SCS-C02 Management and Security Governance Practice Test 6 — 15 Questions

Question 1

Match each AWS VPC flow log type to its description.

Accepted Answer

VPC flow logs: Captures network traffic to and from all network interfaces in a VPC. AWS VPC flow logs can be created at three levels: VPC (captures traffic for all interfaces in the VPC), subnet (captures traffic for interfaces in a specific subnet), and ENI (captures traffic for a single elastic network interface). Common confusions include mistaking the scope of each log type.

Answer

VPC flow logs: Captures network traffic for a specific subnet only

Answer

Subnet flow logs: Captures network traffic for a specific ENI only

Question 2

A company uses AWS Organizations to manage multiple accounts. The security team needs to enforce that all S3 buckets across the organization have block public access enabled. Which policy should be used?

Accepted Answer

Create a service control policy (SCP) that denies s3:PutBucketPublicAccessBlock for all accounts.. A service control policy (SCP) can be applied at the organizational level to deny the s3:PutBucketPublicAccessBlock action, effectively preventing any account from disabling block public access on S3 buckets. Option A is incorrect because bucket policies are per-bucket and would need to be applied individually, which is not scalable for an organization with many buckets. Option C is incorrect because IAM policies apply to users and roles, not accounts, and cannot enforce settings at the account or organizational level. Option D is incorrect because CloudFormation StackSets deploy resources but do not enforce policies across existing buckets.

Answer

Configure a bucket policy on each S3 bucket to deny public access.

Answer

Apply an IAM policy to the root user of each account.

Answer

Use AWS CloudFormation StackSets to deploy a bucket with public access blocked.

Question 3

A security engineer notices that an IAM role in the production account is being assumed by a user from another AWS account, which violates the principle of least privilege. The role's trust policy allows the root user of the external account. What is the MOST secure way to restrict access to only a specific user in the external account?

Accepted Answer

Modify the trust policy to specify the exact user ARN instead of the root ARN.. Modifying the trust policy to include the specific user ARN is the most direct and secure approach. Option A is incorrect because SCPs do not affect cross-account access. Option B is incorrect because IAM policies on the role do not restrict who can assume it. Option D is incorrect because the external account's IAM policies do not control trust.

Answer

Apply an SCP to the external account to deny the sts:AssumeRole action.

Answer

Create an IAM policy in the external account that denies sts:AssumeRole for the role.

Answer

Add a condition to the role's permissions policy requiring a specific source IP.

Question 4

A company wants to automatically detect and remediate S3 buckets that are publicly accessible. Which AWS service can be used to evaluate bucket policies against a defined rule and trigger an automated response?

Accepted Answer

AWS Config. AWS Config rules can evaluate S3 bucket policies against defined rules and trigger automated remediation actions. Option A is incorrect because Amazon GuardDuty is a threat detection service, not for evaluating bucket policies. Option B is incorrect because AWS CloudTrail is for auditing API calls, not real-time resource evaluation. Option C is incorrect because Amazon Inspector is for vulnerability assessment on EC2 instances, not S3 bucket policies.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

Amazon Inspector

Question 5

A company's security team needs to enforce encryption at rest for all RDS instances in the production account. They have enabled mandatory encryption using a service control policy. What else must be done to ensure existing unencrypted RDS instances are encrypted?

Accepted Answer

Create a snapshot of the unencrypted instance, copy the snapshot with encryption enabled, and restore the encrypted snapshot to a new DB instance.. RDS does not support directly enabling encryption on an existing unencrypted instance. The only way to encrypt an existing unencrypted RDS instance is to take a snapshot of it, copy the snapshot with encryption enabled, and restore the encrypted snapshot to a new DB instance. Options A, C, and D are incorrect: A: Attaching a new KMS key policy to the RDS instance does not encrypt the instance; encryption is applied at snapshot creation. C: Enabling encryption on the DB subnet group does not affect existing instances; it only applies to new instances. D: Modifying the RDS instance via the console does not allow enabling encryption on an existing instance; encryption can only be enabled at creation or via snapshot copy.

Answer

Attach a new KMS key policy to the RDS instance.

Answer

Enable encryption on the DB subnet group and reboot the instance.

Answer

Modify the RDS instance to enable encryption using the AWS Console.

