SCS-C02 Management and Security Governance Practice Test 6 — 15 Questions

Question 1

A company uses AWS Organizations with a multi-account strategy. The security team wants to ensure that no EC2 instances are launched without an approved Amazon Machine Image (AMI) ID. Which approach should the team take to enforce this requirement across all accounts?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an SCP that denies ec2:RunInstances if the AMI ID is not in a specified list.. Service Control Policies (SCPs) in AWS Organizations can be used to enforce permissions across all accounts. An SCP that denies ec2:RunInstances unless the AMI ID is in an approved list will prevent any user or role in the organization from launching non-compliant instances. This is a preventive control that applies at the organization level.

Answer

Use AWS Config to detect EC2 instances with noncompliant AMI IDs and send notifications.

Answer

Create an IAM policy in each account that denies ec2:RunInstances unless the AMI ID is in an approved list.

Answer

Deploy a Lambda function that terminates any EC2 instance with a noncompliant AMI ID.

Question 2

A company is implementing a data retention policy for CloudTrail logs. The logs are stored in an S3 bucket. The policy requires that logs be retained for 7 years and then automatically deleted. Which TWO actions should the security engineer take to meet this requirement?

Accepted Answer

Enable S3 Object Lock in compliance mode on the bucket.. Option B is correct because S3 Object Lock in compliance mode prevents any user, including the root account, from deleting or overwriting the CloudTrail log objects for the duration of the retention period, which enforces the 7-year immutability requirement. Option E is correct because an S3 Lifecycle policy with an expiration of 2555 days (7 years × 365 days) automatically deletes the objects once the retention period elapses, satisfying the automatic deletion requirement. Option A is not appropriate because AWS Backup manages backups and recovery points, not the retention and deletion of existing S3 objects in place. Option C is wrong because a bucket policy denying s3:DeleteObject blocks deletion entirely and would prevent the required automatic deletion after 7 years. Option D is incorrect because versioning with deletion of noncurrent versions does not guarantee a fixed 7-year retention and does not by itself enforce immutability.

Answer

Use AWS Backup to manage retention and deletion.

Answer

Configure the S3 bucket policy to deny s3:DeleteObject actions for all principals.

Answer

Enable S3 Versioning and create a lifecycle policy to delete noncurrent versions.

Question 3

A company uses AWS Organizations with 50 accounts. The security team wants to centrally manage IAM roles that grant cross-account access to a central security account. Which THREE steps are required to set up this cross-account access?

Accepted Answer

Create an IAM role in each member account with a trust policy that allows the security account to assume the role.. The correct steps involve: (C) creating IAM roles in each member account with a trust policy that allows the security account to assume the role, (D) applying an SCP to member accounts that denies iam:PassRole for the roles to prevent users from modifying the trust policy, and (E) creating an IAM user or role in the security account with a policy that allows sts:AssumeRole to the member account roles. Option D is necessary to enforce that only the security account can assume the roles, and option E provides the entity in the security account that performs the role assumption. Option A is incorrect because IAM groups cannot be assigned to roles. Option B is incorrect because Access Analyzer is not used for cross-account role setup.

Answer

Create an IAM group in the security account with permissions to assume roles in member accounts.

Answer

Enable AWS Organizations trusted access with AWS IAM Access Analyzer.

Question 4

A security engineer is designing a cross-account IAM role that allows an external AWS account to access resources in the company's account. The external account's root user must not be able to delegate permissions to other users. Which trust policy condition should be included?

Accepted Answer

Condition: ArnLike aws:PrincipalArn. The trust policy condition 'ArnLike aws:PrincipalArn' restricts which principal ARNs can assume the role, allowing you to specify the exact IAM user or role ARN in the external account rather than the entire account. This prevents the external account's root user from assuming the role and delegating it to arbitrary users, because only the named principal ARN matches the condition. It is the standard mechanism for scoping cross-account role assumption to a specific identity.

Answer

Condition: StringEquals aws:PrincipalOrgID

Answer

Condition: Bool aws:PrincipalIsAWSService false

Answer

Condition: StringEquals aws:SourceAccount

Question 5

A company is using AWS CloudFormation to deploy infrastructure. The security team wants to enforce that all S3 buckets created by CloudFormation have encryption enabled. Which approach should be used to enforce this policy?

Accepted Answer

Use AWS CloudFormation Guard to validate templates. AWS CloudFormation Guard is a policy-as-code tool that validates CloudFormation templates against defined rules before deployment, ensuring that all S3 buckets have encryption enabled. It integrates into CI/CD pipelines to enforce compliance at template level.

