SCS-C02 Management and Security Governance Practice Test 5 — 15 Questions

Question 1

Which TWO AWS services can be used to enforce that Amazon S3 buckets are not publicly accessible? (Choose two.)

Accepted Answer

AWS Organizations service control policies (SCPs). AWS Organizations service control policies (SCPs) (C) are correct because they set the maximum permissions for accounts in an organization, so an SCP with s3:PutBucketPublicAccessBlock or conditions denying s3:PutBucketPolicy, s3:PutBucketAcl, and s3:DeletePublicAccessBlock can prevent principals in member accounts from making buckets public. AWS Config (E) is correct because its managed rule s3-bucket-public-read-prohibited and s3-bucket-public-write-prohibited continuously evaluate bucket ACLs and policies and flag or auto-remediate noncompliant public buckets. IAM Access Analyzer (A) only identifies and reports resources such as S3 buckets that are shared with external entities; it detects exposure but does not enforce or block public access. AWS CloudTrail (B) merely records API activity for auditing and does not prevent public bucket configurations. Amazon Macie (D) discovers and classifies sensitive data in S3 and alerts on risks, but it is a detection service, not an enforcement control.

Answer

IAM Access Analyzer

Answer

AWS CloudTrail

Answer

Amazon Macie

Question 2

The exhibit shows an SCP attached to an organizational unit. What is the effect of this policy?

Accepted Answer

It allows s3:PutBucketPolicy only if the bucket ACL is set to bucket-owner-full-control.. The SCP shown in the exhibit uses a Condition block that allows s3:PutBucketPolicy only when the request includes the s3:x-amz-acl condition key set to bucket-owner-full-control. This is a common pattern to enforce that cross-account bucket policy changes include the proper ACL, ensuring the bucket owner retains full control.

Answer

It denies all s3:PutBucketPolicy actions on all buckets.

Answer

It denies s3:PutBucketPolicy for any bucket that does not have an ACL.

Answer

It allows s3:PutBucketPolicy for buckets owned by the management account.

Question 3

The exhibit shows an S3 bucket policy. The security team wants to ensure that only users from account 123456789012 can access objects in the bucket. What is a potential security issue with this policy?

Accepted Answer

The policy grants access to all IAM users in the account, not just specific ones.. The policy uses a Principal of "123456789012" which effectively grants access to all IAM users and roles within that AWS account. This means any user in the account who has permission to call s3:GetObject can access the bucket objects, making it overly permissive. The correct answer is A because this is the security issue—no restriction to specific users or roles.

Answer

The policy does not restrict access to a specific VPC.

Answer

The policy uses a wildcard in the resource ARN.

Answer

The policy does not require MFA.

Question 4

A company uses AWS Organizations with multiple accounts. The security team needs to ensure that all S3 buckets across the organization are encrypted with AWS KMS keys. What is the MOST effective way to enforce this requirement?

Accepted Answer

Create a service control policy (SCP) that denies any S3 bucket creation or modification without encryption enabled.. Service control policies (SCPs) in AWS Organizations define the maximum permissions for accounts and can explicitly deny actions like s3:CreateBucket or s3:PutBucketEncryption when encryption is not enabled. Because SCPs are enforced at the organization level, they prevent non-compliant bucket creation or modification across all accounts, making this the most effective preventive control.

Answer

Use AWS CloudTrail to log all bucket creation events and alert the security team.

Answer

Create an IAM role in each account that denies s3:PutBucketEncryption if encryption is not set.

Answer

Use AWS Config rules to detect unencrypted buckets and trigger a Lambda function to encrypt them.

Question 5

A security team is reviewing IAM roles and policies. They want to ensure that any new IAM role created in the account must include a specific managed policy (e.g., SecurityAudit). What AWS service can enforce this requirement?

Accepted Answer

Service control policy (SCP) in AWS Organizations. AWS CloudTrail logs API calls but does not enforce policies. Option B is incorrect because AWS Config rules can detect noncompliant roles after creation but cannot prevent their creation. Option C is correct because Service Control Policies (SCPs) in AWS Organizations can deny the creation of IAM roles that do not have a specific managed policy attached, using a condition like `aws:RequestedManagedPolicy`. Option D is incorrect because IAM permissions boundaries limit the maximum permissions a role can have but do not enforce attachment of a specific managed policy.

Answer

AWS CloudTrail

Answer

AWS Config rules

Answer

IAM permissions boundary

Question 6

A security engineer needs to ensure that all EC2 instances launched in an account have a specific tag (e.g., CostCenter) applied. If an instance is launched without the tag, it should be automatically terminated. Which solution meets these requirements with minimal effort?

