SCS-C02 Management and Security Governance Practice Test 3 — 15 Questions

Question 1

A company has a three-tier web application running on AWS. The application consists of an Application Load Balancer (ALB), an EC2 Auto Scaling group for web servers, and an RDS MySQL database. The Security team recently discovered that the database is publicly accessible from the internet. They need to remediate this immediately while minimizing downtime. The database is critical for the application, and the application must remain available. The team has identified that the database security group currently allows inbound traffic from 0.0.0.0/0 on port 3306. The web servers are in a security group named 'web-sg'. The database security group is named 'db-sg'. The team wants to restrict access to only the ALB and the web servers. Which action should the team take to resolve the issue with the least downtime?

Accepted Answer

Modify the inbound rule of the db-sg security group to allow traffic from the web-sg security group on port 3306 and remove the rule allowing traffic from 0.0.0.0/0.. Option B is correct because modifying the db-sg security group to allow inbound traffic from the web-sg security group (instead of 0.0.0.0/0) on port 3306 directly restricts database access to only the web servers. This change is applied immediately without requiring any resource recreation or downtime, as security group rules are stateful and take effect in real time. Removing the overly permissive rule eliminates the public exposure while keeping the existing database endpoint and application connectivity intact.

Answer

Create a new security group that allows inbound traffic from the web-sg security group on port 3306, then attach the new security group to the database instance.

Answer

Update the network ACL for the database subnet to deny inbound traffic from 0.0.0.0/0 on port 3306.

Answer

Move the RDS instance to a private subnet and update the application's database endpoint to use the new private IP address.

Question 2

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that all IAM users in the organization have multi-factor authentication (MFA) enabled. Which combination of actions should be taken to enforce this requirement?

Accepted Answer

Create an SCP that denies IAM actions without MFA and attach it to the root organizational unit (OU).. Option B is correct because Service Control Policies (SCPs) in AWS Organizations can be attached to the root organizational unit (OU) to apply a blanket denial of IAM actions when MFA is not present, affecting all accounts and users within the organization. This leverages the `aws:MultiFactorAuthPresent` condition key in an SCP to enforce MFA at the organization level, ensuring that even if IAM users are created in member accounts, they cannot perform IAM actions without MFA. Attaching the SCP to the root OU ensures the policy cascades down to all child OUs and accounts, providing centralized enforcement.

Answer

Create an SCP that denies IAM actions without MFA and attach it to the IAM group that contains all users.

Answer

Create an SCP that denies IAM actions without MFA and attach it to each IAM user.

Answer

Create an SCP that denies IAM actions without MFA and attach it to the management account.

Question 3

A security engineer is designing a governance framework for a multi-account AWS environment. The engineer needs to ensure that all accounts comply with the principle of least privilege for IAM roles and that any non-compliant resources are automatically reported. Which two AWS services should the engineer use together to achieve this? (Choose TWO.)

Accepted Answer

AWS Security Hub. AWS Security Hub is correct because it provides a comprehensive view of security alerts and compliance status across multiple AWS accounts, aggregating findings from various AWS services and third-party tools. AWS Config is correct because it continuously monitors and records AWS resource configurations, enabling you to define rules (e.g., IAM least privilege policies) and automatically evaluate resource compliance, triggering notifications or remediation actions for non-compliant resources. Together, Security Hub can ingest AWS Config rule compliance results as findings, allowing centralized reporting and automated response to IAM role violations.

Answer

AWS Service Catalog

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Question 4

Refer to the exhibit. A security engineer applied the bucket policy shown. What is the effect of this policy?

Accepted Answer

Only GetObject requests that use HTTP are denied.. The bucket policy uses a `NotIpAddress` condition with the `aws:SourceIp` key to deny `s3:GetObject` requests that do not originate from the specified IP range (192.0.2.0/24). However, the `Null` condition on `aws:SecureTransport` ensures the policy only applies when the request is not using HTTPS (i.e., when `aws:SecureTransport` is false). Therefore, only GetObject requests over HTTP are denied; HTTPS requests from any IP are allowed, and PutObject requests are unaffected.

Answer

All PutObject requests are denied.

Answer

Only GetObject requests from specific IP ranges are denied.

Answer

All GetObject requests to the bucket are denied.

Question 5

Drag and drop the steps to configure Amazon GuardDuty for multi-account security in the correct order.

Question 6

Drag and drop the steps to set up a secure S3 bucket with encryption and access control in the correct order.

Question 7

Match each AWS security control to its category.

Question 8

Match each AWS VPC flow log type to its description.

Question 9

A company uses AWS Organizations to manage multiple accounts. The security team needs to enforce that all S3 buckets across the organization have block public access enabled. Which policy should be used?

Accepted Answer

Create a service control policy (SCP) that denies s3:PutBucketPublicAccessBlock for all accounts.. Option A is correct because a service control policy (SCP) can be applied at the organizational level to deny actions that modify S3 public access settings. Option B is incorrect because IAM policies apply to users/roles, not accounts. Option C is incorrect because bucket policies are per-bucket, not organizational. Option D is incorrect because CloudFormation StackSets deploy resources, not enforce policies.

