SCS-C02 Management and Security Governance Practice Test 7 — 15 Questions

Question 1

Which THREE AWS services can be used to detect and alert on suspicious API activity in an AWS account? (Choose three.)

Accepted Answer

AWS CloudTrail Insights. GuardDuty identifies threats, CloudTrail logs API calls (with Insights for anomalous activity), and Security Hub aggregates findings. Config evaluates configuration, not activity; Inspector scans for vulnerabilities.

Answer

Amazon Inspector

Answer

AWS Config

Question 2

Which TWO AWS services can be used to enforce that specific resource types (e.g., EC2 instances) are tagged with a 'CostCenter' tag? (Choose two.)

Accepted Answer

AWS Organizations tag policies. AWS Config can evaluate resource tagging and AWS Organizations can use tag policies. IAM is for permissions, not enforcement; CloudFormation can be used but not for existing resources; Service Catalog is for provisioning, not enforcement.

Answer

AWS Service Catalog

Answer

AWS CloudFormation

Answer

AWS IAM

Question 3

A security engineer needs to ensure that an Amazon S3 bucket is not publicly accessible. Which AWS service can be used to continuously monitor and alert if the bucket becomes public?

Accepted Answer

AWS Config. (AWS Config) is correct because AWS Config has managed rules such as 's3-bucket-public-read-prohibited' and 's3-bucket-public-write-prohibited' that can evaluate S3 bucket policies and ACLs, continuously monitor configurations, and trigger alerts via Amazon SNS when a bucket becomes public. Option A (AWS CloudTrail) is wrong because CloudTrail records API calls but does not evaluate resource configurations. Option C (AWS Trusted Advisor) provides best-practice checks but does not offer continuous monitoring and alerting for configuration changes. Option D (Amazon GuardDuty) focuses on threat detection, not configuration compliance.

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Question 4

A company uses AWS Organizations with multiple accounts. The security team wants to prevent members of the 'Developers' group from modifying IAM roles in any account. What is the most effective way to enforce this restriction?

Accepted Answer

Apply a service control policy (SCP) that denies IAM role modification actions to all accounts in the organization.. A service control policy (SCP) applied to the organization root or to all accounts can deny IAM role modification actions (e.g., iam:CreateRole, iam:UpdateAssumeRolePolicy) for all principals in member accounts. SCPs are effective because they are applied at the organization level and cannot be overridden by account-level permissions, even for administrators. Option B is incorrect because an IAM policy attached to a group in the management account only affects users in that account, not users in member accounts. Option C is incorrect because AWS Config can detect changes but cannot prevent them; it only reacts after the fact. Option D is incorrect because a cross-account role defines permissions to access resources, not restrictions; it does not prevent users from modifying IAM roles in their own account.

Answer

Attach an IAM policy to the Developers group in the management account that denies IAM actions.

Answer

Use AWS Config to detect IAM role modifications and automatically revert them.

Answer

Create a cross-account role in each member account that denies IAM actions.

Question 5

A company requires that all Amazon EC2 instances be launched only with an approved Amazon Machine Image (AMI) that has been hardened by the security team. Which AWS service should be used to enforce this requirement?

Accepted Answer

AWS Config. AWS Config is correct because it can evaluate whether EC2 instances are launched from approved AMIs using managed rules (e.g., approved-amis-by-id) or custom Lambda rules, and it can automatically remediate noncompliant instances. Option B (EC2 Image Builder) builds and manages AMIs but does not enforce their usage. Option C (AWS Systems Manager Patch Manager) patches instances but does not control which AMIs are used. Option D (AWS Service Catalog) provides a product portfolio for launching instances but does not enforce the use of specific AMIs at launch.

Answer

EC2 Image Builder

Answer

AWS Systems Manager Patch Manager

Answer

AWS Service Catalog

Question 6

A security engineer needs to automate the response to an AWS CloudTrail log event that indicates a potential security threat. Which AWS service would be most appropriate to orchestrate the automated response?

Accepted Answer

AWS Step Functions. AWS Step Functions is a serverless orchestration service that coordinates multiple AWS services into workflows, ideal for automating responses to CloudTrail events. Option A (AWS Lambda) is incorrect because Lambda is a compute service that executes code but does not orchestrate complex workflows. Option B (Amazon SQS) is incorrect because SQS is a message queue service used for decoupling and buffering, not orchestration. Option D (Amazon EventBridge) is incorrect because EventBridge is an event bus that routes events but cannot orchestrate multi-step workflows itself.

Answer

AWS Lambda

Answer

Amazon Simple Queue Service (SQS)

Answer

Amazon EventBridge

Question 7

A company has an AWS account with a single VPC and multiple subnets. The security team wants to ensure that no network ACL (NACL) allows inbound SSH (port 22) from 0.0.0.0/0. Which AWS service can be used to detect and alert on such non-compliant NACLs?

Accepted Answer

AWS Config. AWS Config can evaluate network ACL (NACL) rules using managed rules or custom Lambda-backed rules to detect non-compliant inbound SSH from 0.0.0.0/0. Option A (Amazon Inspector) is a vulnerability assessment service for EC2, not for NACL evaluation. Option B (Amazon GuardDuty) is a threat detection service that monitors for malicious activity, not configuration compliance. Option D (AWS CloudTrail) logs API calls but does not evaluate resource configurations against rules. Therefore, AWS Config (Option C) is the correct service for this compliance check.

