SCS-C02 Management and Security Governance Practice Test 3 — 15 Questions

Question 1

Drag and drop the steps to configure Amazon GuardDuty for multi-account security in the correct order.

Accepted Answer

1. Enable GuardDuty in the master account. 2. Invite member accounts. 3. Accept invitations from member accounts. 4. Configure findings export. 5. Delegate administration.. Multi-account GuardDuty requires enabling in master, inviting members, accepting, configuring export, and delegating admin.

Answer

1. Invite member accounts. 2. Enable GuardDuty in the master account. 3. Accept invitations from member accounts. 4. Configure findings export. 5. Delegate administration.

Answer

1. Enable GuardDuty in the master account. 2. Invite member accounts. 3. Configure findings export. 4. Accept invitations from member accounts. 5. Delegate administration.

Answer

1. Enable GuardDuty in the master account. 2. Configure findings export. 3. Invite member accounts. 4. Accept invitations from member accounts. 5. Delegate administration.

Question 2

Drag and drop the steps to set up a secure S3 bucket with encryption and access control in the correct order.

Accepted Answer

Enable default encryption → Block public access → Attach bucket policy → Enable versioning → Enable access logging. Secure S3 bucket requires encryption, public access block, bucket policy, versioning, and access logging.

Answer

Block public access → Enable default encryption → Attach bucket policy → Enable versioning → Enable access logging

Answer

Enable default encryption → Block public access → Enable versioning → Attach bucket policy → Enable access logging

Answer

Enable default encryption → Enable versioning → Block public access → Attach bucket policy → Enable access logging

Question 3

Match each AWS security control to its category.

Accepted Answer

Security Group: A stateful firewall that controls inbound and outbound traffic at the instance level.. Security Groups are stateful instance-level firewalls, Network ACLs are stateless subnet-level firewalls. Common confusions involve mixing statefulness and level of operation.

Answer

Security Group: A stateless firewall that controls traffic at the subnet level.

Answer

AWS WAF: A stateful firewall that controls traffic at the instance level.

Question 4

A company uses AWS Organizations to manage multiple accounts. The security team needs to enforce that all S3 buckets across the organization have block public access enabled. Which policy should be used?

Accepted Answer

Create a service control policy (SCP) that denies s3:PutBucketPublicAccessBlock for all accounts.. A service control policy (SCP) can be applied at the organizational level to deny the s3:PutBucketPublicAccessBlock action, effectively preventing any account from disabling block public access on S3 buckets. Option A is incorrect because bucket policies are per-bucket and would need to be applied individually, which is not scalable for an organization with many buckets. Option C is incorrect because IAM policies apply to users and roles, not accounts, and cannot enforce settings at the account or organizational level. Option D is incorrect because CloudFormation StackSets deploy resources but do not enforce policies across existing buckets.

Answer

Configure a bucket policy on each S3 bucket to deny public access.

Answer

Apply an IAM policy to the root user of each account.

Answer

Use AWS CloudFormation StackSets to deploy a bucket with public access blocked.

Question 5

A security engineer notices that an IAM role in the production account is being assumed by a user from another AWS account, which violates the principle of least privilege. The role's trust policy allows the root user of the external account. What is the MOST secure way to restrict access to only a specific user in the external account?

Accepted Answer

Modify the trust policy to specify the exact user ARN instead of the root ARN.. Modifying the trust policy to include the specific user ARN is the most direct and secure approach. Option A is incorrect because SCPs do not affect cross-account access. Option B is incorrect because IAM policies on the role do not restrict who can assume it. Option D is incorrect because the external account's IAM policies do not control trust.

Answer

Apply an SCP to the external account to deny the sts:AssumeRole action.

Answer

Create an IAM policy in the external account that denies sts:AssumeRole for the role.

Answer

Add a condition to the role's permissions policy requiring a specific source IP.

Question 6

A company wants to automatically detect and remediate S3 buckets that are publicly accessible. Which AWS service can be used to evaluate bucket policies against a defined rule and trigger an automated response?

