SCS-C02 Management and Security Governance Practice Test 8 — 15 Questions

Question 1

A security engineer needs to ensure that an Amazon S3 bucket is not publicly accessible. Which AWS service can be used to continuously monitor and alert if the bucket becomes public?

Accepted Answer

AWS Config. Option A is correct because AWS Config has managed rules like 's3-bucket-public-read-prohibited' that can evaluate S3 bucket policies and ACLs. Option B is wrong because AWS CloudTrail records API calls but does not evaluate resource configurations. Option C is wrong because Amazon GuardDuty focuses on threat detection. Option D is wrong because AWS Trusted Advisor provides best-practice checks but not continuous monitoring and alerting.

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Question 2

A company uses AWS Organizations with multiple accounts. The security team wants to prevent members of the 'Developers' group from modifying IAM roles in any account. What is the most effective way to enforce this restriction?

Accepted Answer

Apply a service control policy (SCP) that denies IAM role modification actions to all accounts in the organization.. Option D is correct because an SCP can deny IAM role modifications (iam:*Role*) for the entire organization, and it cannot be overridden by account-level permissions. Option A is wrong because a cross-account role only defines access, not restrictions. Option B is wrong because IAM policies can be overridden by administrators in the member account. Option C is wrong because attaching a policy to the Developers group only affects users in the management account, not all accounts.

Answer

Attach an IAM policy to the Developers group in the management account that denies IAM actions.

Answer

Use AWS Config to detect IAM role modifications and automatically revert them.

Answer

Create a cross-account role in each member account that denies IAM actions.

Question 3

A company requires that all Amazon EC2 instances be launched only with an approved Amazon Machine Image (AMI) that has been hardened by the security team. Which AWS service should be used to enforce this requirement?

Accepted Answer

AWS Config. Option B is correct because AWS Config can evaluate whether EC2 instances are launched from approved AMIs using a managed rule or custom rule. Option A is wrong because AWS Service Catalog can provide a product portfolio but does not enforce at launch. Option C is wrong because EC2 Image Builder builds and manages images but does not enforce usage. Option D is wrong because AWS Systems Manager Patch Manager patches instances but does not control which AMIs are used.

Answer

EC2 Image Builder

Answer

AWS Systems Manager Patch Manager

Answer

AWS Service Catalog

Question 4

A security engineer needs to automate the response to an AWS CloudTrail log event that indicates a potential security threat. Which AWS service would be most appropriate to orchestrate the automated response?

Accepted Answer

AWS Step Functions. Option C is correct because AWS Step Functions can coordinate multiple AWS services into a workflow, such as invoking Lambda functions, making API calls, etc. Option A is wrong because Amazon EventBridge can trigger events but does not orchestrate complex workflows. Option B is wrong because AWS Lambda can execute code but is not an orchestrator. Option D is wrong because Amazon SQS is a message queue, not an orchestrator.

Answer

AWS Lambda

Answer

Amazon Simple Queue Service (SQS)

Answer

Amazon EventBridge

Question 5

A company has an AWS account with a single VPC and multiple subnets. The security team wants to ensure that no network ACL (NACL) allows inbound SSH (port 22) from 0.0.0.0/0. Which AWS service can be used to detect and alert on such non-compliant NACLs?

Accepted Answer

AWS Config. Option D is correct because AWS Config can evaluate NACL rules using a custom rule that checks for inbound SSH from 0.0.0.0/0. Option A is wrong because AWS CloudTrail logs API calls but does not evaluate NACL configurations. Option B is wrong because Amazon GuardDuty focuses on threat detection. Option C is wrong because AWS Inspector assesses vulnerabilities on EC2, not NACLs.

Answer

Amazon Inspector

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Question 6

A company needs to audit all changes to IAM policies in its AWS account. Which AWS service should be used to record the change history of IAM policies?

Accepted Answer

AWS CloudTrail. Option A is correct because AWS CloudTrail records API calls, including IAM policy changes (CreatePolicy, PutPolicy, etc.). Option B is wrong because AWS Config records resource configurations but not the full history of each change. Option C is wrong because Amazon GuardDuty does not log changes. Option D is wrong because AWS CloudWatch Logs stores logs but does not automatically capture IAM changes.

Answer

Amazon CloudWatch Logs

Answer

Amazon GuardDuty

Answer

AWS Config

Question 7

A security engineer needs to generate a report of all AWS Identity and Access Management (IAM) users who have not used their access keys in the last 90 days. Which AWS service can provide this information?

Accepted Answer

AWS IAM Credentials Report. Option B is correct because AWS IAM Credentials Report provides a CSV file with details about IAM users, including last activity dates. Option A is wrong because AWS CloudTrail logs API calls but does not provide a summary report. Option C is wrong because AWS Config evaluates configurations, not usage. Option D is wrong because Amazon GuardDuty does not track IAM key usage.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS Config

Question 8

A company uses AWS Organizations and wants to restrict the AWS Regions in which resources can be created across all member accounts. Which mechanism should be used?

Accepted Answer

Apply a service control policy (SCP) that denies operations in unauthorized regions.. Option D is correct because an SCP can deny operations in unauthorized regions. Option A is wrong because IAM policies can be overridden by account administrators. Option B is wrong because VPC endpoints do not control region usage. Option C is wrong because AWS Config can detect resources in unauthorized regions but does not prevent creation.

Answer

Use VPC endpoints to restrict API calls to specific regions.

Answer

Configure AWS Config rules to detect and delete resources in unauthorized regions.

Answer

Attach an IAM policy to each user that denies operations in unauthorized regions.

