SCS-C02 Management and Security Governance Practice Test 7 — 15 Questions

Question 1

Refer to the exhibit. A security engineer runs the get-trail-status command for a CloudTrail trail. The engineer notices that LatestCloudWatchLogsDeliveryTime is null. What does this indicate?

Accepted Answer

The trail is not configured to deliver logs to CloudWatch Logs.. Option A is correct because if CloudWatch Logs integration is not configured, that field is null. Option B is wrong because trail is logging. Option C is wrong because digest delivery is successful. Option D is wrong because delivery attempts succeeded.

Answer

The trail has stopped logging.

Answer

The trail is not delivering logs to S3.

Answer

The digest delivery has failed.

Question 2

Refer to the exhibit. A security engineer creates this IAM policy for a user. Which action can the user perform?

Accepted Answer

Decrypt KMS keys when the request originates from S3 in us-east-1.. Option B is correct because the policy allows decrypting KMS keys only when the request comes through S3. Option A is wrong because it requires S3 endpoint. Option C is wrong because the policy is limited to S3. Option D is wrong because there is no resource restriction.

Answer

Decrypt KMS keys only for resources in us-east-1.

Answer

Decrypt any KMS key from any service.

Answer

Decrypt only S3 objects.

Question 3

A company wants to enforce that all IAM users in an AWS account must have multi-factor authentication (MFA) enabled. Which AWS service can be used to automatically detect and remediate non-compliant users?

Accepted Answer

AWS Config. AWS Config can evaluate IAM user MFA status using a managed rule (iam-user-mfa-enabled) and trigger automatic remediation via Systems Manager Automation or Lambda.

Answer

AWS Trusted Advisor

Answer

AWS IAM Access Analyzer

Answer

AWS CloudTrail

Question 4

A security engineer needs to centrally manage and enforce security policies across multiple AWS accounts in an organization. Which AWS service should they use?

Accepted Answer

AWS Organizations with SCPs. AWS Organizations with Service Control Policies (SCPs) allows central policy management across accounts. Firewall Manager focuses on VPC security, not general policies.

Answer

AWS CloudFormation StackSets

Answer

AWS IAM

Answer

AWS Firewall Manager

Question 5

A company's security team discovers that an IAM role has been assumed from an unexpected external AWS account. Which AWS service can be used to analyze the trust policy and identify unintended access?

Accepted Answer

AWS IAM Access Analyzer. IAM Access Analyzer analyzes resource-based policies (including trust policies) to identify external access. It generates findings for roles, S3 buckets, etc.

Answer

AWS CloudTrail Insights

Answer

AWS Config

Answer

AWS Security Hub

Question 6

A company wants to automatically detect and notify about any S3 buckets that have public read access. Which combination of services should be used?

Accepted Answer

AWS Config and Amazon EventBridge. AWS Config can evaluate S3 bucket public access using managed rules, and Amazon EventBridge can trigger notifications via SNS.

Answer

AWS CloudTrail and AWS Lambda

Answer

AWS IAM Access Analyzer and Amazon CloudWatch

Answer

AWS Trusted Advisor and Amazon SES

Question 7

A security engineer needs to ensure that all new IAM users are created with a strong password policy enforced. Which action should be taken?

Accepted Answer

Set a custom IAM password policy in the account. IAM password policy is set at the account level and applies to all users. Custom password policies cannot be per-user; the account policy enforces strength for all.

Answer

Use AWS Config to automatically delete users with weak passwords

Answer

Create a Lambda function that checks password strength on user creation

Answer

Use AWS Secrets Manager to generate passwords

Question 8

A security team wants to audit all changes to IAM policies in the AWS account. Which AWS service should be used to track these changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records all API calls, including IAM policy changes. Config records resource configuration changes but CloudTrail provides detailed event history.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

AWS CloudWatch Logs

Question 9

A company uses AWS Organizations with multiple accounts. The security team needs to ensure that no account can disable Amazon GuardDuty. Which SCP should be applied?

Accepted Answer

Deny action: guardduty:StopMonitoringMembers. SCPs can deny specific actions. The correct SCP denies the StopMonitoringMember action for GuardDuty.

Answer

Deny action: guardduty:DisableGuardDuty

Answer

Deny action: guardduty:UpdateDetector

Answer

Deny action: guardduty:DeleteDetector

Question 10

A security engineer notices that an S3 bucket policy allows access to a principal from another AWS account. Which AWS feature can be used to check if this external access is intended?

Accepted Answer

AWS IAM Access Analyzer. IAM Access Analyzer generates findings for external access to S3 buckets. You can review and archive findings if intended.

Answer

AWS Trusted Advisor bucket permissions check

Answer

AWS Config rule s3-bucket-public-read-prohibited

Answer

AWS CloudTrail event history

Question 11

A company wants to run a security assessment that checks for vulnerabilities in an EC2 instance. Which AWS service should be used?

Accepted Answer

Amazon Inspector. Amazon Inspector automatically assesses EC2 instances for vulnerabilities and network exposure.

Answer

AWS WAF

Answer

Amazon GuardDuty

Answer

AWS Shield Advanced

Question 12

Which TWO actions should a security engineer take to ensure that an S3 bucket is not publicly accessible? (Choose two.)

Accepted Answer

Enable S3 Block Public Access at the account level. Block Public Access settings at bucket and account level prevent all public access. The other options are not correct because: ACLs can allow public access; CloudTrail does not block; Bucket policies are overridden by Block Public Access.

Answer

Enable AWS CloudTrail for the bucket

Answer

Remove all bucket ACLs

Answer

Set a bucket policy that denies all public access

Question 13

Which THREE AWS services can be used to detect and alert on suspicious API activity in an AWS account? (Choose three.)

Accepted Answer

AWS CloudTrail Insights. GuardDuty identifies threats, CloudTrail logs API calls (with Insights for anomalous activity), and Security Hub aggregates findings. Config evaluates configuration, not activity; Inspector scans for vulnerabilities.

Answer

Amazon Inspector

Answer

AWS Config

Question 14

Which TWO AWS services can be used to enforce that specific resource types (e.g., EC2 instances) are tagged with a 'CostCenter' tag? (Choose two.)

Accepted Answer

AWS Organizations tag policies. AWS Config can evaluate resource tagging and AWS Organizations can use tag policies. IAM is for permissions, not enforcement; CloudFormation can be used but not for existing resources; Service Catalog is for provisioning, not enforcement.

Answer

AWS Service Catalog

Answer

AWS CloudFormation

Answer

AWS IAM

Question 15

A company wants to enforce that all IAM users in its AWS account use multi-factor authentication (MFA) for console login. Which action should be taken to ensure compliance?

Accepted Answer

Create an IAM policy that denies access unless MFA is present and attach it to all IAM users.. Option A is correct because an IAM policy with a condition that checks 'aws:MultiFactorAuthPresent' can deny API actions if MFA is not used. Option B is wrong because AWS Organizations service control policies (SCPs) cannot enforce MFA at the user level. Option C is wrong because MFA is not enforced through a password policy. Option D is wrong because MFA is not enforced by enabling it on the root user.

Answer

Apply an SCP to the AWS account that mandates MFA for all users.

Answer

Enable MFA on the root user and share credentials with all users.

Answer

Configure the account password policy to require MFA.