SCS-C02 Management and Security Governance Practice Test 7 — 15 Questions

Question 1

A company is using AWS Organizations with a management account and several member accounts. The security team has created an SCP that denies access to all actions for the 'ec2:*' service unless the request comes from a specific VPC endpoint. The SCP is attached to the organization root. However, users in a member account are still able to launch EC2 instances from the AWS Management Console, which does not use a VPC endpoint. The SCP is as follows:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": "ec2:*",
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "aws:sourceVpce": "vpce-12345678"
        }
      }
    }
  ]
}

What is the most likely reason the SCP is not preventing the users from launching instances?

Accepted Answer

The condition key 'aws:sourceVpce' is not present in requests from the AWS Management Console.. The condition key 'aws:sourceVpce' is supported in SCPs. However, requests from the AWS Management Console do not include this condition key. In SCPs, when the 'aws:sourceVpce' key is absent, the 'StringNotEquals' condition operator evaluates to false, causing the Deny statement to not apply. Therefore, the SCP fails to block actions from the console because the condition does not match. Option C correctly identifies this as the reason the SCP is not preventing users from launching instances. Options A, B, and D are incorrect: A) SCPs do apply to the root user in member accounts; B) SCPs attached to the organization root apply to all member accounts; D) the users are in a member account, and management account SCP behavior is irrelevant here.

Answer

The SCP is not applied to the root user in the member account.

Answer

The SCP is attached to the organization root but not to the member account.

Answer

The management account is not affected by SCPs, and the users are using the management account.

Question 2

A company has a single AWS account with several IAM users. The security team wants to ensure that all IAM users have strong passwords and that passwords are rotated every 90 days. The team also wants to receive a notification if any user's password is older than 90 days. The team has enabled an IAM password policy that requires strong passwords and sets a maximum password age of 90 days. However, they are not receiving notifications about expired passwords. Which additional step should the security team take to receive notifications?

Accepted Answer

Create an AWS Config rule that checks the password policy and triggers an SNS notification.. AWS Config can evaluate IAM user password age using a custom rule and trigger an SNS notification when a user's password exceeds 90 days. Option B is incorrect because IAM does not have a feature to automatically email when passwords expire; the password policy only applies during login. Option C is incorrect because CloudTrail logs API calls but does not evaluate password age; CloudWatch Events would need to be combined with a custom solution to check password age. Option D is incorrect because AWS Trusted Advisor checks the overall password policy but does not monitor individual user password age or send notifications.

Answer

Configure IAM to automatically send an email when a password expires.

Answer

Enable AWS CloudTrail to log password changes and use Amazon CloudWatch Events to monitor.

Answer

Use AWS Trusted Advisor to check password policy and send notifications.

Question 3

A company has an AWS environment with multiple accounts managed under AWS Organizations. The security team wants to enforce that all newly created S3 buckets in any account have encryption enabled by default. Which approach should the security team take?

Accepted Answer

Create a Service Control Policy (SCP) that denies the creation of S3 buckets without encryption.. SCPs in AWS Organizations set the maximum available permissions for all accounts in the organization, and they can explicitly deny actions like s3:CreateBucket or s3:PutBucketEncryption when the request lacks the required encryption headers. Because SCPs are evaluated at the Organizations level before IAM policies, they provide a preventive, centralized guardrail that applies to every account, including newly created ones. This is the only option that enforces encryption at creation time across all accounts rather than detecting or defaulting after the fact.

Answer

Use AWS Config rules to detect unencrypted buckets and send alerts.

Answer

Enable S3 default encryption in each account's S3 settings.

Answer

Apply an IAM policy to the root user of each account to enforce bucket encryption.

Question 4

A security engineer is troubleshooting a situation where an IAM user is unable to assume a role in a different account. The trust policy of the role allows the user's account to assume the role, and the user has permissions to call AssumeRole. However, the user receives an 'AccessDenied' error. What is the most likely cause?

Accepted Answer

The user's IAM policy does not grant sts:AssumeRole for the target role.. The user's IAM permissions must explicitly allow the sts:AssumeRole action for the specific role ARN. Option A is wrong because the error would be different if the role did not exist. Option C is wrong because SCPs apply to all principals in the account, but the user already has a policy allowing AssumeRole. Option D is wrong because MFA would result in a different error message.

Answer

The role ARN is incorrect.

Answer

An SCP in the user's account denies sts:AssumeRole.

