SCS-C02 Management and Security Governance Practice Test 4 — 15 Questions

Question 1

A security engineer is reviewing the CloudTrail configuration for a trail named 'management-trail'. The engineer needs to ensure that all S3 object-level operations in the bucket 'my-bucket' are logged. What is the issue with the current configuration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The 'Values' field should end with a '/*' to capture all objects under the prefix.. The 'DataResources' value should include a trailing '/*' to indicate all objects under the prefix. Option A is incorrect because the ReadWriteType is 'All', which covers both read and write. Option C is incorrect because the event selector includes management events. Option D is incorrect because the trail is not necessarily multi-region from this output.

Answer

The ReadWriteType is set to 'All', which does not include write events.

Answer

The IncludeManagementEvents should be set to false to focus on data events.

Answer

The trail should be configured as a multi-region trail to capture all regions.

Question 2

An S3 bucket policy is created as shown. What is the effect of this policy?

Accepted Answer

It denies all requests that are not made over HTTPS.. The policy denies all S3 actions if the request does not use HTTPS (SecureTransport is false). Therefore, the effect is to deny any request that is not made over HTTPS. The correct answer is B. Option A is incorrect because the policy does not block all access; it only blocks non-HTTPS requests. Option C is incorrect because the policy does not allow anonymous access; it only restricts the protocol. Option D is incorrect because the policy does not enforce server-side encryption; it only enforces HTTPS.

Answer

It blocks all access to the bucket.

Answer

It allows anonymous access to the bucket over HTTPS.

Answer

It requires server-side encryption for all objects.

Question 3

A security engineer notices that an IAM user has permissions that exceed their job requirements. The engineer wants to implement the principle of least privilege. Which IAM feature should be used to grant only the necessary permissions?

Accepted Answer

Attach a permissions boundary to the user. Permissions boundaries set the maximum permissions that an identity-based policy can grant. Option A is correct because attaching a permissions boundary restricts the user's permissions to a defined boundary. Option B (adding the user to an IAM group with restricted permissions) can help but does not enforce a hard limit; the user might still have other policies that grant permissions beyond the group's policies. Option C (using a resource-based policy on the user) is incorrect because resource-based policies are attached to resources, not users. Option D (attaching a service control policy (SCP) to the user's account) applies to all accounts in an AWS organization and cannot be attached to individual users; SCPs affect all IAM users in the account.

Answer

Add the user to an IAM group with restricted permissions

Answer

Use a resource-based policy on the user

Answer

Attach a service control policy (SCP) to the user's account

Question 4

A company uses AWS Organizations with multiple accounts. The security team needs to ensure that no account can disable a specific security service, such as AWS Config, across all accounts. Which approach should be used?

Accepted Answer

Attach a service control policy (SCP) that denies the action at the root organization level. A service control policy (SCP) can deny actions across all accounts in an organization. Option C is correct because an SCP with a Deny effect on config:StopConfigurationRecorder prevents disabling. Option A is wrong because IAM roles do not apply to the root user and are not organization-wide. Option B is wrong because Config rules can detect non-compliance but do not prevent the action. Option D is wrong because CloudTrail logs actions and can alert but does not prevent them.

Answer

Create an IAM role with a deny policy for the action and attach it to all users

Answer

Create an AWS Config rule to check for the action and automatically remediate

Answer

Enable AWS CloudTrail and create a metric filter to alert on the action

Question 5

A company wants to centrally manage IAM users and allow them to access multiple AWS accounts using a single set of credentials. Which AWS service should be used?

Accepted Answer

AWS IAM Identity Center (AWS SSO). AWS IAM Identity Center (formerly AWS SSO) is the correct service because it provides a centralized identity source that allows users to sign in once with a single set of credentials and then access multiple AWS accounts and business applications. It integrates with AWS Organizations to automatically manage permissions across accounts, eliminating the need for separate IAM users in each account.

