SCS-C02 Management and Security Governance Practice Test 2 — 15 Questions

Question 1

A security engineer notices that an IAM user has permissions that exceed their job requirements. The engineer wants to implement the principle of least privilege. Which IAM feature should be used to grant only the necessary permissions?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Attach a permissions boundary to the user. A permissions boundary is an advanced IAM feature that sets the maximum permissions an identity-based policy can grant to an IAM user or role. When attached to a user, the effective permissions are the intersection of the identity-based policies and the permissions boundary, ensuring the user cannot exceed the boundary even if broader policies are attached. This directly enforces least privilege by capping permissions to only what is necessary. In contrast, other options either do not limit existing permissions or are not applicable to individual users.

Answer

Add the user to an IAM group with restricted permissions

Answer

Use a resource-based policy on the user

Answer

Attach a service control policy (SCP) to the user's account

Question 2

A developer has created an S3 bucket policy that grants public read access. The security team wants to prevent any S3 bucket from becoming public. Which AWS service can enforce this restriction across all accounts?

Accepted Answer

A service control policy (SCP) denying s3:PutBucketPolicy. A service control policy (SCP) is the correct choice because it operates at the AWS Organizations level to centrally restrict permissions across all accounts. By creating an SCP that denies the s3:PutBucketPolicy action, you prevent any account in the organization from modifying bucket policies to grant public access, regardless of individual account settings. This enforces a guardrail that cannot be overridden by account administrators.

Answer

AWS CloudTrail with a metric filter

Answer

S3 Block Public Access settings on each account

Answer

IAM permissions boundary

Question 3

A security team needs to enforce that all EC2 instances launched in a specific AWS account use only approved AMIs. Which combination of services can enforce this requirement?

Accepted Answer

Use an AWS Config rule to check AMI compliance and a service control policy (SCP) to deny noncompliant launches. The correct combination is AWS Config rule and SCP. An AWS Config rule can evaluate launched instances against approved AMIs, and an SCP can deny any noncompliant launch at the organizational level. Option A is incorrect because IAM policies cannot restrict ec2:RunInstances based on AMI ID. Option B (Service Catalog) is incorrect because it does not prevent direct EC2 launches through the console or CLI. Option D (CloudTrail) only logs and alerts but does not enforce compliance.

Answer

Use IAM policies to restrict ec2:RunInstances to only approved AMIs

Answer

Use AWS Service Catalog with a product that launches approved AMIs

Answer

Use AWS CloudTrail to log all EC2 launches and alert on noncompliant AMIs

Question 4

A security engineer needs to automatically detect and respond to unauthorized API calls in an AWS account. Which two services should be used together?

Accepted Answer

AWS CloudTrail and Amazon EventBridge. AWS CloudTrail and Amazon EventBridge (option A) are the correct combination because CloudTrail records all API activity in the account, including unauthorized calls, and EventBridge can match those events via rules and trigger automated responses such as Lambda functions or SNS notifications. This pairing directly supports automatic detection (CloudTrail) and response (EventBridge) to unauthorized API calls. Amazon GuardDuty and Amazon SNS (B) detect threats but do not natively capture all API call details for custom unauthorized-call rules, and SNS alone only notifies rather than orchestrates a response. AWS Config and AWS Lambda (C) evaluate resource configuration compliance, not real-time API call authorization events. Amazon Inspector and Amazon S3 (D) are for vulnerability scanning and storage, respectively, and do not detect unauthorized API calls.

Answer

Amazon GuardDuty and Amazon SNS

Answer

AWS Config and AWS Lambda

Answer

Amazon Inspector and Amazon S3

Question 5

Which TWO actions can be taken to enforce the principle of least privilege for IAM users in an AWS account? (Choose two.)