Question 9

A security engineer needs to implement a solution to detect and alert on suspicious API calls in an AWS account. Which TWO AWS services should be integrated to achieve this? (Choose two.)

Accepted Answer

AWS CloudTrail. Option A and Option C are correct. Amazon GuardDuty can analyze CloudTrail events to detect suspicious API calls. Option B is wrong because AWS Config evaluates configurations, not API calls. Option D is wrong because Amazon Inspector assesses EC2 vulnerabilities. Option E is wrong because AWS Trusted Advisor provides best-practice checks.

Answer

AWS Config

Answer

Amazon Inspector

Answer

AWS Trusted Advisor

Question 10

A company wants to centrally manage and enforce security policies across multiple AWS accounts using AWS Organizations. Which THREE actions should be taken? (Choose three.)

Accepted Answer

Enable all features in AWS Organizations and create service control policies (SCPs) to restrict actions.. Options A, B, and D are correct. SCPs enforce policies across accounts. Centralized logging with CloudTrail provides auditing. IAM roles for cross-account access allow secure management. Option C is wrong because using the root user for each account is not a best practice. Option E is wrong because disabling CloudTrail in member accounts removes auditing.

Answer

Use the root user of each member account for administrative tasks.

Answer

Disable CloudTrail in member accounts to reduce costs.

Question 11

A company needs to ensure that its S3 buckets are not publicly accessible. Which TWO AWS services can be used to detect and report on public S3 buckets? (Choose two.)

Accepted Answer

AWS Trusted Advisor. AWS Trusted Advisor (option B) checks S3 bucket permissions and reports any bucket that has open access policies, including public read or write access. AWS Config (option C) can evaluate S3 bucket policies against custom or managed rules (e.g., s3-bucket-public-read-prohibited, s3-bucket-public-write-prohibited) to detect noncompliant buckets and trigger remediation. Both services provide detection and reporting capabilities for public S3 buckets.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

Amazon Inspector

Question 12

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all newly created accounts automatically have AWS CloudTrail enabled, with logs delivered to a centralized S3 bucket. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Create an SCP that denies actions to disable CloudTrail and modify the S3 bucket policy. Use AWS CloudFormation StackSets to deploy a CloudTrail trail in each account.. Option A is correct because SCPs can be used to prevent disabling CloudTrail and to enforce delivery to a specific bucket, but enabling it requires a proactive mechanism like AWS Config rules with auto-remediation or a custom resource. However, the best approach is to use CloudFormation StackSets or AWS Control Tower, but since Control Tower is not listed, the correct answer is using an SCP to prevent disabling and a CloudFormation StackSet to enable it. Actually, the simplest is to use AWS CloudFormation StackSets to deploy a CloudTrail trail across all accounts. Option B is wrong because Lambda functions need to be triggered by something. Option C is wrong because SCPs cannot enable services, only deny. Option D is wrong because Trusted Advisor does not enforce configurations.

Answer

Create an SCP that enables CloudTrail and enforces log delivery to the centralized S3 bucket.

Answer

Use AWS Trusted Advisor to check CloudTrail status and send alerts to the security team.

Answer

Use AWS Config rules with auto-remediation to enable CloudTrail in each account.

Question 13

A security engineer needs to audit all IAM role creations across an AWS account. Which AWS service should be used to log these API calls?

Accepted Answer

AWS CloudTrail. Option B is correct because AWS CloudTrail records API calls, including IAM role creation. Option A is wrong because AWS Config records resource configuration changes but not API call details. Option C is wrong because Amazon GuardDuty focuses on threat detection. Option D is wrong because AWS CloudWatch Logs stores logs but does not capture API calls directly.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 14

A company has a requirement that all access keys for IAM users must be rotated every 90 days. A security engineer needs to implement an automated solution to identify and disable keys that are older than 90 days. Which approach meets the requirement with the least operational overhead?

Accepted Answer

Use an AWS Config rule with auto-remediation to disable keys older than 90 days.. Option D is correct because AWS Config has a managed rule 'access-keys-rotated' that checks key age and can trigger auto-remediation via a Systems Manager automation document to disable old keys. Option A is wrong because IAM Access Analyzer does not manage key rotation. Option B is wrong because CloudTrail does not enforce rotation. Option C is wrong because AWS Trusted Advisor only provides recommendations, not enforcement.

Answer

Use AWS Trusted Advisor to check key age and send notifications.

Answer

Use AWS CloudTrail to monitor CreateAccessKey events and trigger a Lambda function to check key age.

Answer

Use IAM Access Analyzer to generate findings for unused keys and manually disable them.

Question 15

An IAM policy is attached to a user. The user reports that they cannot list objects in the bucket 'example-bucket' from their home office IP address 203.0.113.50. What is the most likely cause?

Accepted Answer

The IP address condition restricts access to the 10.0.0.0/24 range.. Option B is correct because the policy allows s3:* actions only if the source IP is in the 10.0.0.0/24 range (private IP). Since the user's home office IP is 203.0.113.50 (public), the condition fails. Option A is wrong because the policy allows s3:* which includes s3:ListBucket. Option C is wrong because the resource is specified as arn:aws:s3:::example-bucket/* which only matches objects, not the bucket itself. However, the error is about listing objects, which requires s3:ListBucket on the bucket resource, not the objects. That is a resource issue, but the main issue is the IP condition. Option D is wrong because the effect is Allow.

Answer

The policy effect is Deny by default.

Answer

The resource ARN should be arn:aws:s3:::example-bucket without the /*.

Answer

The policy does not allow the s3:ListBucket action.