instances are still being launched without the tag in some accounts. What is the most likely reason?

Accepted Answer

The accounts launching instances without tags are the management account.. The most likely reason is that the accounts launching instances without the tag are the management account. Service Control Policies (SCPs) do not affect the management account in AWS Organizations; they only apply to member accounts. Therefore, if the security team is testing from the management account, the SCP denying ec2:RunInstances without the 'CostCenter' tag will not be enforced. Option A is incorrect because 'aws:RequestTag' is the correct condition key for tagging requests, not 'aws:ResourceTag'. Option C is incorrect because SCPs work by denying actions, not by requiring explicit allows. Option D is incorrect because the SCP would still prevent unauthorized launches even without an explicit allow. The issue is specifically that SCPs do not apply to the management account.

Answer

The SCP uses the wrong condition key; it should use 'aws:ResourceTag' instead.

Answer

The SCP does not include an explicit allow for the action.

Answer

The SCP is not attached to the organizational units containing the accounts.

Question 14

A security engineer needs to ensure that all IAM policies in an AWS account are evaluated for overly permissive access, such as wildcard actions or resources, before they are attached to IAM roles. The engineer wants to automate this check and receive alerts when noncompliant policies are detected. Which AWS service should the engineer use?

Accepted Answer

AWS Identity and Access Management Access Analyzer. IAM Access Analyzer is designed to analyze IAM policies and resource policies to identify overly permissive access, including wildcard actions and resources. It provides findings and can be integrated with other services for alerts, making it the correct choice for automating policy evaluation.

Answer

Amazon GuardDuty

Answer

AWS Security Hub

Answer

AWS Trusted Advisor

Question 15

A security engineer is responsible for ensuring that all API calls made in an AWS account are logged and that the logs are immutable for at least one year. The engineer must also ensure that any attempt to delete or modify the logs triggers an alert. Which solution meets these requirements?

Accepted Answer

Enable AWS CloudTrail with log file validation, store logs in an S3 bucket with Object Lock in compliance mode for one year, and create an Amazon EventBridge rule to alert on DeleteObject or PutObject events for the bucket.. To achieve immutable logs for one year and alert on tampering, use CloudTrail with log file validation, S3 Object Lock in compliance mode to prevent deletion or modification, and EventBridge to detect and alert on DeleteObject or PutObject events for the bucket. This combination ensures logs cannot be altered and any attempt triggers an alert.

Answer

Enable AWS CloudTrail with log file validation, store logs in an S3 bucket with versioning and MFA delete enabled, and create an Amazon EventBridge rule to alert on DeleteObject or PutObject events for the bucket.

Answer

Enable AWS CloudTrail with log file validation, store logs in an S3 bucket with versioning and MFA delete enabled, and create an Amazon CloudWatch alarm on the CloudTrail metric for log file delivery failures.

Answer

Enable AWS CloudTrail with log file validation, store logs in an S3 bucket with Object Lock in compliance mode for one year, and create an Amazon CloudWatch alarm on the CloudTrail metric for log file delivery failures.