Answer

Amazon Inspector

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Question 8

A company needs to audit all changes to IAM policies in its AWS account. Which AWS service should be used to record the change history of IAM policies?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls, including IAM policy changes such as CreatePolicy, PutRolePolicy, and AttachRolePolicy, providing a complete audit trail of who made changes and when. Option A is wrong because Amazon CloudWatch Logs is used for storing and monitoring log data but does not automatically capture IAM API calls. Option B is wrong because Amazon GuardDuty is a threat detection service that does not log configuration changes. Option D is wrong because AWS Config records resource configurations and can track changes to IAM policies over time, but it does not provide the detailed API-level history that CloudTrail offers; CloudTrail is the primary service for auditing changes.

Answer

Amazon CloudWatch Logs

Answer

Amazon GuardDuty

Answer

AWS Config

Question 9

A security engineer needs to generate a report of all AWS Identity and Access Management (IAM) users who have not used their access keys in the last 90 days. Which AWS service can provide this information?

Accepted Answer

AWS IAM Credentials Report. AWS IAM Credentials Report provides a CSV file with details about IAM users, including last activity dates. Option B is wrong because AWS CloudTrail logs API calls but does not provide a summary report. Option C is wrong because Amazon GuardDuty does not track IAM key usage. Option D is wrong because AWS Config evaluates configurations, not usage.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS Config

Question 10

A company uses AWS Organizations and wants to restrict the AWS Regions in which resources can be created across all member accounts. Which mechanism should be used?

Accepted Answer

Apply a service control policy (SCP) that denies operations in unauthorized regions.. A service control policy (SCP) can be applied at the root, OU, or account level to centrally restrict allowed AWS Regions across all member accounts, and member account administrators cannot override SCPs. Option B is incorrect because VPC endpoints control network traffic to specific services, not region restrictions. Option C is incorrect because AWS Config rules are detective controls that can only trigger remediations after a resource is created, not prevent creation. Option D is incorrect because IAM policies attached to users can be modified by account administrators with sufficient permissions, making them less effective for central enforcement.

Answer

Use VPC endpoints to restrict API calls to specific regions.

Answer

Configure AWS Config rules to detect and delete resources in unauthorized regions.

Answer

Attach an IAM policy to each user that denies operations in unauthorized regions.

Question 11

A security engineer needs to implement a solution to detect and alert on suspicious API calls in an AWS account. Which TWO AWS services should be integrated to achieve this? (Choose two.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail records all API calls in the account, providing the necessary logs for detection. Amazon GuardDuty analyzes CloudTrail logs (among other data sources) and uses threat intelligence and machine learning to identify suspicious API activity, generating alerts. Together, these services meet the requirement. AWS Config evaluates resource configurations, not API call patterns. Amazon Inspector focuses on vulnerability assessments of EC2 instances. AWS Trusted Advisor provides best-practice recommendations, not real-time threat detection.

Answer

AWS Config

Answer

Amazon Inspector

Answer

AWS Trusted Advisor

Question 12

A company wants to centrally manage and enforce security policies across multiple AWS accounts using AWS Organizations. Which THREE actions should be taken? (Choose three.)

Accepted Answer

Enable all features in AWS Organizations and create service control policies (SCPs) to restrict actions.. Options B, C, and D are correct. Enabling all features in AWS Organizations and creating service control policies (SCPs) allows central enforcement of security policies across all accounts. Using AWS CloudTrail to log API calls in all accounts and delivering logs to a centralized S3 bucket provides auditing and monitoring. Creating IAM roles in member accounts that grant cross-account access from the management account enables secure management without using root users. Option A is incorrect because using the root user of each member account for administrative tasks violates security best practices and removes auditability. Option E is incorrect because disabling CloudTrail in member accounts removes auditing capabilities, which is contrary to the goal of centrally managing and enforcing security policies.

Answer

Use the root user of each member account for administrative tasks.

Answer

Disable CloudTrail in member accounts to reduce costs.

Question 13

A company needs to ensure that its S3 buckets are not publicly accessible. Which TWO AWS services can be used to detect and report on public S3 buckets? (Choose two.)

Accepted Answer

AWS Trusted Advisor. AWS Trusted Advisor (option B) checks S3 bucket permissions and reports any bucket that has open access policies, including public read or write access. AWS Config (option C) can evaluate S3 bucket policies against custom or managed rules (e.g., s3-bucket-public-read-prohibited, s3-bucket-public-write-prohibited) to detect noncompliant buckets and trigger remediation. Both services provide detection and reporting capabilities for public S3 buckets.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

Amazon Inspector

Question 14

A security engineer needs to audit all IAM role creations across an AWS account. Which AWS service should be used to log these API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls, including IAM role creation. Option A is wrong because Amazon GuardDuty focuses on threat detection, not API logging. Option B is wrong because AWS Config records resource configuration changes but not API call details. Option C is wrong because Amazon CloudWatch Logs stores logs but does not capture API calls directly.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 15

A company has a requirement that all access keys for IAM users must be rotated every 90 days. A security engineer needs to implement an automated solution to identify and disable keys that are older than 90 days. Which approach meets the requirement with the least operational overhead?

Accepted Answer

Use an AWS Config rule with auto-remediation to disable keys older than 90 days.. AWS Config has a managed rule 'access-keys-rotated' that checks key age and can trigger auto-remediation via a Systems Manager automation document to disable old keys. Option A is wrong because AWS Trusted Advisor only provides recommendations, not enforcement. Option B is wrong because CloudTrail does not enforce rotation. Option C is wrong because IAM Access Analyzer does not manage key rotation; it generates findings for unused access, not key age.

Answer

Use AWS Trusted Advisor to check key age and send notifications.

Answer

Use AWS CloudTrail to monitor CreateAccessKey events and trigger a Lambda function to check key age.

Answer

Use IAM Access Analyzer to generate findings for unused keys and manually disable them.