Question 6

A company needs to audit all changes to IAM policies in their AWS account for compliance. Which AWS service should be enabled to record the API calls that modify IAM policies?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls, including IAM policy changes. Option A is incorrect because CloudWatch Logs stores logs but does not capture API calls directly. Option B is incorrect because AWS Config records resource configurations but not API call history. Option D is incorrect because VPC Flow Logs capture network traffic, not API calls.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

VPC Flow Logs

Question 7

A security engineer notices that an S3 bucket contains objects that are accessible to authenticated users from other AWS accounts. The bucket policy allows access to the 'aws:SourceArn' condition that references an Amazon Resource Name (ARN) from another account. What is the MOST effective way to restrict access to only users from the company's own account?

Accepted Answer

Add a condition using 'aws:SourceAccount' with the company's account ID.. Using the 'aws:SourceAccount' condition key with the company's account ID ensures that only requests originating from that account are allowed, effectively blocking cross-account access from other accounts. Option A is incorrect because SCPs apply to principals within the organization and cannot restrict access from external accounts ('aws:SourceAccount' is not evaluated for SCPs). Option B is incorrect because simply removing the bucket policy would break all cross-account access but also removes any existing policy-based permissions within the account; adding IAM policies alone does not grant cross-account access and may not be the most effective solution. Option C is incorrect because 'aws:SourceArn' is typically used for service-to-service access (e.g., SNS to S3) and does not reliably restrict by account; the proper condition key for account-level restriction is 'aws:SourceAccount'.

Answer

Apply an SCP to deny s3:GetObject for any principal outside the organization.

Answer

Remove the bucket policy and add an IAM policy to the company's users.

Answer

Modify the condition to use 'aws:SourceArn' with an ARN from the company's account.

Question 8

A company's security team is implementing a data classification policy for S3 objects using S3 Object Tags. They need to ensure that any object uploaded without the required 'classification' tag is automatically denied. Which S3 bucket policy condition should be used?

Accepted Answer

aws:RequestTag. Aws:RequestTag. This condition key checks the tags provided in the request. To deny uploads that lack the required 'classification' tag, use a Deny effect with 'StringNotEquals' on 'aws:RequestTag/classification'. Option B (s3:ExistingObjectTag) checks tags already stored on the object, which does not apply at upload time because the object does not yet exist. s3:ExistingObjectTag is used for subsequent access controls, not for enforcing tagging during upload.

Answer

s3:x-amz-tagging-directive

Answer

s3:ExistingObjectTag

Answer

s3:object-lock-mode

Question 9

A company uses AWS Organizations and wants to ensure that no member account can disable AWS CloudTrail or delete CloudTrail log files from S3. Which TWO actions should the security team take? (Choose TWO.)

Accepted Answer

Create an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail.. Options A and D are correct. A service control policy (SCP) applied to member accounts can deny the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions, preventing accounts from disabling or deleting trails. Adding an S3 bucket policy that denies s3:DeleteObject for the CloudTrail log bucket protects the log files from deletion by any principal, including the bucket owner. Option B is incorrect because MFA delete is an S3 feature but does not prevent deletion by CloudTrail or SCPs; it only adds an extra authentication requirement for versioned objects. Option C is incorrect because SCPs cannot be applied to the management account—the management account is not affected by SCPs, so this would not protect member accounts. Option E is incorrect because an IAM role for CloudTrail does not prevent other principals from deleting logs; it only controls CloudTrail's own permissions.

Answer

Enable MFA delete on the S3 bucket that stores CloudTrail logs.

Answer

Apply an SCP to the management account to prevent disabling CloudTrail.

Answer

Create an IAM role for CloudTrail with permissions to write logs only.

Question 10

A security team needs to ensure that all IAM users in a production account use multi-factor authentication (MFA) before accessing the AWS Management Console. Which TWO steps should be taken? (Choose TWO.)

Accepted Answer

Enable MFA for each IAM user.. To enforce MFA for console access, you need to enable MFA for each user (B) and attach an IAM policy that denies console access if MFA is not present (C). Option E is incorrect because the IAM password policy cannot require MFA; it only requires MFA for password changes, not console login. Option A is incorrect because AWS Config rules can detect users without MFA but cannot enforce it. Option D is incorrect because SCPs apply to accounts, not individual user console access; they cannot directly require MFA for console login.

Answer

Use AWS Config rules to detect users without MFA.

Answer

Apply an SCP that requires MFA for console access.

Answer

Configure an IAM password policy to require MFA.