Answer

Configure a bucket policy on each S3 bucket to deny public access.

Answer

Apply an IAM policy to the root user of each account.

Answer

Use AWS CloudFormation StackSets to deploy a bucket with public access blocked.

Question 10

A security engineer notices that an IAM role in the production account is being assumed by a user from another AWS account, which violates the principle of least privilege. The role's trust policy allows the root user of the external account. What is the MOST secure way to restrict access to only a specific user in the external account?

Accepted Answer

Modify the trust policy to specify the exact user ARN instead of the root ARN.. Option C is correct because modifying the trust policy to include the specific user ARN is the most direct and secure approach. Option A is incorrect because SCPs do not affect cross-account access. Option B is incorrect because IAM policies on the role do not restrict who can assume it. Option D is incorrect because the external account's IAM policies do not control trust.

Answer

Apply an SCP to the external account to deny the sts:AssumeRole action.

Answer

Create an IAM policy in the external account that denies sts:AssumeRole for the role.

Answer

Add a condition to the role's permissions policy requiring a specific source IP.

Question 11

A company wants to automatically detect and remediate S3 buckets that are publicly accessible. Which AWS service can be used to evaluate bucket policies against a defined rule and trigger an automated response?

Accepted Answer

AWS Config. Option B is correct because AWS Config rules can evaluate resources and trigger remediation actions. Option A is incorrect because CloudTrail is for auditing API calls, not real-time evaluation. Option C is incorrect because GuardDuty is a threat detection service. Option D is incorrect because Inspector is for vulnerability assessment.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

Amazon Inspector

Question 12

A company uses AWS Organizations with all features enabled. The security team wants to ensure that no IAM users are created in any account. Which approach should be used?

Accepted Answer

Attach a service control policy (SCP) that denies iam:CreateUser.. Option C is correct because Service Control Policies (SCPs) in AWS Organizations allow you to centrally restrict permissions across all accounts in the organization. By attaching an SCP that denies the `iam:CreateUser` action, you prevent the creation of IAM users in any member account, regardless of any IAM policies attached to users or roles within those accounts. This provides a guardrail that cannot be overridden by account administrators, ensuring compliance with the security team's requirement.

Answer

Use AWS Config rules to detect IAM users and notify via SNS.

Answer

Enable AWS CloudTrail Insights to detect anomalous IAM activity.

Answer

Apply an IAM policy to the root user to deny iam:CreateUser.

Question 13

A company's security team needs to enforce encryption at rest for all RDS instances in the production account. They have enabled mandatory encryption using a service control policy. What else must be done to ensure existing unencrypted RDS instances are encrypted?

Accepted Answer

Create a snapshot of the unencrypted instance, copy the snapshot with encryption enabled, and restore the encrypted snapshot to a new DB instance.. Option A is correct because RDS does not support encrypting existing unencrypted instances; you must create a snapshot, copy it encrypted, and restore. Option B is incorrect because you cannot enable encryption on an existing instance. Option C is incorrect because enabling encryption on the DB subnet group does not affect existing instances. Option D is incorrect because you must use a snapshot copy.

Answer

Attach a new KMS key policy to the RDS instance.

Answer

Enable encryption on the DB subnet group and reboot the instance.

Answer

Modify the RDS instance to enable encryption using the AWS Console.

Question 14

A company needs to audit all changes to IAM policies in their AWS account for compliance. Which AWS service should be enabled to record the API calls that modify IAM policies?

Accepted Answer

AWS CloudTrail. Option C is correct because AWS CloudTrail records API calls, including IAM policy changes. Option A is incorrect because AWS Config records resource configurations but not API call history. Option B is incorrect because VPC Flow Logs capture network traffic. Option D is incorrect because CloudWatch Logs stores logs but does not capture API calls directly.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

VPC Flow Logs

Question 15

A security engineer notices that an S3 bucket contains objects that are accessible to authenticated users from other AWS accounts. The bucket policy allows access to the 'aws:SourceArn' condition that references an Amazon Resource Name (ARN) from another account. What is the MOST effective way to restrict access to only users from the company's own account?

Accepted Answer

Add a condition using 'aws:SourceAccount' with the company's account ID.. Option D is correct because using 'aws:SourceAccount' condition with the company's account ID ensures only requests originating from that account are allowed. Option A is incorrect because removing the bucket policy does not address existing objects. Option B is incorrect because SCPs do not affect cross-account access to resources. Option C is incorrect because 'aws:SourceArn' is already used; the issue is the ARN belongs to another account.

Answer

Apply an SCP to deny s3:GetObject for any principal outside the organization.

Answer

Remove the bucket policy and add an IAM policy to the company's users.

Answer

Modify the condition to use 'aws:SourceArn' with an ARN from the company's account.