Answer

Use AWS Service Catalog to enforce encryption

Answer

Enable AWS CloudTrail to detect unencrypted buckets

Answer

Create an SCP to deny creation of unencrypted S3 buckets

Question 6

A company is using AWS Config to evaluate resource compliance. They need to ensure that all EC2 instances have a specific tag key 'Environment' with a value of 'Production' or 'Development'. Which type of AWS Config rule should be used?

Accepted Answer

Custom AWS Config rule using AWS Lambda. AWS Config managed rule 'required-tags' checks whether resources have the specified tag keys, but it does not validate tag values. To enforce both key and value, a custom AWS Config rule using AWS Lambda is needed, as it allows custom logic to check the exact tag key and value.

Answer

Custom AWS Config rule written in Python

Answer

AWS Config managed rule 'ec2-instance-tags'

Answer

AWS Config managed rule 'required-tags'

Question 7

A company needs to grant an IAM user permissions to start and stop specific EC2 instances. Which IAM policy element should be used to restrict actions to specific instances?

Accepted Answer

Condition. (Resource) is incorrect because while the Resource element can specify instance ARNs, it does not allow dynamic filtering based on tags. Option B (Condition) is correct because the Condition element can use the 'ec2:ResourceTag' condition key to restrict actions to instances with specific tags. Option C (Principal) is incorrect because the Principal element specifies who is allowed to perform actions, not the resources. Option D (NotAction) is incorrect because NotAction is used to exclude specific actions from a policy, not to limit actions to specific resources.

Answer

Resource

Answer

Principal

Answer

NotAction

Question 8

Refer to the exhibit. A security engineer runs the CLI command to determine if the IAM user 'testuser' created a key pair in January 2023. The output shows one event. What can be concluded from this output?

Accepted Answer

The user 'testuser' created the key pair 'my-key-pair' on January 15, 2023.. The CLI command likely used AWS CloudTrail to look up events, and the output shows an event where 'testuser' created a key pair named 'my-key-pair' on January 15, 2023. This directly indicates that the user performed the CreateKeyPair action on that date, confirming the key pair creation.

Answer

The key pair 'my-key-pair' was created in a different AWS account.

Answer

The user 'testuser' performed all actions in January 2023.

Answer

The user 'testuser' performed a read-only operation.

Question 9

A security engineer notices that an IAM user has permissions to launch EC2 instances but the engineer wants to ensure that all new instances are automatically tagged with the creator's user name. What is the most efficient way to enforce this?

Accepted Answer

Add an IAM policy to the user that uses a condition key 'aws:RequestTag/Creator' with a value '${aws:username}'.. Using an IAM policy with a condition key 'aws:RequestTag/Creator' set to '${aws:username}' ensures that any EC2 RunInstances request must include the tag 'Creator' with the IAM user's name, otherwise the request is denied. This enforces tagging at the time of instance creation. Option A (CloudTrail) only provides auditing, not enforcement. Option C (AWS Config rules) can detect and remediate after creation but is less efficient than proactive enforcement. Option D (SCP) can deny based on missing tags but cannot enforce the tag value to match the user name; also, SCPs are used for account-wide policies, not per-user.

Answer

Use AWS CloudTrail to monitor and alert on untagged instances.

Answer

Use AWS Config rules to automatically tag resources after creation.

Answer

Create an SCP that denies EC2:RunInstances unless the request includes a 'Creator' tag with the user name.

Question 10

An organization uses AWS Organizations with multiple OUs. The security team wants to ensure that any new account created in the 'Production' OU automatically gets a set of mandatory tags (CostCenter, Environment) and that these tags cannot be removed. What is the most effective approach?

Accepted Answer

Apply an SCP that denies changes to the specified tags for all accounts in the Production OU.. An SCP can be applied to the Production OU in AWS Organizations to deny actions that modify the specified tags (using the aws:TagKeys condition key). This prevents removal or modification of CostCenter and Environment tags. Option A is wrong because AWS Service Catalog can provision resources but does not enforce tag immutability across accounts. Option B is wrong because AWS Config rules are detective, not preventive. Option C is wrong because IAM policies in each account are less centralized and harder to manage; SCPs provide a central control.

Answer

Use AWS Service Catalog to provision accounts with pre-defined tags.

Answer

Use AWS Config rules to detect untagged resources and send alerts.

Answer

Create an IAM policy in each account that prohibits tag removal.

Question 11

A company wants to centrally manage and enforce encryption on all EBS volumes across multiple AWS accounts. Which AWS service can be used to define and enforce encryption policies at the organizational level?

Accepted Answer

AWS Organizations. AWS Organizations allows you to centrally define and enforce policies across multiple AWS accounts using Service Control Policies (SCPs). SCPs can be attached to the organization root, OUs, or individual accounts to restrict permissions, including requiring encryption for EBS volumes. By creating an SCP that denies the ec2:CreateVolume action unless the request includes encryption, you can enforce encryption organization-wide. This is the only option that provides centralized, multi-account policy enforcement at the organizational level.