Answer

The role requires MFA and the user has not authenticated with MFA.

Question 5

A company has a security policy that requires all IAM users to use multi-factor authentication (MFA) when accessing the AWS Management Console. The company also wants to enforce this policy using an SCP. Which TWO conditions must be met for the SCP to be effective?

Accepted Answer

The SCP must use a condition that checks if MFA is present.. Option A is correct because an SCP enforces MFA by including a condition such as "aws:MultiFactorAuthPresent": "true" (or "false" with a Deny) in its policy statement, which is the mechanism that actually checks whether the principal authenticated with MFA. Option D is correct because SCPs are attached to organizations, OUs, or accounts—not to IAM users—and attaching the SCP at the root OU is what makes the MFA requirement apply to every account in the organization. Option B is wrong because aws:SourceIp restricts access by source IP address and has nothing to do with MFA. Option C is wrong because SCPs cannot force users to register MFA devices; they only allow or deny API actions, and device registration is handled through IAM policies or console settings. Option E is wrong because SCPs cannot be attached to individual IAM users; they only attach to the organization root, OUs, or member accounts.

Answer

The SCP must use the condition key 'aws:SourceIp' to allow only MFA-enabled IPs.

Answer

The SCP must require users to register MFA devices before accessing the console.

Answer

The SCP must be attached to individual IAM users.

Question 6

A company is using AWS Organizations to manage multiple accounts. The security team wants to prevent the creation of Amazon EC2 instances with public IP addresses in all accounts. Which TWO actions should the team take to implement this control using Service Control Policies (SCPs)?

Accepted Answer

Create an SCP with a Deny effect for ec2:RunInstances where the request parameter ec2:AssociatePublicIpAddress is true.. Option C is correct because SCPs can use a Deny effect with the condition key ec2:AssociatePublicIpAddress set to true to block ec2:RunInstances requests that would launch an instance with a public IP address, directly enforcing the security team's requirement. Option D is correct because attaching the SCP to the root organizational unit applies the policy to every account in the organization, ensuring the control is enforced across all accounts as requested. Option A is incorrect because ec2:LaunchTemplate is not a valid condition key for evaluating whether an instance will receive a public IP address during RunInstances. Option B is incorrect because SCPs do not add IAM policies to accounts; they set maximum permissions, and a blanket deny of ec2:RunInstances would block all instance launches, not just those with public IPs. Option E is incorrect because requiring a tag value does not prevent the creation of instances with public IP addresses and can be bypassed or misconfigured.

Answer

Use the condition key 'ec2:LaunchTemplate' to deny public IPs.

Answer

Create an SCP that adds an IAM policy to deny ec2:RunInstances.

Answer

Create an SCP that requires the tag 'PublicIP' to be set to 'false'.

Question 7

A company has an AWS Organization with hundreds of accounts. The security team wants to enforce that no account can disable AWS CloudTrail logging. Which TWO approaches can achieve this?

Accepted Answer

Enable CloudTrail as a trusted service and create an organization trail.. Option A is correct because creating an organization trail from the management account makes CloudTrail a trusted service across all accounts in the AWS Organization, and member accounts cannot modify or delete an organization trail, effectively preventing them from disabling logging. Option C is correct because a Service Control Policy (SCP) attached at the organization or OU level can explicitly deny the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions, which blocks any principal in the affected accounts from stopping or deleting trails. Option B is incorrect because IAM policies attached to a root user do not reliably prevent actions taken by other administrators or roles, and root user permissions are not the proper enforcement mechanism across hundreds of accounts. Option D is incorrect because AWS Config is a detective control that can detect and remediate noncompliance after the fact, but it does not prevent an account from disabling CloudTrail in the first place. Option E is incorrect because CloudWatch Logs monitoring and alerting is also detective, not preventive, and it cannot stop an account from turning off CloudTrail logging.

Answer

Apply an IAM policy to each account's root user to prevent disabling CloudTrail.

Answer

Use AWS Config to automatically re-enable CloudTrail if it is disabled.

Answer

Configure CloudWatch Logs to monitor CloudTrail logs and alert if logging stops.

Question 8

Refer to the exhibit. An IAM policy is attached to a user. The user reports that they cannot upload files to the S3 bucket 'example-bucket' using the AWS CLI with HTTPS. What is the most likely reason?

