SCS-C02 Management and Security Governance Practice Test 2 — 15 Questions

Question 1

A security engineer is designing a solution to monitor and remediate non-compliant resources across multiple AWS accounts. The company uses AWS Organizations and wants to enforce that any S3 bucket with public read access is automatically remediated. The solution must be centralized and scalable. Which approach should the engineer take?

Accepted Answer

Deploy an AWS Config conformance pack with a rule and an auto-remediation action using AWS Systems Manager Automation.. Option A is correct because AWS Config conformance packs allow you to deploy a collection of AWS Config rules and remediation actions across multiple accounts and Regions in AWS Organizations. By including an auto-remediation action using AWS Systems Manager Automation, the solution can automatically remediate S3 buckets with public read access in a centralized and scalable manner, without manual intervention or per-account configuration.

Answer

Create an AWS Config rule in each account and configure an Amazon CloudWatch Events rule to trigger an AWS Lambda function for remediation.

Answer

Use AWS Trusted Advisor to identify public buckets and manually remediate them.

Answer

Deploy an AWS Config conformance pack with a rule that checks for public buckets and reports non-compliance.

Question 2

A startup uses a single AWS account for development. The developer has full administrative access and accidentally deleted an S3 bucket containing critical data. The security team wants to prevent similar incidents without hindering agility. What is the MOST effective control?

Accepted Answer

Enable S3 Versioning and MFA Delete on the bucket.. Option D is correct because enabling S3 Versioning preserves all object versions, allowing recovery of deleted objects, while MFA Delete requires multi-factor authentication to permanently delete object versions or suspend versioning. This prevents accidental or unauthorized permanent deletions without hindering the developer's ability to create, read, and update objects, thus balancing security and agility.

Answer

Remove the developer's permissions and require all changes through IT.

Answer

Configure an S3 lifecycle policy to archive objects to S3 Glacier.

Answer

Use AWS CloudTrail to monitor deletions and alert the security team.

Question 3

A company has multiple AWS accounts managed through AWS Organizations. The security team needs to ensure that no EC2 instances are launched without an approved Amazon Machine Image (AMI). Which governance control should be implemented?

Accepted Answer

Use a service control policy (SCP) that denies ec2:RunInstances unless the AMI ID is in an approved list.. A service control policy (SCP) is the correct governance control because it operates at the AWS Organizations level, allowing the security team to enforce a deny on ec2:RunInstances across all member accounts unless the AMI ID matches an approved list. SCPs are account permission boundaries that cannot be overridden by IAM policies within the account, ensuring that no user or role can launch an EC2 instance with an unapproved AMI, even if they have full administrative privileges. This provides a preventive control that blocks non-compliant actions before they occur, which is more robust than detective or reactive measures.

Answer

Deploy an AWS Config rule that triggers a Lambda function to terminate non-compliant instances.

Answer

Use AWS CloudTrail to monitor instance launches and alert the security team.

Answer

Use an IAM policy that restricts ec2:RunInstances to approved AMIs.

Question 4

A company wants to use AWS CloudFormation to manage infrastructure. The security team requires that all templates are scanned for security vulnerabilities before deployment. Which service should be integrated into the pipeline?

Accepted Answer

AWS CloudFormation Guard. AWS CloudFormation Guard (cfn-guard) is a policy-as-code tool that allows you to define rules to validate CloudFormation templates against security best practices before deployment. It integrates into CI/CD pipelines to enforce compliance with organizational policies, such as ensuring encryption is enabled or public access is restricted, directly addressing the requirement to scan templates for security vulnerabilities.

Answer

Amazon Inspector

Answer

AWS Config

Answer

AWS Shield Advanced

Question 5

A large enterprise uses AWS Organizations with hundreds of accounts. The security team needs to enforce that all accounts have AWS CloudTrail enabled and logs are delivered to a centralized S3 bucket in the management account. The team also wants to ensure that no account can disable CloudTrail or delete the bucket. Which combination of controls meets these requirements?

Accepted Answer

Use a service control policy (SCP) to deny actions that disable CloudTrail or delete the bucket.. Service control policies (SCPs) are the correct mechanism because they allow the management account to centrally restrict permissions across all accounts in the organization. By creating an SCP that denies the `cloudtrail:StopLogging`, `cloudtrail:DeleteTrail`, `cloudtrail:UpdateTrail`, and `s3:DeleteBucket` actions, the security team can prevent any account (including root users) from disabling CloudTrail or deleting the centralized S3 bucket, regardless of IAM policies or direct resource-based policies.

