SCS-C02 Management and Security Governance Practice Test 3 — 15 Questions

Question 1

A company wants to enforce that all IAM users in its AWS account use multi-factor authentication (MFA) for console login. Which action should be taken to ensure compliance?

Accepted Answer

Create an IAM policy that denies access unless MFA is present and attach it to all IAM users.. To enforce MFA for IAM users, the correct approach is an IAM policy that includes a condition such as aws:MultiFactorAuthPresent set to true in a Deny statement, attached to the users or their groups. This ensures that any API or console action fails unless the principal has authenticated with MFA, providing account-wide enforcement at the identity level. The policy can also use aws:MultiFactorAuthAge to require recent MFA authentication.

Answer

Apply an SCP to the AWS account that mandates MFA for all users.

Answer

Enable MFA on the root user and share credentials with all users.

Answer

Configure the account password policy to require MFA.

Question 2

A company uses AWS Organizations with multiple accounts. The security team wants to prevent members of the 'Developers' group from modifying IAM roles in any account. What is the most effective way to enforce this restriction?

Accepted Answer

Apply a service control policy (SCP) that denies IAM role modification actions to all accounts in the organization.. A Service Control Policy (SCP) in AWS Organizations defines the maximum permissions for all accounts in the organization or specific OUs, and a deny statement in an SCP overrides any IAM policy that would otherwise allow the action. Applying an SCP that denies IAM role modification actions to all accounts ensures that no principal — including the Developers group — can modify IAM roles, regardless of their identity-based policies. This is the most effective, centralized enforcement mechanism.

Answer

Attach an IAM policy to the Developers group in the management account that denies IAM actions.

Answer

Use AWS Config to detect IAM role modifications and automatically revert them.

Answer

Create a cross-account role in each member account that denies IAM actions.

Question 3

A company requires that all Amazon EC2 instances be launched only with an approved Amazon Machine Image (AMI) that has been hardened by the security team. Which AWS service should be used to enforce this requirement?

Accepted Answer

AWS Config. AWS Config is correct because it can evaluate whether EC2 instances are launched from approved AMIs using managed rules (e.g., approved-amis-by-id) or custom Lambda rules, and it can automatically remediate noncompliant instances. Option B (EC2 Image Builder) builds and manages AMIs but does not enforce their usage. Option C (AWS Systems Manager Patch Manager) patches instances but does not control which AMIs are used. Option D (AWS Service Catalog) provides a product portfolio for launching instances but does not enforce the use of specific AMIs at launch.

Answer

EC2 Image Builder

Answer

AWS Systems Manager Patch Manager

Answer

AWS Service Catalog

Question 4

An IAM policy is attached to a user. The user reports that they cannot list objects in the bucket 'example-bucket' from their home office IP address 203.0.113.50. What is the most likely cause?

Accepted Answer

The IP address condition restricts access to the 10.0.0.0/24 range.. The IAM policy likely includes a condition that restricts access to requests originating from the 10.0.0.0/24 IP range (a private IP range). Since the user's home office IP is 203.0.113.50 (a public IP), the condition fails and access is denied. Option A is incorrect because IAM policies are deny by default only when no explicit Allow exists; in this case, an Allow statement is present. Option B is incorrect because while using the wrong resource ARN (with /*) prevents bucket-level actions, the most likely cause given the specific IP mismatch is the condition. Option C is incorrect because the policy allows s3:* actions, which includes s3:ListBucket.

Answer

The policy effect is Deny by default.

Answer

The resource ARN should be arn:aws:s3:::example-bucket without the /*.

Answer

The policy does not allow the s3:ListBucket action.

Question 5

A security engineer notices that CloudTrail logs are not being delivered to the S3 bucket for the past 2 hours. The output of 'get-trail-status' is shown. What is the most likely cause?

