SCS-C02 Management and Security Governance Practice Test 4 — 15 Questions

Question 1

A company has an S3 bucket that stores sensitive data. The bucket policy allows access only from a specific VPC endpoint. The security engineer tests the configuration and finds that requests from the VPC endpoint are being denied. The bucket policy contains the following condition: "Condition": { "StringEquals": { "aws:SourceVpce": "vpce-12345678" } }. The VPC endpoint ID is correct. The engineer also confirms that the VPC endpoint policy allows the necessary S3 actions. What is the most likely reason for the denial?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The request is not being routed through the VPC endpoint; the EC2 instance is using a public S3 endpoint.. The bucket policy condition aws:SourceVpce restricts access to requests that arrive through the specified VPC endpoint. If the EC2 instance is resolving s3.amazonaws.com to the public IP and routing through an Internet Gateway or NAT instead of the gateway endpoint, the request's source VPC endpoint context is absent, so the StringEquals condition fails and access is denied. The fix is to ensure the route table for the subnet has a route to the S3 prefix list via the gateway endpoint, and that the instance uses the endpoint.

Answer

The EC2 instance does not have an IAM role that allows s3:GetObject.

Answer

The VPC endpoint is in a different region than the S3 bucket.

Answer

The condition key is misspelled; it should be aws:SourceVpce (no 'e' at the end).

Question 2

A company has a multi-account AWS Organizations setup with hundreds of accounts. The Security team needs to enforce a policy that prohibits the creation of any S3 bucket with public read access across all accounts. They have enabled all features in Organizations and are using Service Control Policies (SCPs). The team creates an SCP with a Deny effect for s3:PutBucketAcl and s3:PutBucketPolicy when the request includes a condition that would make the bucket public. They attach the SCP to the root OU. However, a developer in a member account under the root OU is able to create a bucket with a bucket policy that grants public read access. The SCP is evaluated and shows the Deny is effective for s3:PutBucketPolicy but the bucket policy is still created. What is the MOST likely reason for this behavior?

Accepted Answer

The developer used a different API call, such as PutObject with public-read canned ACL, which is not blocked by the SCP because it does not match the denied actions.. The SCP denies s3:PutBucketAcl and s3:PutBucketPolicy under certain conditions. However, the developer used a different API call, such as PutObject with a public-read canned ACL, which is not blocked by the SCP because it does not match the denied actions. SCPs only restrict the actions explicitly listed; if the developer uses an action not denied, the SCP does not prevent it. Therefore, the bucket policy was created, but the public access was granted via a different method.

Answer

The S3 Block Public Access settings at the account level are overriding the SCP.

Answer

The developer used an IAM role that is attached to an Amazon EC2 instance, which bypasses SCPs.

Answer

The SCP only denies actions when the request comes from outside the organization, but the developer is within the organization.

Question 3

A company wants to grant cross-account access to an S3 bucket. What is the best practice for managing permissions?

Accepted Answer

Use an S3 bucket policy that grants access to the other account. An S3 bucket policy can explicitly grant cross-account access by specifying the other AWS account ID as the principal in the policy's Principal element. This allows the bucket owner to centrally manage permissions without requiring the target account to create an IAM role, and it works seamlessly with IAM user or role permissions in the external account. It is the recommended best practice for cross-account S3 access as per AWS documentation.

Answer

Use an IAM role in the target account

Answer

Use S3 ACLs with the other account ID

Answer

Use an SCP to allow access

Question 4

Which AWS service provides a centralized view of compliance status for AWS resources?

Accepted Answer

AWS Config. AWS Config is the correct answer because it provides a centralized view of compliance status by continuously evaluating your AWS resource configurations against desired policies (e.g., managed or custom rules). It generates compliance scores and detailed reports for each resource, enabling you to track whether your infrastructure adheres to internal or regulatory standards. This is distinct from other services because Config focuses specifically on configuration compliance, not threat detection or API activity.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

AWS Security Hub

Question 5

A company wants to enforce that all EC2 instances use a specific AMI ID. Which AWS service can be used to detect and remediate non-compliant instances?

Accepted Answer

AWS Config. AWS Config is the correct service because it continuously evaluates your AWS resource configurations against desired policies, such as requiring a specific AMI ID for all EC2 instances. You can create an AWS Config rule (e.g., a custom Lambda rule or a managed rule like 'ec2-instance-managed-by-systems-manager') to detect non-compliant instances, and then use AWS Config auto-remediation with Systems Manager Automation documents to terminate or replace them. This directly enforces compliance by both detecting and remediating violations.