Accepted Answer

Use AWS Config rules with an automatic remediation action that invokes a Lambda function to terminate the instance.. AWS Config rules can evaluate whether EC2 instances have the required tag and trigger an automatic remediation action (via SSM Automation or Lambda) that terminates non-compliant instances. This is a fully managed, low-effort solution that both detects and enforces the tag requirement without custom event handling.

Answer

Use an SCP to deny ec2:RunInstances if the request does not include the required tag.

Answer

Use AWS Organizations Tag Policies to enforce the tag.

Answer

Use AWS CloudTrail to detect RunInstances events and send alerts to the security team.

Question 7

A security engineer is configuring AWS Config to track changes to security groups in a VPC. The engineer wants to be notified when a security group is modified. Which TWO steps are required to achieve this?

Accepted Answer

Configure an SNS topic and subscribe to it to receive notifications when the Config rule triggers.. Option D is correct because AWS Config requires a Config rule to evaluate resource changes; to detect security group modifications you create a rule (for example, using the managed rule or a custom rule) that monitors security group configuration changes and triggers when a change is recorded. Option A is correct because AWS Config rules alone do not send notifications; you must configure an Amazon SNS topic and subscribe to it (e.g., email, SMS, Lambda) so that Config can publish change notifications to that topic when the rule triggers. Option B is not required because CloudTrail logs API activity for auditing, but it does not itself evaluate resource configuration changes or send the desired Config-based notification. Option C is not required because GuardDuty is a threat detection service and does not monitor security group configuration changes for notification. Option E is not required because VPC Flow Logs capture IP traffic metadata, not security group configuration modifications.

Answer

Enable AWS CloudTrail to log security group changes.

Answer

Enable Amazon GuardDuty to detect security group modifications.

Answer

Enable VPC Flow Logs to capture security group activity.

Question 8

A company is implementing a data classification policy using AWS. The policy requires that all S3 objects containing personally identifiable information (PII) be automatically tagged and encrypted. Which THREE services should be used together to meet this requirement?

Accepted Answer

Amazon Macie. Options A, B, and D are correct. Option A: Amazon Macie can automatically discover and classify PII in S3. Option B: Amazon S3 default encryption ensures objects are encrypted. Option D: AWS Lambda can process Macie findings and apply tags. Option C is wrong because AWS Config does not classify data. Option E is wrong because CloudTrail is for logging.

Answer

AWS Config

Answer

AWS CloudTrail

Question 9

A company is using AWS Organizations to manage multiple accounts. The security team wants to ensure that no root user credentials are used for any account. Which TWO actions should be taken to enforce this?

Accepted Answer

Create a service control policy (SCP) that denies all actions for the root user.. Option D is correct because an SCP attached at the organization or OU level can include a statement with a Condition of aws:PrincipalArn matching the root user ARN (arn:aws:iam::<account-id>:root) and Effect: Deny on Action: *, which centrally blocks root credentials from performing any actions across all member accounts. Option E is correct because enabling MFA on the root user is an AWS best practice that adds a required second authentication factor, making root credential use significantly harder to abuse and aligning with the goal of preventing unauthorized root access. Option A is incorrect because the root user cannot be deleted from an AWS account; it exists permanently and can only be secured or have its credentials removed. Option B is incorrect because AWS Config rules are detective, not preventive—they only record and alert on root activity after it occurs. Option C is incorrect because IAM roles cannot override or restrict the account root user, which is not governed by IAM policies in the same way as regular principals.

Answer

Delete the root user from all accounts.

Answer

Use AWS Config rules to detect root user activity.

Answer

Create an IAM role that prevents root user actions.

Question 10

A security engineer has attached the above IAM policy to a user. The user reports that they cannot upload objects to the S3 bucket from their office, which has a public IP address of 198.51.100.50. What is the MOST likely reason for the failure?

Accepted Answer

The policy restricts access to the 10.0.0.0/8 IP range, but the user's IP is outside that range.. The policy likely includes a condition that restricts access to the 10.0.0.0/8 IP range, and the user's public IP 198.51.100.50 is outside that range, causing the denial. This is a common configuration to limit access to internal networks, but it blocks external users. The most likely reason is the IP restriction condition.

Answer

The policy does not specify the bucket resource for the PutObject action.

Answer

The policy is not attached to the user.

Answer

The policy does not allow the s3:PutObject action.

Question 11

A company is using AWS Organizations to manage multiple accounts. The security team needs to enforce that all newly created S3 buckets across the organization have server-side encryption (SSE-S3) enabled by default. Which solution is MOST operationally efficient?