Accepted Answer

The S3 bucket policy denies write access from CloudTrail.. The 'get-trail-status' command shows that the trail is active (not stopped) and that the S3 bucket exists. However, the latest delivery time is 2 hours old, and the latest delivery attempt failed. This indicates that CloudTrail is unable to write logs to the S3 bucket, most likely because the S3 bucket policy has been modified to deny write access from CloudTrail. Option C is correct. Option A is incorrect because if the bucket did not exist, CloudTrail would report an error about the bucket not being found, and the trail status would indicate that. Option B is incorrect because the trail status shows it is still logging. Option D is incorrect because CloudWatch Logs delivery is separate; the issue is with S3 delivery.

Answer

The S3 bucket does not exist.

Answer

The trail has been stopped.

Answer

CloudWatch Logs delivery is failing.

Question 6

A security engineer is designing a data encryption strategy for an S3 bucket that contains sensitive information. Which TWO of the following are valid options for enforcing encryption at rest?

Accepted Answer

Enable S3 default encryption on the bucket.. Option B is correct because S3 default encryption (SSE-S3, SSE-KMS, or DSSE-KMS) automatically encrypts every object at rest when it is written to the bucket, so no per-request header is required and enforcement is applied at the bucket level. Option E is correct because a bucket policy that denies s3:PutObject when the s3:x-amz-server-side-encryption condition key is absent (or does not match an approved algorithm such as AES256 or aws:kms) blocks unencrypted uploads, effectively enforcing encryption at rest for all writers. Option A is not a valid enforcement mechanism by itself: a KMS key with automatic rotation strengthens key hygiene but does not force objects to be encrypted unless default encryption or a policy requires that key. Option C is wrong because CloudTrail only records API activity for auditing; it does not encrypt data or prevent unencrypted uploads. Option D is wrong because an IAM policy attached to users is not the recommended or reliable enforcement point for bucket-level encryption, since it can be bypassed by other principals and does not apply to the bucket itself.

Answer

Use an AWS KMS key with automatic key rotation.

Answer

Enable AWS CloudTrail to log all object uploads.

Answer

Attach an IAM policy to users to require encryption.

Question 7

A company has a security requirement that any Amazon RDS database must be encrypted at rest. Which TWO actions should be taken to enforce this requirement?

Accepted Answer

Use an AWS Config rule to detect unencrypted RDS instances and trigger auto-remediation.. Option B is correct because an AWS Config rule (such as rds-storage-encrypted) continuously evaluates RDS instances for the StorageEncrypted attribute and can trigger auto-remediation via SSM Automation to enforce encryption at rest. Option D is correct because an IAM policy with a Deny on rds:CreateDBInstance conditioned on rds:StorageEncrypted being false (using a StringEquals or Bool condition) prevents the creation of unencrypted RDS instances at the API level. Option A is wrong because VPC security groups operate at the network layer and cannot inspect or block unencrypted storage; encryption at rest is a property of the RDS instance, not the connection. Option C is wrong because SCPs govern IAM permissions and cannot directly require an encryption setting on an RDS instance; they can only deny actions, and there is no SCP condition that enforces StorageEncrypted on RDS creation. Option E is wrong because enabling encryption on existing RDS instances is not possible in place — you must snapshot, copy with encryption, and restore — so a Lambda function cannot simply 'enable encryption' on running instances.

Answer

Configure VPC security groups to block unencrypted connections.

Answer

Attach an SCP to the OU to require encryption for all RDS instances.

Answer

Enable encryption on all existing RDS instances using a Lambda function.

Question 8

A security engineer needs to grant a user read-only access to an S3 bucket. Which THREE of the following are required in the IAM policy?

Accepted Answer

Action: s3:ListBucket. Options A, B, and D are correct. To grant read-only access, the policy must allow s3:ListBucket on the bucket resource and s3:GetObject on the object resources. Option C is wrong because s3:PutObject is write access. Option E is wrong because s3:DeleteObject is not needed for read-only.

Answer

Action: s3:PutObject

Answer

Action: s3:DeleteObject

Question 9

A company uses AWS Organizations to manage 50 accounts. The security team has enabled AWS CloudTrail in the management account with an organization trail that delivers logs to a central S3 bucket. The bucket policy grants necessary permissions to CloudTrail. Recently, the security team noticed that logs from two member accounts stopped appearing in the bucket. Other accounts continue to deliver logs correctly. The CloudTrail status in the management account shows that the trail is logging and deliveries are succeeding. The security team checked the CloudTrail configuration in the affected member accounts and found that they do not have any trails configured. The IAM roles used for CloudTrail in the management account have sufficient permissions. What is the most likely cause of the missing logs?