Answer

AWS Systems Manager

Answer

Amazon Inspector

Answer

AWS CloudTrail

Question 6

Refer to the exhibit. A security engineer runs the AWS CLI command to look up CloudTrail events. What can be concluded from the output?

Accepted Answer

User 'admin' created a trail named 'my-trail' on Jan 15. The CloudTrail event output shows that user 'admin' performed a CreateTrail action on 'my-trail' on January 15. The event name is CreateTrail, the user identity is 'admin', and the request parameters include the trail name. Therefore, the conclusion that user 'admin' created a trail named 'my-trail' on Jan 15 is correct.

Answer

The event name is DeleteTrail

Answer

The trail was deleted by user 'admin'

Answer

The event is a read-only API call

Question 7

Refer to the exhibit. A CloudFormation template creates an S3 bucket. Which security control is NOT enabled by this template?

Accepted Answer

Bucket versioning. The exhibit (a CloudFormation template creating an S3 bucket) typically includes properties such as BucketEncryption, PublicAccessBlockConfiguration, and a BucketPolicy, but does not include the VersioningConfiguration property. Therefore, bucket versioning is the security control NOT enabled by the template. Versioning is a data-protection feature that preserves object versions, and its absence means overwrites and deletes are permanent.

Answer

Bucket policy restrictions

Answer

Blocking public access

Answer

Server-side encryption

Question 8

A company wants to grant a third-party auditor read-only access to specific CloudTrail log files stored in an S3 bucket. The auditor should not be able to list or access any other objects in the bucket. What is the most secure way to achieve this?

Accepted Answer

Generate pre-signed URLs for the specific log files and share them with the auditor.. Pre-signed URLs grant time-limited, read-only access to specific S3 objects without requiring the auditor to have any IAM permissions or bucket access. This is the most secure approach because it exposes only the exact objects intended, with no ability to list or access other objects.

Answer

Use CloudTrail's built-in console access for the auditor.

Answer

Create a new IAM user for the auditor with an S3 policy that grants s3:GetObject on the entire bucket.

Answer

Use a bucket policy that grants the auditor's IAM user s3:GetObject access to the specific log file prefix.

Question 9

A company's security team needs to implement a solution to detect and alert on the creation of IAM users or roles with administrative privileges. The solution must be able to analyze historical account activity and provide real-time alerts. Which combination of AWS services should be used?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Logs with metric filters and alarms. AWS CloudTrail logs IAM CreateUser, CreateRole, and AttachRolePolicy events. Amazon CloudWatch Logs can use metric filters to capture these events and trigger CloudWatch Alarms for real-time alerts. CloudTrail also stores historical logs for analysis. Option A is the correct combination. Option B (GuardDuty and Lambda) is focused on threat detection, not specific IAM administrative privilege creation events. Option C (Trusted Advisor and SES) provides best-practice recommendations and email notifications, not real-time API monitoring. Option D (AWS Config and SNS) evaluates resource configuration compliance but does not monitor API calls in real time.

Answer

Amazon GuardDuty and AWS Lambda

Answer

AWS Trusted Advisor and Amazon SES

Answer

AWS Config with managed rules and Amazon SNS

Question 10

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that all accounts have AWS CloudTrail enabled and that logs are delivered to a central S3 bucket in the management account. What is the most efficient way to enforce this across all accounts?

Accepted Answer

Create a service control policy (SCP) that denies modifications to CloudTrail settings.. SCPs are the only AWS Organizations mechanism that can enforce preventive controls across all accounts in an OU or organization. By attaching an SCP that denies actions like cloudtrail:StopLogging, cloudtrail:DeleteTrail, and cloudtrail:UpdateTrail, the security team ensures no principal in any member account can disable or tamper with CloudTrail, even account root users. This is the most efficient way to enforce the requirement centrally without per-account configuration drift.

Answer

Use AWS Trusted Advisor to check CloudTrail status and send alerts.

Answer

Configure each account individually with a CloudTrail trail pointing to the central bucket.

Answer

Use AWS Config rules in each account to detect non-compliant trails.

Question 11

A developer accidentally committed AWS access keys to a public GitHub repository. The security team needs to immediately revoke the compromised keys and ensure that no new keys are created for that IAM user. What is the most effective immediate action?

