SCS-C02 Management and Security Governance Practice Test 5 — 15 Questions

Question 1

A security engineer needs to grant an EC2 instance access to an S3 bucket without storing long-term credentials on the instance. Which approach should the engineer use?

Accepted Answer

Create an IAM role with the required permissions and attach it to the EC2 instance as an instance profile.. An IAM role with an instance profile allows the EC2 instance to obtain temporary credentials from the instance metadata service, avoiding long-term credential storage. Option A is wrong because it stores long-term access keys on the instance. Option B is wrong because SCPs are organization-wide policies, not for individual instances. Option C is wrong because storing credentials in the AMI is insecure and also long-term.

Answer

Generate an access key and secret key for an IAM user and store them in the EC2 instance.

Answer

Use an SCP to allow the EC2 instance to access the S3 bucket.

Answer

Store the credentials in the AMI used to launch the instance.

Question 2

A company is using AWS Organizations with SCPs. The management account has an SCP that denies access to all EC2 actions. A developer in a member account tries to launch an EC2 instance but receives an authorization error. The developer has an IAM policy that allows ec2:RunInstances. What is the most likely cause of the error?

Accepted Answer

The SCP denies the action, overriding the IAM policy.. SCPs act as a permission boundary; if an SCP denies an action, it cannot be performed even if an IAM policy allows it. Option A is wrong because the developer does have the ec2:RunInstances permission in their IAM policy; the error occurs due to the SCP. Option B is wrong because the order of evaluation is not relevant; SCPs and IAM policies are evaluated together, and SCPs can deny actions regardless of IAM permissions. Option D is wrong because SCPs apply to all principals in the account, not just the root user.

Answer

The IAM policy does not include the ec2:RunInstances permission.

Answer

The IAM policy is applied before the SCP.

Answer

The SCP is applied only to the root user.

Question 3

A company wants to ensure that IAM users with console access have strong passwords. Which IAM password policy setting should the company configure to enforce the use of at least one uppercase letter?

Accepted Answer

RequireUppercaseCharacters. 'RequireUppercaseCharacters' enforces the use of at least one uppercase letter. Option A is wrong because 'MinimumPasswordLength' only sets the minimum length, not character types. Option C is wrong because 'RequireNumbers' enforces digits, not uppercase letters. Option D is wrong because 'RequireSymbols' enforces special characters, not uppercase letters.

Answer

MinimumPasswordLength

Answer

RequireNumbers

Answer

RequireSymbols

Question 4

A security engineer needs to audit all API calls made in an AWS account for the past 90 days. Which AWS service should the engineer use?

Accepted Answer

AWS CloudTrail. AWS CloudTrail (Option B) is the correct service for auditing all API calls made in an AWS account over the past 90 days. It records API activity and can be configured to store logs for 90 days in the management event history. Option A (Amazon S3 access logs) logs access to S3 objects, not API calls. Option C (AWS Config) tracks resource configuration changes, not API calls. Option D (Amazon CloudWatch Logs) is for monitoring, storing, and accessing log files from various sources, but it is not specifically designed for auditing API calls; CloudTrail is the primary service for that purpose.

Answer

Amazon S3 access logs

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 5

A company uses AWS KMS to encrypt sensitive data. The security team wants to ensure that KMS keys can only be used by specific IAM roles and that key usage is logged. Which combination of actions should the team take? (Choose the best answer.)

Accepted Answer

Configure the key policy to specify the IAM roles as key users and enable CloudTrail.. Key policies define who can use the key, and CloudTrail logs all KMS API calls. Option A is wrong because an SCP can only deny, not grant permissions. Option B is wrong because IAM policies alone are not enough; the key policy must allow IAM access. Option C is wrong because the key policy must specify the IAM roles.

Answer

Create an SCP to restrict KMS key usage and enable CloudWatch Logs.

Answer

Attach an IAM policy that allows kms:Encrypt and kms:Decrypt to the roles.