Question 11

A company uses AWS KMS to encrypt sensitive data. The security team needs to ensure that KMS keys cannot be deleted accidentally. Which TWO actions should be taken? (Choose TWO.)

Accepted Answer

Attach an SCP that denies kms:ScheduleKeyDeletion for all accounts.. Options A and D are correct. Attaching a service control policy (SCP) that denies kms:ScheduleKeyDeletion at the organizational level (A) and modifying the key policy to deny kms:ScheduleKeyDeletion for all principals (D) are both preventive controls that protect KMS keys from accidental deletion. Option B (CloudTrail) is detective, not preventive. Option C (key rotation) does not affect deletion permissions. Option E (disabling the key) prevents usage but does not prevent deletion; the key can still be deleted while disabled.

Answer

Enable CloudTrail to log key deletion events.

Answer

Enable automatic key rotation.

Answer

Disable the key to prevent usage.

Question 12

An IAM policy is used to grant access to an S3 bucket. The policy condition requires that objects be retrieved using AES256 encryption. However, users can still download objects without specifying encryption. What is the MOST likely reason?

Accepted Answer

The condition key 's3:x-amz-server-side-encryption' applies only to PUT requests, not GET requests.. The condition key 's3:x-amz-server-side-encryption' is a request header that is only applicable to PUT requests (uploads) when setting server-side encryption. For GET requests (downloads), the 's3:x-amz-server-side-encryption' header is not used; instead, the condition 's3:x-amz-server-side-encryption-customer-algorithm' would apply for customer-provided encryption keys. Therefore, the policy condition does not affect GET requests, allowing users to download objects without specifying encryption. Options B, C, and D are incorrect: B is wrong because the resource ARN with '/*' is correct for granting access to objects; C is wrong because using 'Null' would not solve the issue; D is wrong because 'aws:SecureTransport' enforces HTTPS, not encryption.

Answer

The resource ARN should include the bucket name without the '/*' suffix.

Answer

The condition should use 'Null' instead of 'StringEquals'.

Answer

The condition should use 'aws:SecureTransport' instead.

Question 13

A security engineer is reviewing the CloudTrail configuration for a trail named 'management-trail'. The engineer needs to ensure that all S3 object-level operations in the bucket 'my-bucket' are logged. What is the issue with the current configuration?

Accepted Answer

The 'Values' field should end with a '/*' to capture all objects under the prefix.. The 'DataResources' value should include a trailing '/*' to indicate all objects under the prefix. Option A is incorrect because the ReadWriteType is 'All', which covers both read and write. Option C is incorrect because the event selector includes management events. Option D is incorrect because the trail is not necessarily multi-region from this output.

Answer

The ReadWriteType is set to 'All', which does not include write events.

Answer

The IncludeManagementEvents should be set to false to focus on data events.

Answer

The trail should be configured as a multi-region trail to capture all regions.

Question 14

An S3 bucket policy is created as shown. What is the effect of this policy?

Accepted Answer

It denies all requests that are not made over HTTPS.. The policy denies all S3 actions if the request does not use HTTPS (SecureTransport is false). Therefore, the effect is to deny any request that is not made over HTTPS. The correct answer is B. Option A is incorrect because the policy does not block all access; it only blocks non-HTTPS requests. Option C is incorrect because the policy does not allow anonymous access; it only restricts the protocol. Option D is incorrect because the policy does not enforce server-side encryption; it only enforces HTTPS.

Answer

It blocks all access to the bucket.

Answer

It allows anonymous access to the bucket over HTTPS.

Answer

It requires server-side encryption for all objects.

Question 15

A company uses AWS Organizations with multiple accounts. The security team needs to ensure that no account can disable a specific security service, such as AWS Config, across all accounts. Which approach should be used?

Accepted Answer

Attach a service control policy (SCP) that denies the action at the root organization level. A service control policy (SCP) can deny actions across all accounts in an organization. Option C is correct because an SCP with a Deny effect on config:StopConfigurationRecorder prevents disabling. Option A is wrong because IAM roles do not apply to the root user and are not organization-wide. Option B is wrong because Config rules can detect non-compliance but do not prevent the action. Option D is wrong because CloudTrail logs actions and can alert but does not prevent them.

Answer

Create an IAM role with a deny policy for the action and attach it to all users

Answer

Create an AWS Config rule to check for the action and automatically remediate

Answer

Enable AWS CloudTrail and create a metric filter to alert on the action