SCS-C02 Management and Security Governance Practice Test 4 — 15 Questions

Question 1

A company's security team is implementing a data classification policy for S3 objects using S3 Object Tags. They need to ensure that any object uploaded without the required 'classification' tag is automatically denied. Which S3 bucket policy condition should be used?

Accepted Answer

s3:ExistingObjectTag. Option C is correct because using 's3:ExistingObjectTag' with a deny condition ensures that if the tag does not exist, the request is denied. Option A is incorrect because 's3:x-amz-tagging-directive' is for copy operations. Option B is incorrect because 'aws:RequestTag' checks tags provided in the request, not existing tags. Option D is incorrect because 's3:object-lock-mode' is for object lock.

Answer

s3:x-amz-tagging-directive

Answer

aws:RequestTag

Answer

s3:object-lock-mode

Question 2

A company wants to centrally manage and enforce backup policies for all EC2 instances across multiple AWS accounts. Which AWS service should be used?

Accepted Answer

AWS Backup. AWS Backup is the correct service because it provides a centralized, policy-based solution to define and enforce backup policies across multiple AWS accounts and regions. It integrates with AWS Organizations to manage backups for EC2 instances and other supported resources, ensuring compliance with governance requirements without needing custom scripts or manual processes.

Answer

AWS Config

Answer

AWS CloudFormation StackSets

Answer

AWS Systems Manager

Question 3

A company uses AWS Organizations and wants to ensure that no member account can disable AWS CloudTrail or delete CloudTrail log files from S3. Which TWO actions should the security team take? (Choose TWO.)

Accepted Answer

Create an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail.. Options A and C are correct. An SCP can deny the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions. An S3 bucket policy with a deny effect can protect the log files from deletion. Option B is incorrect because CloudTrail does not support MFA for log file deletion directly. Option D is incorrect because IAM roles are not preventive. Option E is incorrect because SCPs cannot be applied to the management account in a way that prevents it from modifying CloudTrail; the management account is not affected by SCPs.

Answer

Enable MFA delete on the S3 bucket that stores CloudTrail logs.

Answer

Apply an SCP to the management account to prevent disabling CloudTrail.

Answer

Create an IAM role for CloudTrail with permissions to write logs only.

Question 4

A security team needs to ensure that all IAM users in a production account use multi-factor authentication (MFA) before accessing the AWS Management Console. Which THREE steps should be taken? (Choose THREE.)

Accepted Answer

Enable MFA for each IAM user.. Options A, C, and E are correct. Enabling MFA on each user, using IAM policy to deny console access without MFA, and using a password policy that requires MFA are all necessary steps. Option B is incorrect because AWS Config can detect but not enforce MFA usage. Option D is incorrect because SCPs apply to accounts, not individual user console access.

Answer

Use AWS Config rules to detect users without MFA.

Answer

Apply an SCP that requires MFA for console access.

Question 5

A company uses AWS KMS to encrypt sensitive data. The security team needs to ensure that KMS keys cannot be deleted accidentally. Which TWO actions should be taken? (Choose TWO.)

Accepted Answer

Attach an SCP that denies kms:ScheduleKeyDeletion for all accounts.. Options A and C are correct. Enabling key rotation creates new cryptographic material but does not prevent deletion; however, the question asks about preventing deletion, so key rotation is not directly relevant. Actually, the correct answers are: enabling deletion protection on the key (Option B is correct if we consider that KMS now supports key deletion protection; but traditionally, the way to prevent deletion is to disable key deletion via key policy or using SCP. Option A: enabling automatic key rotation does not prevent deletion. Option B: disabling the key does not prevent deletion. Option C: using SCP to deny kms:ScheduleKeyDeletion is correct. Option D: using a key policy to deny deletion is correct. Option E: using CloudTrail is detective, not preventive. The correct two are C and D. I'll revise:

Answer

Enable CloudTrail to log key deletion events.

Answer

Enable automatic key rotation.

Answer

Disable the key to prevent usage.

Question 6

An IAM policy is used to grant access to an S3 bucket. The policy condition requires that objects be retrieved using AES256 encryption. However, users can still download objects without specifying encryption. What is the MOST likely reason?

Accepted Answer

The condition key 's3:x-amz-server-side-encryption' applies only to PUT requests, not GET requests.. Option C is correct because the condition 's3:x-amz-server-side-encryption' is a request header for uploads, not downloads. For downloads, the condition should be 's3:x-amz-server-side-encryption-customer-algorithm' or similar. Option A is incorrect because the resource ARN is correct. Option B is incorrect because S3 supports multiple encryption types. Option D is incorrect because the condition is not null.

Answer

The resource ARN should include the bucket name without the '/*' suffix.

Answer

The condition should use 'Null' instead of 'StringEquals'.

Answer

The condition should use 'aws:SecureTransport' instead.

Question 7

A security engineer is reviewing the CloudTrail configuration for a trail named 'management-trail'. The engineer needs to ensure that all S3 object-level operations in the bucket 'my-bucket' are logged. What is the issue with the current configuration?

Accepted Answer

The 'Values' field should end with a '/*' to capture all objects under the prefix.. Option B is correct because the 'DataResources' value should include a trailing '/*' to indicate all objects under the prefix. Option A is incorrect because the ReadWriteType is 'All', which covers both read and write. Option C is incorrect because the event selector includes management events. Option D is incorrect because the trail is not necessarily multi-region from this output.