Answer

Configure the key policy to allow the root user and enable CloudTrail.

Question 6

Which TWO actions are best practices for securing an AWS account root user? (Select TWO.)

Accepted Answer

Create an IAM user with administrative privileges and use it instead of the root user.. The correct answers are D and E. Creating an IAM user with administrative privileges and using it for everyday tasks reduces the need to use the root user, minimizing exposure of root credentials. Enabling MFA on the root user adds an additional layer of security, making it harder for attackers to gain full control. Option A is incorrect because using the root user for everyday tasks increases risk; root access should be restricted to essential account-level actions. Option B is incorrect because access keys for the root user provide long-term credentials that, if compromised, grant unrestricted access; they should not be created. Option C is incorrect because the root user cannot be deleted; it is required for account management and billing.

Answer

Use the root user for everyday administrative tasks.

Answer

Create access keys for the root user.

Answer

Delete the root user to prevent unauthorized access.

Question 7

Which THREE measures should a security team implement to detect and respond to potential security incidents in an AWS environment? (Select THREE.)

Accepted Answer

Enable AWS CloudTrail.. Options B, C, and E are correct. AWS CloudTrail logs all API calls, providing an audit trail for investigation. AWS Config tracks configuration changes, which can indicate misconfigurations or unauthorized changes. Amazon GuardDuty continuously monitors for malicious activity using threat intelligence and anomaly detection. Option A is incorrect because Amazon Inspector is a vulnerability assessment service, not designed for ongoing threat detection. Option D is incorrect because VPC Flow Logs capture network traffic metadata but are not primarily for incident detection; they can aid network analysis but are not a direct detection service.

Answer

Run Amazon Inspector assessments.

Answer

Enable VPC Flow Logs for all VPCs.

Question 8

Which TWO AWS services can be used to centrally manage and enforce security policies across multiple AWS accounts? (Select TWO.)

Accepted Answer

AWS Organizations. Options B and E are correct. AWS Organizations allows you to centrally manage and enforce service control policies (SCPs) across multiple AWS accounts, providing governance and compliance. AWS Config enables you to create rules that evaluate resource configurations and enforce compliance across accounts, including multi-account aggregation. Option A (AWS CloudTrail) is for auditing API activity, not for enforcement. Option C (Amazon GuardDuty) is for threat detection, not policy enforcement. Option D (AWS IAM) is per-account and cannot centrally enforce policies across multiple accounts.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS IAM

Question 9

A security engineer notices that an IAM user has been performing suspicious actions in an AWS account. The engineer needs to generate a credential report to identify the age of the user's access keys. Which AWS CLI command should the engineer run?

Accepted Answer

aws iam generate-credential-report && aws iam get-credential-report. The engineer must first generate the credential report using 'aws iam generate-credential-report' and then retrieve it with 'aws iam get-credential-report'. The report contains the age of access keys. Option A is incorrect because 'get-account-authorization-details' retrieves information about account entities, not credential age. Option C is incorrect because 'generate-service-last-accessed-details' is used to find out which services an IAM entity has accessed, not key age. Option D is incorrect because 'list-access-keys' lists keys but does not provide the key age; the credential report includes creation dates.

Answer

aws iam get-account-authorization-details

Answer

aws iam generate-service-last-accessed-details

Answer

aws iam list-access-keys --user-name suspectUser

Question 10

A company wants to centrally manage and enforce security policies across all accounts in AWS Organizations. Which AWS service should be used to define and apply guardrails?

Accepted Answer

AWS Control Tower. (AWS Control Tower) is correct because it allows centralized management and enforcement of security policies across all accounts in an AWS Organization using guardrails. Option A (IAM Policy Simulator) is incorrect because it is used to test IAM policies, not enforce guardrails across accounts. Option C (AWS Shield) is incorrect as it provides DDoS protection. Option D (AWS Config) is incorrect because it is used for resource compliance and configuration tracking, not for centrally defining and applying guardrails.

