SCS-C02 Management and Security Governance Practice Test 5 — 15 Questions

Question 1

A company uses AWS Organizations and wants to restrict the use of specific AWS services in member accounts. For example, they want to block the use of Amazon Redshift. Which policy type should be used?

Accepted Answer

Service control policies (SCPs). Service control policies (SCPs) can deny access to services at the organization level. Option B is correct. Option A (IAM permissions boundaries) are per-entity. Option C (IAM policies) are per-identity. Option D (Resource-based policies) are per-resource.

Answer

IAM permissions boundaries

Answer

IAM identity-based policies

Answer

S3 bucket policies

Question 2

A security engineer needs to automatically detect and respond to unauthorized API calls in an AWS account. Which two services should be used together?

Accepted Answer

AWS CloudTrail and Amazon EventBridge. CloudTrail logs API calls, and CloudWatch Events (now Amazon EventBridge) can trigger automated responses. Option C is correct. Option A (Config + Lambda) is for configuration compliance. Option B (GuardDuty + SNS) is for threat detection alerting. Option D (Inspector + S3) is for vulnerability assessment.

Answer

Amazon GuardDuty and Amazon SNS

Answer

AWS Config and AWS Lambda

Answer

Amazon Inspector and Amazon S3

Question 3

Which TWO actions can be taken to enforce the principle of least privilege for IAM users in an AWS account? (Choose two.)

Accepted Answer

Use IAM roles with temporary credentials for access. Option A reduces excessive permissions; Option E provides temporary permissions. Option B (full admin) violates least privilege. Option C (SCP) is for accounts, not users. Option D (root user) is too permissive.

Answer

Grant full administrative access to all users to simplify management

Answer

Use service control policies (SCPs) to restrict user permissions

Answer

Use the root user for daily administrative tasks

Question 4

Which THREE are benefits of using AWS CloudTrail for security governance? (Choose three.)

Accepted Answer

Supports compliance audits by providing event history. CloudTrail logs API calls (A), helps with compliance (C), and enables security analysis (E). Option B is for CloudWatch Logs. Option D is for Config.

Answer

Enables real-time log analysis with Amazon CloudWatch Logs

Answer

Automatically remediates noncompliant resources

Question 5

Which TWO are valid methods to centrally manage multiple AWS accounts? (Choose two.)

Accepted Answer

AWS Control Tower. AWS Organizations (A) and AWS Control Tower (B) provide centralized management. Option C (IAM) is per-account. Option D (Cognito) is for external users. Option E (Service Catalog) is for product approval.

Answer

AWS IAM

Answer

AWS Service Catalog

Answer

Amazon Cognito

Question 6

A company requires that all IAM users in the Security team must use multi-factor authentication (MFA) to access the AWS Management Console. The company has enabled MFA for all users, but the Security team administrator reports that some users can still sign in without MFA. Which action should the administrator take to enforce MFA for all sign-ins?

Accepted Answer

Attach an IAM policy that denies all actions if 'aws:MultiFactorAuthPresent' is false.. Option D is correct because attaching an IAM policy that explicitly denies access unless MFA is present will enforce MFA for all actions, including console sign-in. Option A is wrong because the default condition key 'aws:MultiFactorAuthPresent' is not set to 'true' for console sign-in; it is only set for API calls. Option B is wrong because requiring MFA for programmatic access does not affect console sign-in. Option C is wrong because password policy cannot enforce MFA at sign-in.

Answer

Create a new IAM policy that requires MFA for programmatic access only.

Answer

Enable the 'aws:MultiFactorAuthPresent' condition in the IAM password policy.

Answer

Update the password policy to require MFA for all IAM users.

Question 7

A developer needs to grant an IAM user read-only access to an S3 bucket containing sensitive data. The bucket is encrypted with an AWS KMS customer managed key. Which set of permissions must be included in the IAM policy?

Accepted Answer

s3:GetObject, kms:Decrypt. Option B is correct because to read objects, the user needs both s3:GetObject and kms:Decrypt permissions. Option A is wrong because s3:ListBucket is not required for reading a specific object. Option C is wrong because kms:Encrypt is not needed for read-only. Option D is wrong because s3:GetObject is required.

Answer

s3:GetObject, kms:Encrypt

Answer

kms:Decrypt

Answer

s3:ListBucket, kms:Decrypt

Question 8

A company's Security team is using AWS Organizations with a consolidated billing account. The security team wants to ensure that all member accounts have AWS CloudTrail enabled and that logs are delivered to a central S3 bucket in the management account. Which combination of actions should the security team take? (Choose the best answer.)

Accepted Answer

Use an SCP to deny disabling CloudTrail and use CloudFormation StackSets to deploy CloudTrail in all accounts.. Option C is correct because using an SCP to deny disabling CloudTrail and a CloudFormation StackSet to deploy CloudTrail in each account ensures enforcement and deployment. Option A is wrong because relying on individual account owners is not automated. Option B is wrong because enabling CloudTrail only in the management account does not cover member accounts. Option D is wrong because Config rules do not prevent disabling of CloudTrail.