Accepted Answer

Use IAM roles with temporary credentials for access. Option A is correct because assigning IAM roles that issue temporary credentials via AWS STS (e.g., AssumeRole) eliminates long-lived access keys and lets you scope permissions tightly to only what each task requires, directly enforcing least privilege. Option E is correct because regularly auditing IAM policies and removing unused or overly broad permissions (for example, via IAM Access Analyzer or credential reports) shrinks the effective permission set over time, which is a core least-privilege practice. Option B is wrong because granting full administrative access to all users violates least privilege by massively over-provisioning permissions. Option C is wrong in this context because SCPs apply to AWS Organizations accounts/OUs as permission guardrails, not to individual IAM users within an account, so they cannot directly restrict a specific user's permissions. Option D is wrong because using the root user for daily administrative tasks is an anti-pattern that grants unrestricted, non-scoped access and should be avoided in favor of scoped IAM identities.

Answer

Grant full administrative access to all users to simplify management

Answer

Use service control policies (SCPs) to restrict user permissions

Answer

Use the root user for daily administrative tasks

Question 6

A company requires that all IAM users in the Security team must use multi-factor authentication (MFA) to access the AWS Management Console. The company has enabled MFA for all users, but the Security team administrator reports that some users can still sign in without MFA. Which action should the administrator take to enforce MFA for all sign-ins?

Accepted Answer

Attach an IAM policy that denies all actions if 'aws:MultiFactorAuthPresent' is false.. To enforce MFA for console access, the administrator must attach an IAM policy that explicitly denies all actions when the aws:MultiFactorAuthPresent condition key is false. AWS does not enforce MFA through password policies or by simply enabling MFA on users; enforcement requires a deny-based policy using the condition key. This ensures that even if a user has MFA configured, they cannot perform actions without presenting the MFA token.

Answer

Create a new IAM policy that requires MFA for programmatic access only.

Answer

Enable the 'aws:MultiFactorAuthPresent' condition in the IAM password policy.

Answer

Update the password policy to require MFA for all IAM users.

Question 7

A company is using AWS Organizations with SCPs. The management account has an SCP that denies access to all EC2 actions. A developer in a member account tries to launch an EC2 instance but receives an authorization error. The developer has an IAM policy that allows ec2:RunInstances. What is the most likely cause of the error?

Accepted Answer

The SCP denies the action, overriding the IAM policy.. SCPs act as a permission boundary; if an SCP denies an action, it cannot be performed even if an IAM policy allows it. Option A is wrong because the developer does have the ec2:RunInstances permission in their IAM policy; the error occurs due to the SCP. Option B is wrong because the order of evaluation is not relevant; SCPs and IAM policies are evaluated together, and SCPs can deny actions regardless of IAM permissions. Option D is wrong because SCPs apply to all principals in the account, not just the root user.

Answer

The IAM policy does not include the ec2:RunInstances permission.

Answer

The IAM policy is applied before the SCP.

Answer

The SCP is applied only to the root user.

Question 8

A company uses AWS KMS to encrypt sensitive data. The security team wants to ensure that KMS keys can only be used by specific IAM roles and that key usage is logged. Which combination of actions should the team take? (Choose the best answer.)

Accepted Answer

Configure the key policy to specify the IAM roles as key users and enable CloudTrail.. Key policies define who can use the key, and CloudTrail logs all KMS API calls. Option A is wrong because an SCP can only deny, not grant permissions. Option B is wrong because IAM policies alone are not enough; the key policy must allow IAM access. Option C is wrong because the key policy must specify the IAM roles.

Answer

Create an SCP to restrict KMS key usage and enable CloudWatch Logs.

Answer

Attach an IAM policy that allows kms:Encrypt and kms:Decrypt to the roles.

Answer

Configure the key policy to allow the root user and enable CloudTrail.

Question 9

Which THREE measures should a security team implement to detect and respond to potential security incidents in an AWS environment? (Select THREE.)

Accepted Answer

Enable AWS CloudTrail.. Options B, C, and E are correct. AWS CloudTrail logs all API calls, providing an audit trail for investigation. AWS Config tracks configuration changes, which can indicate misconfigurations or unauthorized changes. Amazon GuardDuty continuously monitors for malicious activity using threat intelligence and anomaly detection. Option A is incorrect because Amazon Inspector is a vulnerability assessment service, not designed for ongoing threat detection. Option D is incorrect because VPC Flow Logs capture network traffic metadata but are not primarily for incident detection; they can aid network analysis but are not a direct detection service.