Accepted Answer

AWS Config. AWS Config rules can evaluate S3 bucket policies against defined rules and trigger automated remediation actions. Option A is incorrect because Amazon GuardDuty is a threat detection service, not for evaluating bucket policies. Option B is incorrect because AWS CloudTrail is for auditing API calls, not real-time resource evaluation. Option C is incorrect because Amazon Inspector is for vulnerability assessment on EC2 instances, not S3 bucket policies.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

Amazon Inspector

Question 7

A company uses AWS Organizations with all features enabled. The security team wants to ensure that no IAM users are created in any account. Which approach should be used?

Accepted Answer

Attach a service control policy (SCP) that denies iam:CreateUser.. Service Control Policies (SCPs) in AWS Organizations allow you to centrally restrict permissions across all accounts in the organization. By attaching an SCP that denies the `iam:CreateUser` action, you prevent the creation of IAM users in any member account, regardless of any IAM policies attached to users or roles within those accounts. This provides a guardrail that cannot be overridden by account administrators, ensuring compliance with the security team's requirement.

Answer

Use AWS Config rules to detect IAM users and notify via SNS.

Answer

Enable AWS CloudTrail Insights to detect anomalous IAM activity.

Answer

Apply an IAM policy to the root user to deny iam:CreateUser.

Question 8

A company's security team needs to enforce encryption at rest for all RDS instances in the production account. They have enabled mandatory encryption using a service control policy. What else must be done to ensure existing unencrypted RDS instances are encrypted?

Accepted Answer

Create a snapshot of the unencrypted instance, copy the snapshot with encryption enabled, and restore the encrypted snapshot to a new DB instance.. RDS does not support directly enabling encryption on an existing unencrypted instance. The only way to encrypt an existing unencrypted RDS instance is to take a snapshot of it, copy the snapshot with encryption enabled, and restore the encrypted snapshot to a new DB instance. Options A, C, and D are incorrect: A: Attaching a new KMS key policy to the RDS instance does not encrypt the instance; encryption is applied at snapshot creation. C: Enabling encryption on the DB subnet group does not affect existing instances; it only applies to new instances. D: Modifying the RDS instance via the console does not allow enabling encryption on an existing instance; encryption can only be enabled at creation or via snapshot copy.

Answer

Attach a new KMS key policy to the RDS instance.

Answer

Enable encryption on the DB subnet group and reboot the instance.

Answer

Modify the RDS instance to enable encryption using the AWS Console.

Question 9

A company needs to audit all changes to IAM policies in their AWS account for compliance. Which AWS service should be enabled to record the API calls that modify IAM policies?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls, including IAM policy changes. Option A is incorrect because CloudWatch Logs stores logs but does not capture API calls directly. Option B is incorrect because AWS Config records resource configurations but not API call history. Option D is incorrect because VPC Flow Logs capture network traffic, not API calls.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

VPC Flow Logs

Question 10

A company's security team is implementing a data classification policy for S3 objects using S3 Object Tags. They need to ensure that any object uploaded without the required 'classification' tag is automatically denied. Which S3 bucket policy condition should be used?

Accepted Answer

aws:RequestTag. Aws:RequestTag. This condition key checks the tags provided in the request. To deny uploads that lack the required 'classification' tag, use a Deny effect with 'StringNotEquals' on 'aws:RequestTag/classification'. Option B (s3:ExistingObjectTag) checks tags already stored on the object, which does not apply at upload time because the object does not yet exist. s3:ExistingObjectTag is used for subsequent access controls, not for enforcing tagging during upload.

Answer

s3:x-amz-tagging-directive

Answer

s3:ExistingObjectTag

Answer

s3:object-lock-mode

Question 11

A company wants to centrally manage and enforce backup policies for all EC2 instances across multiple AWS accounts. Which AWS service should be used?

Accepted Answer

AWS Backup. AWS Backup is the correct service because it provides a centralized, policy-based solution to define and enforce backup policies across multiple AWS accounts and regions. It integrates with AWS Organizations to manage backups for EC2 instances and other supported resources, ensuring compliance with governance requirements without needing custom scripts or manual processes.