Answer

IAM roles with cross-account trust

Answer

AWS Organizations consolidated billing

Answer

Amazon Cognito user pools

Question 6

A security team needs to enforce that all EC2 instances launched in a specific AWS account use only approved AMIs. Which combination of services can enforce this requirement?

Accepted Answer

Use an AWS Config rule to check AMI compliance and a service control policy (SCP) to deny noncompliant launches. The correct combination is AWS Config rule and SCP. An AWS Config rule can evaluate launched instances against approved AMIs, and an SCP can deny any noncompliant launch at the organizational level. Option A is incorrect because IAM policies cannot restrict ec2:RunInstances based on AMI ID. Option B (Service Catalog) is incorrect because it does not prevent direct EC2 launches through the console or CLI. Option D (CloudTrail) only logs and alerts but does not enforce compliance.

Answer

Use IAM policies to restrict ec2:RunInstances to only approved AMIs

Answer

Use AWS Service Catalog with a product that launches approved AMIs

Answer

Use AWS CloudTrail to log all EC2 launches and alert on noncompliant AMIs

Question 7

A company wants to automate the enforcement of security best practices across all AWS accounts. Which AWS service provides pre-built rules for security compliance?

Accepted Answer

AWS Security Hub. AWS Security Hub is the correct answer because it provides a comprehensive view of security alerts and compliance status across AWS accounts, and it includes pre-built security standards and automated compliance checks based on frameworks such as the AWS Foundational Security Best Practices (FSBP), CIS AWS Foundations Benchmark, and PCI DSS. These pre-built rules allow you to automate the enforcement of security best practices without manual configuration.

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Answer

AWS Config

Question 8

A company uses AWS Organizations and wants to restrict the use of specific AWS services in member accounts. For example, they want to block the use of Amazon Redshift. Which policy type should be used?

Accepted Answer

Service control policies (SCPs). Service control policies (SCPs) can deny access to AWS services at the organization level, making option A correct. Option B (IAM permissions boundaries) are per-entity, not organizational. Option C (IAM policies) are per-identity. Option D (S3 bucket policies) are per-resource and cannot restrict service usage across accounts.

Answer

IAM permissions boundaries

Answer

IAM identity-based policies

Answer

S3 bucket policies

Question 9

Which TWO actions can be taken to enforce the principle of least privilege for IAM users in an AWS account? (Choose two.)

Accepted Answer

Use IAM roles with temporary credentials for access. Uses IAM roles with temporary credentials, which adheres to least privilege by providing only necessary permissions for a limited time. Option E involves regularly reviewing and removing unused IAM policies, which ensures that only required permissions are granted and eliminates excessive permissions. Option B (full admin) violates least privilege. Option C (SCP) applies to accounts/OU, not individual users. Option D (root user) should be avoided for daily tasks due to excessive permissions.

Answer

Grant full administrative access to all users to simplify management

Answer

Use service control policies (SCPs) to restrict user permissions

Answer

Use the root user for daily administrative tasks

Question 10

Which THREE are benefits of using AWS CloudTrail for security governance? (Choose three.)

Accepted Answer

Supports compliance audits by providing event history. CloudTrail supports compliance audits by providing event history (C), records API activity in the account (D), and enables security analysis of user activity (E). Option A is not a direct benefit of CloudTrail because real-time log analysis is enabled by CloudWatch Logs, not CloudTrail. Option B describes automated remediation, which is a feature of AWS Config or Systems Manager, not CloudTrail.

Answer

Enables real-time log analysis with Amazon CloudWatch Logs

Answer

Automatically remediates noncompliant resources

Question 11

Which TWO are valid methods to centrally manage multiple AWS accounts? (Choose two.)

Accepted Answer

AWS Control Tower. AWS Control Tower (D) and AWS Organizations (E) are the two services designed for centrally managing multiple AWS accounts. AWS Organizations allows you to consolidate multiple accounts into an organization and centrally manage policies, while AWS Control Tower provides a pre-configured landing zone with governance rules. AWS IAM (A) is per-account, AWS Service Catalog (B) is for creating and managing catalogs of IT services, and Amazon Cognito (C) is for user authentication, not account management.