Answer

Use AWS Config rules to detect when CloudTrail is disabled.

Answer

Create a new IAM policy that requires each account owner to enable CloudTrail.

Answer

Enable CloudTrail in the management account only and use cross-account logging.

Question 9

A company uses AWS Organizations with multiple accounts. The security team wants to centrally manage IAM policies across all accounts. Which AWS feature should the team use to enforce permissions across member accounts?

Accepted Answer

Service Control Policies (SCPs). Option C is correct because SCPs allow central control over permissions for all accounts in an organization. Option A is wrong because IAM policies are per-account. Option B is wrong because AWS Config is for compliance monitoring, not enforcement. Option D is wrong because AWS CloudTrail is for auditing, not enforcement.

Answer

IAM roles with cross-account access

Answer

AWS Config rules

Answer

AWS CloudTrail trails

Question 10

A security engineer needs to grant an EC2 instance access to an S3 bucket without storing long-term credentials on the instance. Which approach should the engineer use?

Accepted Answer

Create an IAM role with the required permissions and attach it to the EC2 instance as an instance profile.. Option A is correct because an IAM role with an instance profile allows the EC2 instance to obtain temporary credentials. Option B is wrong because access keys are long-term credentials. Option C is wrong because storing keys in the AMI is insecure. Option D is wrong because an SCP is for organization-wide policies, not for individual EC2 instances.

Answer

Generate an access key and secret key for an IAM user and store them in the EC2 instance.

Answer

Use an SCP to allow the EC2 instance to access the S3 bucket.

Answer

Store the credentials in the AMI used to launch the instance.

Question 11

A company is using AWS Organizations with SCPs. The management account has an SCP that denies access to all EC2 actions. A developer in a member account tries to launch an EC2 instance but receives an authorization error. The developer has an IAM policy that allows ec2:RunInstances. What is the most likely cause of the error?

Accepted Answer

The SCP denies the action, overriding the IAM policy.. Option C is correct because SCPs take precedence over IAM policies; if an SCP denies an action, even if the IAM policy allows it, the action is denied. Option A is wrong because SCPs do not override IAM only; they are evaluated together. Option B is wrong because SCPs apply to all users in the account, including the root user. Option D is wrong because SCPs apply to all principals, not just the root.

Answer

The IAM policy does not include the ec2:RunInstances permission.

Answer

The IAM policy is applied before the SCP.

Answer

The SCP is applied only to the root user.

Question 12

A company wants to ensure that IAM users with console access have strong passwords. Which IAM password policy setting should the company configure to enforce the use of at least one uppercase letter?

Accepted Answer

RequireUppercaseCharacters. Option B is correct because 'RequireUppercaseCharacters' enforces uppercase letters. Option A is wrong because 'RequireNumbers' is for digits. Option C is wrong because 'RequireSymbols' is for special characters. Option D is wrong because 'MinimumPasswordLength' is about length, not character types.

Answer

MinimumPasswordLength

Answer

RequireNumbers

Answer

RequireSymbols

Question 13

A security engineer needs to audit all API calls made in an AWS account for the past 90 days. Which AWS service should the engineer use?

Accepted Answer

AWS CloudTrail. Option A is correct because CloudTrail logs API calls and can be configured to store logs for 90 days. Option B is wrong because CloudWatch Logs is for application logs, not API calls. Option C is wrong because S3 is storage, not an auditing service. Option D is wrong because Config is for resource configuration changes, not API calls.

Answer

Amazon S3 access logs

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 14

A company uses AWS KMS to encrypt sensitive data. The security team wants to ensure that KMS keys can only be used by specific IAM roles and that key usage is logged. Which combination of actions should the team take? (Choose the best answer.)

Accepted Answer

Configure the key policy to specify the IAM roles as key users and enable CloudTrail.. Option D is correct because key policies define who can use the key, and CloudTrail logs all KMS API calls. Option A is wrong because an SCP can only deny, not grant permissions. Option B is wrong because IAM policies alone are not enough; the key policy must allow IAM access. Option C is wrong because the key policy must specify the IAM roles.

Answer

Create an SCP to restrict KMS key usage and enable CloudWatch Logs.

Answer

Attach an IAM policy that allows kms:Encrypt and kms:Decrypt to the roles.

Answer

Configure the key policy to allow the root user and enable CloudTrail.

Question 15

Which TWO actions are best practices for securing an AWS account root user? (Select TWO.)

Accepted Answer

Create an IAM user with administrative privileges and use it instead of the root user.. Options A and D are correct. Enabling MFA on the root user adds an extra layer of security. Creating an IAM admin user and using it for daily tasks reduces root user usage. Option B is wrong because the root user should not be used for daily tasks. Option C is wrong because access keys should not be created for the root user; they are long-term credentials. Option E is wrong because the root user email should be monitored, but that is not a best practice for securing the root user itself.

Answer

Use the root user for everyday administrative tasks.

Answer

Create access keys for the root user.

Answer

Delete the root user to prevent unauthorized access.