Accepted Answer

The user does not have an explicit allow for s3:PutObject.. IAM policies are deny-by-default: an action is only permitted if an explicit Allow statement matches it. The exhibit (a typical S3 policy) grants some S3 permissions but does not include s3:PutObject, so the CLI upload fails with AccessDenied even though HTTPS and the bucket name are fine. Adding an Allow for s3:PutObject (or s3:*) on the bucket ARN resolves the issue.

Answer

The bucket requires server-side encryption and the user did not specify it.

Answer

The policy denies all S3 actions when using HTTPS.

Answer

The bucket name is incorrect in the policy.

Question 9

A company has an S3 bucket that contains sensitive data. The bucket policy allows access only from a specific VPC endpoint. A security engineer notices that objects in the bucket are being deleted by an IAM user from outside the VPC. The engineer checks the bucket policy and confirms that the policy denies access if the request does not come from the VPC endpoint. However, the deletions continue. What is the most likely cause?

Accepted Answer

The IAM user is the bucket owner and the bucket policy does not apply to the owner.. The bucket owner (the root user of the AWS account that owns the bucket) is not subject to bucket policies. Since the IAM user is the bucket owner (same account), the bucket policy's deny condition does not restrict their actions. Therefore, the IAM user can delete objects from outside the VPC. Option A is incorrect because the bucket policy does deny s3:DeleteObject for non-VPC requests; the issue is that the policy does not apply to the owner. Option B is incorrect because the VPC endpoint policy only applies to requests coming through the endpoint, and the user is not using the endpoint. Option D is incorrect because ACLs are not relevant here; even if an ACL allowed the deletion, the bucket policy would typically override it, but again, the policy does not apply to the owner.

Answer

The bucket policy is missing a Deny statement for the s3:DeleteObject action.

Answer

The VPC endpoint policy allows the deletion.

Answer

The bucket has an ACL that allows the IAM user to delete objects.

Question 10

A company wants to implement a least-privilege security model for its AWS environment. The security team has identified that many IAM users have overly permissive policies. The team wants to use AWS IAM Access Analyzer to identify policies that grant access to external principals. However, the team is not seeing any findings. What is the most likely reason?

Accepted Answer

IAM Access Analyzer is not enabled for the account.. IAM Access Analyzer generates findings only after it is enabled for the account or organization. If the team is not seeing any findings, the most likely reason is that Access Analyzer has not been enabled. Once enabled, it analyzes resource policies (such as S3 bucket policies, IAM roles, KMS keys, etc.) to identify access to external principals. Without enabling it, no analysis occurs, so no findings appear.

Answer

IAM Access Analyzer only analyzes S3 bucket policies, not IAM policies.

Answer

IAM Access Analyzer requires AWS Organizations to be enabled.

Answer

All policies are already least-privilege and do not grant access to external principals.

Question 11

A financial services company uses AWS Organizations to manage multiple accounts. The Security team has enabled AWS CloudTrail in all accounts and logs are delivered to a central S3 bucket in the management account. The company has a requirement to detect and alert on any IAM user or role that performs a console login without multi-factor authentication (MFA) across all accounts. Currently, the team manually reviews CloudTrail logs, which is time-consuming and error-prone. They want an automated solution that uses AWS services and follows AWS best practices for security governance. The solution must be cost-effective and should not require custom code or third-party tools. What should the Security team do to meet this requirement?

Accepted Answer

Configure CloudTrail to deliver logs to Amazon CloudWatch Logs. Create a metric filter for the event name 'ConsoleLogin' with additionalEventData.MFAUsed != 'Yes'. Create a CloudWatch Alarm on the metric to send a notification via Amazon SNS.. The correct solution is to configure CloudTrail to deliver logs to Amazon CloudWatch Logs, create a metric filter for the ConsoleLogin event with additionalEventData.MFAUsed != 'Yes', and set a CloudWatch Alarm to notify via SNS. This uses native AWS services, requires no custom code, and automates detection across all accounts when combined with a centralized logging account.

Answer

Enable Amazon GuardDuty and create a custom rule to detect console logins without MFA.

Answer

Create an AWS Config managed rule to check for console logins without MFA across all accounts.

Answer

Use AWS IAM Access Analyzer to generate findings when IAM users log in without MFA.

Question 12

A security engineer must provide an external auditor with read-only access to a specific set of AWS CloudTrail logs stored in an S3 bucket for 30 days. The auditor has their own AWS account and must not be able to modify or delete any logs. The engineer needs a solution that grants least-privilege access without creating IAM users. Which approach should the engineer take?