Answer

Enable AWS CloudTrail in the management account and use S3 bucket policies.

Answer

Use an IAM policy in each account to prevent trail modifications.

Answer

Use AWS Config rules to detect and alert on disabled trails.

Question 6

A company uses AWS Secrets Manager to store database credentials. The security team needs to ensure that secrets are automatically rotated every 30 days. Which configuration should be used?

Accepted Answer

Enable automatic rotation using an AWS Lambda function.. Option D is correct because AWS Secrets Manager provides a built-in mechanism to automatically rotate secrets using an AWS Lambda function. By configuring a rotation schedule (e.g., every 30 days), Secrets Manager invokes the Lambda function to create a new version of the secret and update the database credentials, ensuring compliance without manual intervention.

Answer

Manually update the secret in Secrets Manager every 30 days.

Answer

Use Amazon Macie to detect when secrets are stale.

Answer

Set an expiration date on the secret and recreate it.

Question 7

A security engineer is designing a governance framework for a multi-account AWS environment. The framework must enforce the principle of least privilege for cross-account access. Which TWO strategies should be implemented?

Accepted Answer

Use IAM roles with specific permissions and trust policies for cross-account access.. Option D is correct because IAM roles with specific permissions and trust policies enable cross-account access without sharing long-term credentials. The trust policy defines which accounts can assume the role, and the permissions policy grants only the necessary actions, enforcing the principle of least privilege.

Answer

Enable AWS CloudTrail in all accounts and aggregate logs.

Answer

Grant full administrative access to a central security group.

Answer

Use a single IAM user across all accounts for administrative tasks.

Question 8

A company's security team is implementing controls to meet PCI DSS compliance. The environment includes Amazon EC2, RDS, and S3. Which THREE controls should be implemented to address logging and monitoring requirements?

Accepted Answer

Enable AWS Config to track resource configuration changes.. AWS Config is correct because it tracks resource configuration changes and records them as configuration items, which is essential for PCI DSS Requirement 10.5.2 that mandates logging of all actions taken by any individual with root or administrative privileges. By monitoring changes to EC2, RDS, and S3 configurations, AWS Config provides an audit trail of who made changes, what changed, and when, directly supporting logging and monitoring compliance.

Answer

Deploy Amazon CloudWatch Application Insights.

Answer

Enable detailed billing reports.

Question 9

A security engineer attaches the above SCP to an OU containing development accounts. The engineer expects that only t3.micro instances can be launched, but developers report that they cannot launch any EC2 instances. What is the MOST likely reason?

Accepted Answer

The SCP denies all ec2 actions because there is no explicit allow statement.. Option D is correct because SCPs operate on a default-deny model: all actions are implicitly denied unless explicitly allowed. The policy only denies non-t3.micro instance types but does not include an explicit Allow statement for ec2:RunInstances or any other EC2 action. Without an explicit Allow, the implicit deny blocks all EC2 actions, including launching t3.micro instances.

Answer

The SCP syntax is invalid because it uses Deny without an explicit Allow.

Answer

The condition StringNotEquals is evaluated incorrectly for EC2 instance types.

Answer

The SCP is applied at the organization root and overrides the OU-level policy.

Question 10

A security engineer reviews the above CloudTrail event. Which action should the engineer take FIRST to mitigate a potential security issue?

Accepted Answer

Revert the bucket policy to remove the public access.. The CloudTrail event shows that the root user executed `s3:PutBucketPolicy` to apply a bucket policy that grants public access (e.g., `Principal: "*"` or `Effect: "Allow"` with `Action: "s3:GetObject"`). Reverting the bucket policy to remove public access is the immediate corrective action to stop unauthorized data exposure. This directly addresses the security issue by revoking the public read permissions that were just granted.

Answer

Delete the bucket to prevent data exposure.

Answer

Contact the root user to confirm the action.

Answer

Disable the root user's access keys.

Question 11

A global e-commerce company operates in three AWS Regions: us-east-1, eu-west-1, and ap-southeast-1. The company uses AWS Organizations with 50 member accounts grouped by business unit. The security team recently discovered that several S3 buckets containing customer data were accidentally made public due to misconfigured bucket policies. The team wants to implement a preventive control that blocks any S3 bucket from becoming public across all accounts, while still allowing authorized cross-account access. The solution must be centrally managed and not require changes to existing IAM policies. Additionally, the team needs to be notified immediately when a public bucket is attempted. Which solution meets all requirements?