Answer

AWS Config

Answer

AWS CloudFormation StackSets

Answer

AWS Systems Manager

Question 12

A company uses AWS Organizations and wants to ensure that no member account can disable AWS CloudTrail or delete CloudTrail log files from S3. Which TWO actions should the security team take? (Choose TWO.)

Accepted Answer

Create an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail.. Options A and D are correct. A service control policy (SCP) applied to member accounts can deny the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions, preventing accounts from disabling or deleting trails. Adding an S3 bucket policy that denies s3:DeleteObject for the CloudTrail log bucket protects the log files from deletion by any principal, including the bucket owner. Option B is incorrect because MFA delete is an S3 feature but does not prevent deletion by CloudTrail or SCPs; it only adds an extra authentication requirement for versioned objects. Option C is incorrect because SCPs cannot be applied to the management account—the management account is not affected by SCPs, so this would not protect member accounts. Option E is incorrect because an IAM role for CloudTrail does not prevent other principals from deleting logs; it only controls CloudTrail's own permissions.

Answer

Enable MFA delete on the S3 bucket that stores CloudTrail logs.

Answer

Apply an SCP to the management account to prevent disabling CloudTrail.

Answer

Create an IAM role for CloudTrail with permissions to write logs only.

Question 13

A security team needs to ensure that all IAM users in a production account use multi-factor authentication (MFA) before accessing the AWS Management Console. Which TWO steps should be taken? (Choose TWO.)

Accepted Answer

Enable MFA for each IAM user.. To enforce MFA for console access, you need to enable MFA for each user (B) and attach an IAM policy that denies console access if MFA is not present (C). Option E is incorrect because the IAM password policy cannot require MFA; it only requires MFA for password changes, not console login. Option A is incorrect because AWS Config rules can detect users without MFA but cannot enforce it. Option D is incorrect because SCPs apply to accounts, not individual user console access; they cannot directly require MFA for console login.

Answer

Use AWS Config rules to detect users without MFA.

Answer

Apply an SCP that requires MFA for console access.

Answer

Configure an IAM password policy to require MFA.

Question 14

A company uses AWS KMS to encrypt sensitive data. The security team needs to ensure that KMS keys cannot be deleted accidentally. Which TWO actions should be taken? (Choose TWO.)

Accepted Answer

Attach an SCP that denies kms:ScheduleKeyDeletion for all accounts.. Options A and D are correct. Attaching a service control policy (SCP) that denies kms:ScheduleKeyDeletion at the organizational level (A) and modifying the key policy to deny kms:ScheduleKeyDeletion for all principals (D) are both preventive controls that protect KMS keys from accidental deletion. Option B (CloudTrail) is detective, not preventive. Option C (key rotation) does not affect deletion permissions. Option E (disabling the key) prevents usage but does not prevent deletion; the key can still be deleted while disabled.

Answer

Enable CloudTrail to log key deletion events.

Answer

Enable automatic key rotation.

Answer

Disable the key to prevent usage.

Question 15

An IAM policy is used to grant access to an S3 bucket. The policy condition requires that objects be retrieved using AES256 encryption. However, users can still download objects without specifying encryption. What is the MOST likely reason?

Accepted Answer

The condition key 's3:x-amz-server-side-encryption' applies only to PUT requests, not GET requests.. The condition key 's3:x-amz-server-side-encryption' is a request header that is only applicable to PUT requests (uploads) when setting server-side encryption. For GET requests (downloads), the 's3:x-amz-server-side-encryption' header is not used; instead, the condition 's3:x-amz-server-side-encryption-customer-algorithm' would apply for customer-provided encryption keys. Therefore, the policy condition does not affect GET requests, allowing users to download objects without specifying encryption. Options B, C, and D are incorrect: B is wrong because the resource ARN with '/*' is correct for granting access to objects; C is wrong because using 'Null' would not solve the issue; D is wrong because 'aws:SecureTransport' enforces HTTPS, not encryption.

Answer

The resource ARN should include the bucket name without the '/*' suffix.

Answer

The condition should use 'Null' instead of 'StringEquals'.

Answer

The condition should use 'aws:SecureTransport' instead.