Answer

IAM Policy Simulator

Answer

AWS Shield

Answer

AWS Config

Question 11

A security engineer is designing a solution to automatically remediate non-compliant resources in an AWS account. The engineer needs to trigger an AWS Lambda function when an EC2 instance is launched without the required tags. Which AWS service should be used to detect the non-compliant resource and invoke the Lambda function?

Accepted Answer

AWS Config. (AWS Config) is correct because AWS Config rules evaluate the compliance of AWS resources against desired configurations and can automatically trigger an AWS Lambda function for remediation when a resource is non-compliant (e.g., an EC2 instance launched without required tags). Option A (AWS CloudTrail) is incorrect as it records API activity but does not evaluate resource compliance or trigger remediation. Option C (Amazon GuardDuty) is incorrect as it is a threat detection service that identifies malicious activity, not compliance violations. Option D (AWS Systems Manager) is incorrect as it provides operational management capabilities like patching and automation, not compliance rule evaluation.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS Systems Manager

Question 12

A company's security team wants to receive alerts when an IAM user creates a new access key. Which AWS service can be used to monitor and notify on this specific API call?

Accepted Answer

AWS CloudTrail with Amazon CloudWatch Events. CloudTrail logs IAM CreateAccessKey events, and CloudWatch Events can trigger a notification. Option A is wrong because Trusted Advisor is for best practices. Option B is wrong because GuardDuty is for threat detection. Option D is wrong because AWS Config is for resource compliance.

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Answer

AWS Config

Question 13

A security engineer is designing a cross-account access policy. The engineer has an S3 bucket in Account A and wants to grant read access to a user in Account B. Which combination of policies is required?

Accepted Answer

A bucket policy in Account A allowing the user, and an IAM policy in Account B granting s3:GetObject.. Cross-account access to an S3 bucket requires both a resource-based policy (bucket policy) in Account A that grants permissions to the user in Account B, and an identity-based policy (IAM policy) in Account B that allows the user to perform the s3:GetObject action. Without both, access is denied. Option A is wrong because a bucket policy alone is insufficient; the user still needs an IAM policy in their own account to allow the action. Option B is wrong because bucket ACLs are a legacy mechanism and do not effectively support cross-account access for specific IAM users; they would still require an IAM policy in Account B. Option C is wrong because an IAM policy in Account B alone is insufficient; the bucket policy in Account A must explicitly grant access to the user, as the bucket's default policy denies access from other accounts.

Answer

A bucket policy in Account A that allows access to the user in Account B.

Answer

A bucket ACL in Account A granting access to the user in Account B.

Answer

An IAM policy in Account B that grants s3:GetObject to the bucket.

Question 14

An organization uses AWS Organizations and wants to restrict the use of specific EC2 instance types across all member accounts. Which policy type should be used to enforce this restriction?

Accepted Answer

Service control policy (SCP). Service control policies (SCPs) are used in AWS Organizations to centrally control permissions for all accounts in the organization. SCPs allow you to restrict the maximum permissions for member accounts, including denying specific EC2 instance types. Resource-based policies are attached to resources, not accounts, and cannot enforce account-wide restrictions. IAM policies are applied to users/roles but can be overridden by administrators unless bounded by SCPs. CloudFormation policies are for stack resources and do not apply across accounts.

Answer

Resource-based policy

Answer

IAM policy

Answer

AWS CloudFormation policy

Question 15

A company wants to log all API calls made in their AWS account for auditing. Which AWS service should be enabled to capture these logs?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls made in an AWS account for auditing. Option A is wrong because VPC Flow Logs capture IP traffic information, not API calls. Option B is wrong because Amazon CloudWatch Logs is used to store and monitor log files, not to capture API activity. Option C is wrong because Amazon S3 server access logs record requests made to an S3 bucket, not all API calls across the account.

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Answer

Amazon S3 server access logs