Accepted Answer

Apply an SCP to the root organizational unit that denies s3:CreateBucket if the bucket lacks encryption settings.. Applying a Service Control Policy (SCP) to the root organizational unit that denies s3:CreateBucket if the bucket lacks encryption settings enforces the requirement centrally across all accounts. SCPs are the most operationally efficient because they provide a single point of control and automatically apply to all existing and new accounts in the organization. This prevents the creation of unencrypted buckets without needing per-account configuration or custom automation.

Answer

Create an AWS Lambda function that is triggered by S3 event notifications to enable encryption on any new bucket.

Answer

Set a default bucket encryption policy in each account’s S3 console.

Answer

Use AWS Config with a managed rule s3-bucket-server-side-encryption-enabled to trigger remediation.

Question 12

A security engineer is designing a solution to automatically remediate noncompliant EC2 security groups. The company uses AWS Organizations with multiple accounts. The engineer wants to deploy an AWS Config rule and a custom Lambda function in a central security account to evaluate and remediate security groups across all accounts. Which combination of steps is REQUIRED to allow the Lambda function to modify security groups in member accounts? (Choose TWO.)

Accepted Answer

Create an IAM role in each member account that allows the central security account to assume it.. Option A is correct because cross-account access requires a trust relationship: you must create an IAM role in each member account whose trust policy allows the central security account (or its Lambda execution role) to assume it, and that role must have permissions to modify security groups (ec2:AuthorizeSecurityGroupIngress, ec2:RevokeSecurityGroupIngress, etc.). Option C is correct because AWS Config remediation actions are what tie a Config rule to a remediation target; configuring the remediation action to invoke the Lambda function in the central account lets the central function receive the evaluation and perform remediation across accounts. Option B is not required and would actually contradict the design goal of a single central Lambda function, since StackSets would deploy the function into every member account. Option D is incorrect because Lambda resource-based policies grant invoke permissions to principals, not the cross-account permission to modify EC2 security groups in member accounts. Option E is incorrect because it describes a distributed per-account design, not the required central-account Lambda approach.

Answer

Use AWS CloudFormation StackSets to deploy the Lambda function to all member accounts.

Answer

Attach a resource-based policy to the Lambda function granting access to Config from all member accounts.

Answer

Create the Lambda function in each member account and configure Config rules in each account.

Question 13

A company wants to ensure that all IAM users in an account have multi-factor authentication (MFA) enabled. A security administrator needs to identify users who do not have MFA. Which AWS service should the administrator use?

Accepted Answer

IAM Credential Report. AWS IAM Credential Report lists all IAM users and their MFA status, providing a quick way to identify users without MFA. Option A (AWS CloudTrail) logs API events, not MFA status. Option B (IAM Access Analyzer) focuses on resource policies. Option D (AWS Config) can check compliance but requires a rule; the credential report is more direct.

Answer

AWS CloudTrail

Answer

IAM Access Analyzer

Answer

AWS Config

Question 14

A company uses AWS CloudFormation to deploy infrastructure. The security team requires that all CloudTrail trails be encrypted with a customer-managed KMS key. Which CloudFormation template snippet correctly enforces this requirement?

Accepted Answer

Trail with KMSKeyId set to 'arn:aws:kms:us-east-1:123456789012:key/abcd1234-...'. To enforce a customer-managed KMS key for CloudTrail encryption in CloudFormation, the KMSKeyId property must reference the actual customer-managed key — either its full ARN or key ID. The ARN 'arn:aws:kms:us-east-1:123456789012:key/abcd1234-...' uniquely identifies a customer-managed CMK in the account, satisfying the security team's requirement. AWS-managed keys and aliases do not meet the 'customer-managed' criterion.

Answer

Trail with KMSKeyId set to 'aws/cloudtrail'

Answer

Trail with KMSKeyId set to 'alias/my-cloudtrail-key'

Answer

Trail without KMSKeyId specified

Question 15

A company uses AWS Key Management Service (KMS) to encrypt data. The security team needs to ensure that KMS keys cannot be deleted accidentally. Which action should be taken?

Accepted Answer

Create an IAM policy that denies kms:ScheduleKeyDeletion for the key.. Creating an IAM policy that explicitly denies kms:ScheduleKeyDeletion for the specific KMS key prevents any principal (including administrators) from scheduling its deletion, unless they can modify the policy. This is the most direct and granular way to protect a key from accidental deletion. AWS KMS does not have a native 'deletion protection' toggle like some other services.

Answer

Apply an SCP that denies kms:ScheduleKeyDeletion for all accounts.

Answer

Enable automatic key rotation.

Answer

Enable deletion protection on the key.