Accepted Answer

Create an SCP that denies s3:PutBucketPolicy and s3:PutBucketAcl when the condition includes making the bucket public, and use CloudTrail and CloudWatch Events to send notifications on denied API calls.. Option C is correct because it uses an SCP to centrally deny the s3:PutBucketPolicy and s3:PutBucketAcl actions when the request would make a bucket public, which is a preventive control that blocks the operation before it happens. The requirement for immediate notification is met by using CloudTrail to log the denied API calls and CloudWatch Events to trigger alerts, all without modifying existing IAM policies or requiring per-account changes.

Answer

Use Amazon Macie to discover public buckets and alert the security team.

Answer

Create an SCP that denies s3:PutBucketPolicy only for policies that specify 'Principal': '*' or 'Principal': {'AWS': '*'}

Answer

Deploy an AWS Config rule in each account that triggers a Lambda function to make non-compliant buckets private.

Question 12

A company uses AWS Organizations with multiple accounts and wants to ensure that all newly created S3 buckets have encryption enabled. The Security team needs a solution that automatically remediates non-compliant buckets without manual intervention. What should they do?

Accepted Answer

Apply a service control policy (SCP) that denies the s3:PutBucketPublicAccessBlock and s3:PutBucketEncryption actions unless the bucket has encryption enabled.. Option A is correct because a service control policy (SCP) that denies the s3:PutBucketEncryption action unless the bucket already has encryption enabled effectively prevents creation of unencrypted buckets. SCPs operate at the AWS Organizations level and apply to all accounts, ensuring that any attempt to create or modify a bucket without encryption is denied, providing automated, organization-wide governance without manual intervention.

Answer

Use an S3 bucket policy that denies PutObject unless the request includes the x-amz-server-side-encryption header.

Answer

Enable AWS Config with the s3-bucket-server-side-encryption-enabled rule and set up automatic remediation using Systems Manager Automation.

Answer

Create an IAM role with permissions to enforce encryption and attach it to all accounts in the organization.

Question 13

A security engineer is designing a centralized logging solution for a multi-account AWS environment. They need to ensure log files are tamper-proof and cannot be deleted or modified by anyone, including the root user of any account. Which configuration meets these requirements?

Accepted Answer

Enable S3 Object Lock in Governance mode with a retention period, and use a separate account to manage the retention settings.. Option D is correct because S3 Object Lock in Governance mode prevents any user, including the root user, from deleting or overwriting objects until the retention period expires. By storing the logs in a separate account that manages the retention settings, the security engineer ensures that even if an attacker compromises the source account, they cannot modify or delete the logs because the lock is enforced by the destination account's S3 configuration.

Answer

Create a bucket policy that denies s3:DeleteObject and s3:PutObject to all principals.

Answer

Enable MFA Delete on the S3 bucket and configure CloudTrail to log to that bucket.

Answer

Enable CloudTrail log file validation and store logs in a separate account.

Question 14

Which TWO of the following are valid methods to centrally manage security policies and enforce compliance across multiple AWS accounts? (Choose two.)

Accepted Answer

Deploy AWS Config conformance packs using AWS CloudFormation StackSets across accounts.. AWS Config conformance packs provide a way to deploy a collection of AWS Config rules and remediation actions across multiple accounts and Regions. When combined with AWS CloudFormation StackSets, you can centrally deploy these conformance packs to all accounts in an AWS Organization, ensuring consistent compliance enforcement. This approach allows you to define and manage security policies as code, automatically evaluating resources against desired configurations.

Answer

Attach IAM policies to all IAM users in each account.

Answer

Use AWS Security Hub to automatically enforce compliance rules.

Answer

Enable VPC Flow Logs in each account and send them to a central S3 bucket.

Question 15

Refer to the exhibit. An organization applies this SCP to an OU containing a developer account. A developer in that account tries to launch an m5.large instance using the AWS Management Console. What is the outcome?

Accepted Answer

The launch fails because the SCP denies RunInstances for instance types other than t2.micro and t2.small.. The SCP explicitly denies the ec2:RunInstances action when the condition key ec2:InstanceType does not match t2.micro or t2.small. Since m5.large is not in the allowed list, the deny effect applies, and the launch fails regardless of any IAM policy that might allow it. SCPs act as a guardrail that overrides IAM permissions, so even if the developer has full IAM access, the SCP blocks the operation.

Answer

The instance launches successfully because the SCP only applies to StartInstances, not RunInstances.

Answer

The instance launches successfully because the SCP does not explicitly allow any actions.

Answer

The launch fails only if the developer's IAM policy also denies the action.