Accepted Answer

Delete the IAM user and recreate it with new permissions.. Deleting the IAM user immediately invalidates all credentials associated with that user, including the compromised access keys, and prevents any new keys from being created for that identity. This satisfies both requirements in the question: immediate revocation and prevention of new key creation. The user can then be recreated with least-privilege permissions.

Answer

Rotate the access keys and update the application.

Answer

Change the IAM user's password.

Answer

Deactivate the access keys using the AWS Management Console.

Question 12

A company has a requirement that all Amazon EC2 instances must be launched with an IAM role that grants least-privilege permissions. The security team wants to prevent users from launching instances without a role, and also want to ensure that the role used is one of a set of approved roles. How can this be enforced?

Accepted Answer

Attach an IAM policy to users that denies ec2:RunInstances unless the ec2:InstanceProfile condition matches an approved profile ARN.. Option B uses an IAM policy with a condition on the ec2:InstanceProfile key to ensure that only approved instance profiles are used. This satisfies both requirements: a role must be attached, and it must be one of the approved roles.

Option A is incorrect because an SCP that requires an IAM role cannot restrict the role to a specific set of approved roles; it would allow any role.

Option C is incorrect because SCPs require AWS Organizations and apply to all principals in the account. While SCPs can technically use the ec2:InstanceProfile condition key, they are typically used for broad guardrails and not for user-specific restrictions. An IAM policy with a condition is the recommended method for this use case.

Option D is incorrect because AWS Config is a detective service; it cannot prevent unauthorized launches, only detect them after the fact.

Answer

Use an SCP to require that all EC2 instances have an IAM role attached.

Answer

Use an SCP to deny ec2:RunInstances unless the instance profile is in a specific list of ARNs.

Answer

Use AWS Config to detect instances without a role and automatically terminate them.

Question 13

A company is using AWS Organizations and wants to delegate the management of IAM policies to a specific member account without granting full administrative access. Which AWS feature allows the management account to delegate policy management to another account?

Accepted Answer

IAM cross-account roles. IAM cross-account roles allow the management account to delegate permissions to a member account by creating a role in the member account that the management account can assume. This enables the member account to manage IAM policies without granting full administrative access. Option A is wrong because AWS Resource Access Manager shares resources, not IAM management. Option B is wrong because AWS CloudFormation StackSets automate resource deployment across accounts, not delegation of policy management. Option C is wrong because AWS Single Sign-On focuses on user authentication and authorization, not IAM policy delegation.

Answer

AWS Resource Access Manager

Answer

AWS CloudFormation StackSets

Answer

AWS Single Sign-On

Question 14

A company's security team is implementing a solution to automatically revoke public access to Amazon S3 buckets that become public. The solution must be serverless and use native AWS services. Which combination of services should be used?

Accepted Answer

Amazon EventBridge (CloudWatch Events) to detect PutBucketPolicy events and invoke an AWS Lambda function to remove the policy. Amazon EventBridge (formerly CloudWatch Events) can capture S3 control-plane API calls such as PutBucketPolicy via CloudTrail-backed event patterns, then invoke a Lambda function that removes the offending policy. This is fully serverless, uses native AWS services, and reacts in near real time to the exact event that makes a bucket public. It directly satisfies the requirement to auto-revoke public access.

Answer

Amazon S3 event notifications on ObjectCreated events to invoke a Lambda function

Answer

Amazon CloudWatch Logs with a metric filter and alarm to trigger an SNS notification

Answer

AWS Config with managed rule 's3-bucket-public-read-prohibited' and auto-remediation via Systems Manager

Question 15

Which THREE steps should a security engineer take to remediate a compromised IAM user whose access keys were exposed? (Choose three.)

Accepted Answer

Deactivate the access keys.. Option A is correct because deactivating the exposed access keys immediately prevents the compromised credentials from being used to make API calls, stopping ongoing unauthorized access while preserving the keys for forensic analysis. Option C is correct because removing the user from all IAM groups revokes the permissions inherited through group policies, ensuring the compromised identity cannot exercise those privileges even if other credentials remain active. Option E is correct because deleting the access keys permanently eliminates the exposed credentials so they can never be reactivated or reused by an attacker. Option B does not belong because creating a new IAM user with the same permissions does not remediate the compromised account and could simply replicate the exposure. Option D does not belong because changing the IAM user's password does not address the leaked access keys, which are used for programmatic access and are independent of the console password.

Answer

Create a new IAM user with the same permissions.

Answer

Change the IAM user's password.