Answer

AWS IAM

Answer

AWS Service Catalog

Answer

Amazon Cognito

Question 12

A company requires that all IAM users in the Security team must use multi-factor authentication (MFA) to access the AWS Management Console. The company has enabled MFA for all users, but the Security team administrator reports that some users can still sign in without MFA. Which action should the administrator take to enforce MFA for all sign-ins?

Accepted Answer

Attach an IAM policy that denies all actions if 'aws:MultiFactorAuthPresent' is false.. Attaching an IAM policy that explicitly denies access unless MFA is present will enforce MFA for all actions, including console sign-in. Option A is wrong because the default condition key 'aws:MultiFactorAuthPresent' is not set to 'true' for console sign-in; it is only set for API calls. Option B is wrong because requiring MFA for programmatic access does not affect console sign-in. Option C is wrong because password policy cannot enforce MFA at sign-in.

Answer

Create a new IAM policy that requires MFA for programmatic access only.

Answer

Enable the 'aws:MultiFactorAuthPresent' condition in the IAM password policy.

Answer

Update the password policy to require MFA for all IAM users.

Question 13

A developer needs to grant an IAM user read-only access to an S3 bucket containing sensitive data. The bucket is encrypted with an AWS KMS customer managed key. Which set of permissions must be included in the IAM policy?

Accepted Answer

s3:GetObject, kms:Decrypt. To read objects from an encrypted S3 bucket, the user needs both s3:GetObject to retrieve the object and kms:Decrypt to decrypt the object using the KMS key. Option A is wrong because it includes kms:Encrypt instead of kms:Decrypt; decryption is required, not encryption. Option C is wrong because it lacks s3:GetObject permission, which is necessary to retrieve the object. Option D is wrong because it includes s3:ListBucket, which is not required for reading a specific object, and it lacks s3:GetObject.

Answer

s3:GetObject, kms:Encrypt

Answer

kms:Decrypt

Answer

s3:ListBucket, kms:Decrypt

Question 14

A company's Security team is using AWS Organizations with a consolidated billing account. The security team wants to ensure that all member accounts have AWS CloudTrail enabled and that logs are delivered to a central S3 bucket in the management account. Which combination of actions should the security team take? (Choose the best answer.)

Accepted Answer

Use an SCP to deny disabling CloudTrail and use CloudFormation StackSets to deploy CloudTrail in all accounts.. Using an SCP to deny disabling CloudTrail and a CloudFormation StackSet to deploy CloudTrail in each account ensures enforcement and deployment across all member accounts. Option A is wrong because AWS Config rules can detect but not prevent disabling of CloudTrail. Option B is wrong because an IAM policy requiring account owners to enable CloudTrail is not enforceable and relies on individual action. Option C is wrong because enabling CloudTrail only in the management account does not enable it in member accounts; cross-account logging requires member accounts to have CloudTrail configured.

Answer

Use AWS Config rules to detect when CloudTrail is disabled.

Answer

Create a new IAM policy that requires each account owner to enable CloudTrail.

Answer

Enable CloudTrail in the management account only and use cross-account logging.

Question 15

A company uses AWS Organizations with multiple accounts. The security team wants to centrally manage IAM policies across all accounts. Which AWS feature should the team use to enforce permissions across member accounts?

Accepted Answer

Service Control Policies (SCPs). Service Control Policies (SCPs) allow central control over permissions for all accounts in an organization. Option A is wrong because IAM roles with cross-account access provide temporary access but do not enforce policies centrally. Option C is wrong because AWS Config rules are for compliance monitoring, not permission enforcement. Option D is wrong because AWS CloudTrail is for auditing, not enforcement.

Answer

IAM roles with cross-account access

Answer

AWS Config rules

Answer

AWS CloudTrail trails