Answer

The ReadWriteType is set to 'All', which does not include write events.

Answer

The IncludeManagementEvents should be set to false to focus on data events.

Answer

The trail should be configured as a multi-region trail to capture all regions.

Question 8

An S3 bucket policy is created as shown. What is the effect of this policy?

Accepted Answer

It denies all requests that are not made over HTTPS.. Option A is correct because the policy denies all actions when the request is not using HTTPS (SecureTransport is false). Option B is incorrect because it does not allow anonymous access. Option C is incorrect because it does not enforce encryption at rest. Option D is incorrect because it does not block all access, only non-HTTPS requests.

Answer

It blocks all access to the bucket.

Answer

It allows anonymous access to the bucket over HTTPS.

Answer

It requires server-side encryption for all objects.

Question 9

A security engineer notices that an IAM user has permissions that exceed their job requirements. The engineer wants to implement the principle of least privilege. Which IAM feature should be used to grant only the necessary permissions?

Accepted Answer

Attach a permissions boundary to the user. Permissions boundaries set the maximum permissions that an identity-based policy can grant. Option A is correct because it restricts permissions to a defined boundary. Option B (service control policies) applies to all accounts in an organization, not individual users. Option C (resource-based policies) are attached to resources, not users. Option D (IAM groups) do not enforce boundaries.

Answer

Add the user to an IAM group with restricted permissions

Answer

Use a resource-based policy on the user

Answer

Attach a service control policy (SCP) to the user's account

Question 10

A company uses AWS Organizations with multiple accounts. The security team needs to ensure that no account can disable a specific security service, such as AWS Config, across all accounts. Which approach should be used?

Accepted Answer

Attach a service control policy (SCP) that denies the action at the root organization level. A service control policy (SCP) can deny actions across all accounts in an organization. Option B is correct because an SCP with a Deny effect on config:StopConfigurationRecorder prevents disabling. Option A is wrong because IAM roles do not apply to the root user. Option C is wrong because CloudTrail logs actions but does not prevent them. Option D is wrong because Config rules do not prevent disabling.

Answer

Create an IAM role with a deny policy for the action and attach it to all users

Answer

Create an AWS Config rule to check for the action and automatically remediate

Answer

Enable AWS CloudTrail and create a metric filter to alert on the action

Question 11

A developer has created an S3 bucket policy that grants public read access. The security team wants to prevent any S3 bucket from becoming public. Which AWS service can enforce this restriction across all accounts?

Accepted Answer

A service control policy (SCP) denying s3:PutBucketPolicy. AWS Organizations SCPs can deny specific S3 actions that make buckets public. Option C is correct. Option A (IAM policies) are per-user, not account-wide. Option B (S3 Block Public Access) is per-account or per-bucket, but can be overridden. Option D (CloudTrail) only logs.

Answer

AWS CloudTrail with a metric filter

Answer

S3 Block Public Access settings on each account

Answer

IAM permissions boundary

Question 12

A company wants to centrally manage IAM users and allow them to access multiple AWS accounts using a single set of credentials. Which AWS service should be used?

Accepted Answer

AWS IAM Identity Center (AWS SSO). AWS IAM Identity Center (formerly AWS SSO) is the correct service because it provides a centralized identity source that allows users to sign in once with a single set of credentials and then access multiple AWS accounts and business applications. It integrates with AWS Organizations to automatically manage permissions across accounts, eliminating the need for separate IAM users in each account.

Answer

IAM roles with cross-account trust

Answer

AWS Organizations consolidated billing

Answer

Amazon Cognito user pools

Question 13

A security team needs to enforce that all EC2 instances launched in a specific AWS account use only approved AMIs. Which combination of services can enforce this requirement?

Accepted Answer

Use an AWS Config rule to check AMI compliance and a service control policy (SCP) to deny noncompliant launches. AWS Config rules can evaluate launched instances, and SCPs can deny noncompliant launches. Option A is correct. Option B (Service Catalog) requires products, not enforced for direct EC2 run. Option C (CloudTrail) only logs. Option D (IAM) cannot restrict based on AMI ID directly.

Answer

Use IAM policies to restrict ec2:RunInstances to only approved AMIs

Answer

Use AWS Service Catalog with a product that launches approved AMIs

Answer

Use AWS CloudTrail to log all EC2 launches and alert on noncompliant AMIs

Question 14

A company wants to automate the enforcement of security best practices across all AWS accounts. Which AWS service provides pre-built rules for security compliance?

Accepted Answer

AWS Security Hub. AWS Security Hub is the correct answer because it provides a comprehensive view of security alerts and compliance status across AWS accounts, and it includes pre-built security standards and automated compliance checks based on frameworks such as the AWS Foundational Security Best Practices (FSBP), CIS AWS Foundations Benchmark, and PCI DSS. These pre-built rules allow you to automate the enforcement of security best practices without manual configuration.

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Answer

AWS Config

Question 15

A security engineer discovers that an IAM user has a policy that allows them to delete any S3 bucket in the account. The engineer wants to audit all delete actions performed by this user. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail logs all API calls, including S3 bucket deletions. Option D is correct. Option A (Config) records resource changes but not API calls. Option B (CloudWatch Logs) stores logs but does not capture API calls by default. Option C (GuardDuty) detects threats but does not log all actions.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

Amazon CloudWatch Logs