Answer

AWS Config

Answer

AWS IAM

Answer

AWS Key Management Service (KMS)

Question 12

A security engineer is designing a solution to detect and alert on any S3 bucket that is publicly accessible. Which THREE services can be used together to achieve this?

Accepted Answer

AWS Security Hub. AWS Config is correct because it continuously records S3 bucket configuration changes and can evaluate them against managed rules such as s3-bucket-public-read-prohibited and s3-bucket-public-write-prohibited, which detect publicly accessible buckets and trigger remediation or alerts. AWS Security Hub is correct because it aggregates and surfaces findings from AWS Config and other services (via the AWS Foundational Security Best Practices and CIS standards, which include S3 public access controls) so the engineer gets centralized detection and alerting on publicly accessible buckets. AWS CloudTrail is correct because it logs the S3 API calls (for example PutBucketAcl, PutBucketPolicy, and DeletePublicAccessBlock) that make a bucket public, providing the event-level audit trail needed to detect and alert on the change that caused public accessibility. Amazon S3 Block Public Access settings are not a detection or alerting service; they are preventive controls that block public access rather than detect and notify about it. Amazon VPC Flow Logs capture IP traffic metadata for network interfaces in a VPC and have no visibility into S3 bucket policies or ACLs, so they cannot detect publicly accessible buckets.

Answer

Amazon S3 Block Public Access settings

Answer

Amazon VPC Flow Logs

Question 13

A security engineer is reviewing an SCP that denies access to a specific AWS service. The engineer notices that the SCP has an Effect of 'Deny' for 's3:PutObject' but the condition block uses 'StringEquals' with 'aws:SourceIp' set to an IP range. Users in the account are still able to upload objects to S3 from IP addresses outside the range. What is the most likely reason?

Accepted Answer

The SCP condition key 'aws:SourceIp' is not available for use in SCPs; SCPs only support condition keys that are global and listed in the AWS Global Condition Context Keys documentation for SCPs.. SCPs do not support the 'aws:SourceIp' condition key because it is not a global condition key listed in the AWS Global Condition Context Keys documentation for SCPs. SCPs only support condition keys that are global and applicable to all services. Therefore, the condition block in the SCP is ignored, and the 'Deny' effect does not apply, allowing users to upload objects from any IP. Option A is incorrect because SCPs do support conditions, but only specific global condition keys. Option B is incorrect because SCPs apply to all principals in the account, including IAM users, groups, and roles. Option D is incorrect because SCPs are evaluated before IAM policies and can deny actions regardless of IAM permissions.

Answer

The SCP condition key 'aws:SourceIp' is not supported for SCPs; SCPs only support conditions that are resource-based.

Answer

The SCP only applies to IAM users and groups, not to the root user.

Answer

The SCP is evaluated after IAM policies, so an IAM policy allowing the action overrides the SCP.

Question 14

A security engineer creates the IAM policy shown in the exhibit. The policy is attached to an IAM role. When a user assumes the role and attempts to upload an object to the bucket without specifying server-side encryption, what is the expected behavior?

Accepted Answer

The request is denied because the condition is not met.. The IAM policy uses a condition (likely aws:RequestedRegion or s3:x-amz-server-side-encryption) that must be satisfied for the PutObject action to be allowed. When the user uploads without specifying server-side encryption, the condition evaluates to false, so the explicit Deny or the absence of an Allow causes the request to be denied. IAM policies are deny-by-default, and a condition that isn't met means the statement doesn't apply, resulting in an implicit deny.

Answer

The request succeeds because the condition is ignored for PutObject.

Answer

The request is denied only if the object is publicly accessible.

Answer

The request succeeds because the condition is only for GetObject.

Question 15

Which TWO AWS services can be used to automatically enforce policies on resources at the time of creation? (Choose two.)

Accepted Answer

AWS Service Catalog. Options D and E are correct. AWS Service Catalog allows you to create and manage pre-approved portfolios of resources, enforcing policies through templates at the time of creation. AWS Config with automatic remediation can evaluate resources against desired configurations and automatically remediate non-compliant resources after creation, effectively enforcing policies upon creation when integrated with AWS Config rules. Option A (AWS KMS) is for managing encryption keys, not policy enforcement. Option B (AWS CloudTrail) is for logging API activity, not enforcing policies. Option C (AWS IAM) manages permissions but does not automatically enforce policies on resources at creation; it controls who can create resources but not the resource configuration itself.

Answer

AWS Key Management Service (KMS)

Answer

AWS CloudTrail

Answer

AWS IAM