Accepted Answer

The S3 bucket policy does not grant write access to the CloudTrail service for the affected member accounts.. The most likely cause is that the S3 bucket policy does not grant write access to the CloudTrail service for the affected member accounts. For an organization trail, CloudTrail delivers logs from all accounts to the central bucket, but the bucket policy must explicitly allow the CloudTrail service principal from each member account to write objects. If the policy only allows some accounts, logs from others will be missing.

Answer

The KMS key used for encryption does not include permissions for the member accounts.

Answer

The CloudTrail service-linked role in the member accounts is missing.

Answer

An SCP attached to the affected member accounts denies cloudtrail:PutLogEvents.

Question 10

A company has a single AWS account with multiple IAM users. The security team wants to enforce that all users use MFA for API calls. An IAM policy is created that denies all actions unless MFA is present. The policy is attached to all users. However, users report that they can still make API calls without MFA. The security team reviews the policy and confirms it is correct. What is the most likely reason the policy is not being enforced?

Accepted Answer

The policy uses the wrong condition key; it should be 'aws:MultiFactorAuthPresent'.. The most likely reason the MFA policy is not enforced is that it uses an incorrect condition key. To enforce MFA, the policy must use the condition key 'aws:MultiFactorAuthPresent' with a value of 'false' in the Deny statement. If the policy uses a different key (e.g., 'aws:MultiFactorAuthAge') or misspells it, the condition will not evaluate correctly, and the Deny effect will not apply. Option B is incorrect because CloudTrail is used for auditing, not enforcement. Option C is incorrect because SCPs are for multi-account organizations, not single accounts. Option D is incorrect because the password policy does not affect API call enforcement.

Answer

AWS CloudTrail is not enabled, so the policy cannot be evaluated.

Answer

An SCP at the root level allows all actions without MFA.

Answer

The IAM password policy does not require MFA.

Question 11

A security engineer is designing a logging solution for a multi-account environment using AWS Organizations. The solution must meet the following requirements: 
- Logs from all accounts must be centrally stored and immutable. 
- Only the security team should be able to delete logs. 
- Logs must be encrypted at rest. 
Which TWO steps should the engineer take to meet these requirements? (Choose TWO.)

Accepted Answer

Enable S3 Object Lock and configure a bucket policy to deny s3:DeleteObject unless the principal is the security team.. Options B and E are correct. Option B: S3 Object Lock prevents logs from being deleted or overwritten, ensuring immutability. Additionally, a bucket policy with a condition that denies s3:DeleteObject unless the principal is the security team ensures only they can delete logs. Option E: An organizational CloudTrail trail in the management account automatically delivers logs from all accounts in the organization to a single S3 bucket, meeting the centralized logging requirement. Option A is incorrect because S3 default encryption provides encryption at rest but does not address immutability or deletion control. Option C is incorrect because CloudWatch Logs retention policy does not prevent deletion by administrators and does not provide immutability. Option D is incorrect because creating an IAM role in each account does not centralize logs; it only provides access but logs remain in each account.

Answer

Enable S3 default encryption on the log bucket.

Answer

Stream logs to CloudWatch Logs and set a retention policy of 10 years.

Answer

Create an IAM role in each account that allows the security team to access logs.

Question 12

A security engineer needs to ensure that all API calls in an AWS account are logged and that the logs are encrypted at rest and retained for at least 7 years. Which THREE steps should the engineer take? (Choose THREE.)