Accepted Answer

Create an IAM role in the log-owner account with a trust policy that allows the auditor's AWS account to assume it, and attach a policy granting s3:GetObject and s3:ListBucket on the specific bucket.. The correct approach uses an IAM role with a trust policy that allows the auditor's AWS account to assume it, combined with a permissions policy limited to reading the specific S3 bucket. This meets the requirements of least privilege, no IAM users, and cross-account access. It also allows the auditor to use their own credentials and enables temporary sessions, which can be revoked by removing the trust relationship.

Answer

Enable S3 Transfer Acceleration and generate a pre-signed URL for each log file that the auditor can use to download the logs.

Answer

Update the S3 bucket policy to allow the auditor's AWS account principal to perform s3:GetObject and s3:ListBucket on the bucket.

Answer

Create an IAM user in the log-owner account for the auditor, attach the ReadOnlyAccess managed policy, and share the access keys securely.

Question 13

A security engineer for a company using AWS Organizations needs to prevent member accounts from leaving the organization or creating new accounts outside of the approved OU structure. The company wants to enforce this restriction across all member accounts without manually configuring each one. Which action should the security engineer take?

Accepted Answer

Attach a service control policy (SCP) to the root of the organization that denies organizations:LeaveOrganization and organizations:CreateAccount.. Service control policies (SCPs) are the only AWS Organizations feature that can centrally enforce restrictions across all member accounts. Attaching an SCP to the root of the organization ensures that all current and future accounts inherit the deny for organizations:LeaveOrganization and organizations:CreateAccount. This meets the requirement without manual per-account configuration.

Answer

Use AWS CloudFormation StackSets to deploy an IAM policy to every member account that denies organizations:LeaveOrganization.

Answer

Configure AWS Control Tower guardrails to block the LeaveOrganization action in all accounts.

Answer

Enable the organizational unit (OU) policy type in AWS Organizations and attach a policy that denies the LeaveOrganization action.

Question 14

A security engineer at a financial services company manages a multi-account AWS environment under AWS Organizations. Auditors require proof that no member account has root user access keys and that root user activity is monitored. The security engineer needs a single centralized mechanism to detect root user sign-in events across all accounts and trigger an alert. Which solution BEST meets these requirements?

Accepted Answer

Enable AWS CloudTrail organization trail and create a single Amazon EventBridge rule in the management account matching the Root user sign-in event via CloudTrail management events, then route to Amazon SNS.. CloudTrail organization trail centralizes API activity from all member accounts into the management account, where a single EventBridge rule can match root user ConsoleLogin events and route alerts through SNS. This scales automatically as accounts join and requires no per-account resources. Config, Security Hub, and per-account EventBridge rules either monitor configuration state instead of live events or fail to provide the centralized, scalable detection the scenario demands.

Answer

Enable AWS Security Hub in all accounts with the AWS Foundational Security Best Practices standard and rely on its default findings for root user activity.

Answer

Enable AWS CloudTrail organization trail and create an Amazon EventBridge rule in each member account matching root user sign-in events, forwarding to an SNS topic for notification.

Answer

Enable AWS Config in each member account with a managed rule for root user access keys, and use AWS Config aggregator to consolidate findings into the management account.

Question 15

A company needs to prove to regulators that access to a sensitive S3 bucket is limited to authorized roles and that any policy changes are recorded. The security engineer must provide evidence of who changed bucket policies and when, and must be able to detect unauthorized changes quickly. Which AWS service provides this audit trail with the LEAST operational effort?

Accepted Answer

Enable AWS CloudTrail data events on the bucket and configure Amazon EventBridge to alert on PutBucketPolicy API calls.. CloudTrail management events capture S3 control-plane API calls such as PutBucketPolicy with the calling identity and timestamp, producing the required audit trail with minimal effort. Pairing this with an EventBridge rule enables near-real-time detection of unauthorized policy changes. S3 access logs, AWS Config, and GuardDuty either record different data or lack the identity attribution needed for regulatory evidence.

Answer

Enable Amazon GuardDuty S3 protection and rely on its findings to detect unauthorized bucket policy changes.

Answer

Enable S3 server access logging on the bucket and analyze the logs with Amazon Athena to identify policy change requests.

Answer

Enable AWS Config with the s3-bucket-policy-not-more-permissive managed rule and review configuration timeline entries for policy changes.