Answer

Run Amazon Inspector assessments.

Answer

Enable VPC Flow Logs for all VPCs.

Question 10

Which TWO AWS services can be used to centrally manage and enforce security policies across multiple AWS accounts? (Select TWO.)

Accepted Answer

AWS Organizations. AWS Organizations (B) is correct because it lets you centrally govern multiple accounts using service control policies (SCPs), which define the maximum permissions for member accounts and enforce security guardrails across the organization. AWS Config (E) is correct because it continuously assesses, audits, and evaluates resource configurations against desired security policies via conformance packs and rules, and it supports multi-account, multi-region aggregation for centralized compliance management. AWS CloudTrail (A) is not correct here because it records API activity for auditing and detection rather than enforcing security policies. Amazon GuardDuty (C) is a threat-detection service that identifies malicious activity, not a policy management or enforcement tool. AWS IAM (D) manages identities and permissions within a single account (or via roles across accounts) but does not by itself centrally manage and enforce policies across an entire multi-account organization.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS IAM

Question 11

A company wants to centrally manage and enforce security policies across all accounts in AWS Organizations. Which AWS service should be used to define and apply guardrails?

Accepted Answer

AWS Control Tower. AWS Control Tower (B) is designed to centrally manage and enforce security policies across all accounts in AWS Organizations. It provides guardrails (preventive and detective) that can be applied to organizational units (OUs) to ensure compliance with security policies.

Answer

IAM Policy Simulator

Answer

AWS Shield

Answer

AWS Config

Question 12

An organization has a requirement to retain all AWS CloudTrail logs for at least 7 years for compliance. Currently, logs are stored in an S3 bucket with default settings. What is the MOST cost-effective way to meet the retention requirement?

Accepted Answer

Configure S3 lifecycle policy to transition objects to S3 Glacier after 30 days and expire after 7 years.. The most cost-effective way is to configure an S3 lifecycle policy that transitions objects to S3 Glacier after 30 days and expires them after 7 years. This balances cost and accessibility: logs are frequently accessed in the first 30 days for troubleshooting, then moved to cheaper Glacier storage for long-term retention, and finally deleted after 7 years. This meets the 7-year requirement at the lowest cost.

Answer

Use S3 Glacier Deep Archive immediately.

Answer

Set an S3 lifecycle policy to delete objects after 7 years.

Answer

Set the CloudTrail trail to store logs in an S3 bucket with 7-year retention.

Question 13

Refer to the exhibit. A security engineer creates this IAM policy for a user. Which action can the user perform?

Accepted Answer

Decrypt KMS keys when the request originates from S3 in us-east-1.. The policy allows decrypting KMS keys only when the request comes through S3. Option A is wrong because it requires S3 endpoint. Option C is wrong because the policy is limited to S3. Option D is wrong because there is no resource restriction.

Answer

Decrypt KMS keys only for resources in us-east-1.

Answer

Decrypt any KMS key from any service.

Answer

Decrypt only S3 objects.

Question 14

A company uses AWS Organizations with multiple accounts. The security team needs to ensure that no account can disable Amazon GuardDuty. Which SCP should be applied?

Accepted Answer

Deny action: guardduty:StopMonitoringMembers. SCPs can deny specific actions. The correct SCP denies the StopMonitoringMember action for GuardDuty.

Answer

Deny action: guardduty:DisableGuardDuty

Answer

Deny action: guardduty:UpdateDetector

Answer

Deny action: guardduty:DeleteDetector

Question 15

Which THREE AWS services can be used to detect and alert on suspicious API activity in an AWS account? (Choose three.)

Accepted Answer

AWS CloudTrail Insights. GuardDuty identifies threats, CloudTrail logs API calls (with Insights for anomalous activity), and Security Hub aggregates findings. Config evaluates configuration, not activity; Inspector scans for vulnerabilities.

Answer

Amazon Inspector

Answer

AWS Config