Accepted Answer

Set an S3 lifecycle policy to transition logs to Glacier after 7 years.. Option E is correct because enabling CloudTrail in the account is the foundational step that records all API activity as management events and delivers the trail logs to an S3 bucket, satisfying the requirement that all API calls are logged. Option D is correct because enabling S3 default encryption (SSE-S3, SSE-KMS, or SSE-C) on the log bucket ensures the CloudTrail log objects are encrypted at rest automatically as they are written. Option B is correct because an S3 lifecycle policy with a transition to Glacier (or Glacier Deep Archive) after 7 years provides the long-term retention mechanism required to keep the logs for at least 7 years at lower cost. Option A is not correct because CloudTrail cannot deliver logs directly to Amazon S3 Glacier; it delivers only to S3 buckets or CloudWatch Logs, and archival to Glacier must be done via lifecycle rules. Option C is not correct because Cross-Region Replication addresses durability and geographic redundancy, not encryption at rest or the 7-year retention requirement.

Answer

Configure CloudTrail to deliver logs to Amazon S3 Glacier.

Answer

Enable S3 Cross-Region Replication to a bucket in another region.

Question 13

A security engineer is reviewing an IAM policy attached to a user. The policy is intended to allow the user to read objects from an S3 bucket only from the office IP range 192.0.2.0/24. However, the user reports that they can access objects from any IP address. What is the most likely reason?

Accepted Answer

The policy does not include an explicit Deny for requests outside the IP range.. IAM policies do not have an explicit Deny by default; the Allow with condition only grants access from the specified IP range. However, other policies (like a bucket policy or another IAM policy) could grant access from other IPs, overriding the condition. To prevent access from outside the IP range, an explicit Deny for all other IPs is required. Option B is incorrect because the condition key 'aws:SourceIp' is correctly spelled; it uses a capital 'S' and 'I'. Option C is incorrect because while a bucket policy allowing public access could override, the most likely reason in this scenario is that the IAM policy is missing an explicit Deny, as that is a common misconfiguration. Option D is incorrect because if the resource ARN is missing the bucket name, the policy would not apply to the bucket at all, and the user would not have access, contradicting the ability to access from any IP.

Answer

The condition key is misspelled; it should be aws:SourceIp without the 's'.

Answer

The policy is attached to the user, but the bucket has a bucket policy that allows public access.

Answer

The resource ARN is missing the bucket name.

Question 14

A company has a single AWS account with multiple IAM users. The security team wants to enforce that all IAM users must use multi-factor authentication (MFA) to access the AWS Management Console. They attach an IAM policy that denies all actions if the user does not have MFA. However, after attaching the policy, some users report that they are unable to perform any actions even after authenticating with MFA. The policy uses the condition "aws:MultiFactorAuthPresent": "false". The security team verifies that the users have MFA enabled and are using it. What is the most likely cause of this issue?

Accepted Answer

The policy is incorrectly written; it should use "Effect": "Allow" and the condition "aws:MultiFactorAuthPresent": "true".. The correct approach is to use an Allow policy with the condition that MFA must be present. The Deny policy as written will deny all actions even when MFA is present if there is no other Allow policy granting permissions. Since IAM defaults to implicit deny, a Deny policy is not sufficient to grant access; it only restricts. Therefore, users cannot perform any actions because there is no Allow statement. Option C correctly identifies this.

Answer

The condition should be "Bool": "aws:MultiFactorAuthPresent": "false" but the policy uses StringLike.

Answer

The policy is missing a NotAction element; it should deny all actions except for the ones needed for MFA enrollment.

Answer

The users are signing in as the root user of the account, not as IAM users.

Question 15

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all member accounts have AWS CloudTrail enabled and that the logs are delivered to a centralized S3 bucket in the management account. The team creates an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail. Additionally, they enable CloudTrail organizational trail. However, after some time, they discover that one member account has disabled CloudTrail. What is the most likely reason this happened?

Accepted Answer

The SCP was applied to the management account instead of the member accounts.. The security team created an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail. If this SCP is attached to the management account only, it does not apply to member accounts. Therefore, member accounts are not restricted and can disable their own CloudTrail trails. The most likely reason for the member account disabling CloudTrail is that the SCP was applied to the management account instead of the member accounts.

Answer

The member account's root user performed the action, which bypasses the SCP.

Answer

The SCP was not attached to the organizational unit (OU) containing the member account.

Answer

The member account's IAM user used the AWS Management Console to disable CloudTrail.