SCS-C02 Management and Security Governance Practice Test 8 — 15 Questions

Question 1

A security engineer is implementing preventive and detective controls for a multi-account AWS environment managed with AWS Organizations. The team wants to prevent member accounts from disabling AWS CloudTrail logging and to detect if any account attempts to delete its trail. Which TWO actions should the security engineer take to meet these requirements? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable an AWS CloudTrail organization trail in the management account with log file validation and deliver logs to a central S3 bucket with a restrictive bucket policy.. Service control policies provide organization-wide preventive enforcement that blocks member accounts from stopping, deleting, or updating CloudTrail trails, even by account administrators. An organization trail with log file validation and a restrictive central bucket ensures logs are captured across accounts and tampering can be detected. Config remediation is reactive, in-account IAM policies are bypassable, and GuardDuty does not report trail deletion events.

Answer

Enable AWS Config in each member account with the cloudtrail-enabled managed rule and configure automatic remediation to re-enable logging if it is disabled.

Answer

Enable Amazon GuardDuty in all accounts and configure findings for CloudTrail logging changes to alert the security team.

Answer

Create an IAM policy in each member account that denies cloudtrail:StopLogging and attach it to all IAM roles, including the account root user.

Question 2

A security engineer needs to ensure that all API calls made in an AWS account are logged and that the logs are immutable and stored for at least 7 years. The logs must be easily searchable for security investigations. Which combination of AWS services should the engineer use?

Accepted Answer

AWS CloudTrail with log file validation enabled, delivering to an Amazon S3 bucket with S3 Object Lock in compliance mode and a lifecycle policy to transition to Amazon Glacier after 90 days.. The correct solution uses CloudTrail to log all API calls, log file validation to ensure integrity, S3 Object Lock in compliance mode for immutability, and lifecycle policies to transition to Glacier for long-term retention. This meets all requirements: logging, immutability, searchability, and 7-year retention. Other options lack either immutability, comprehensive logging, or appropriate retention enforcement.

Answer

AWS CloudTrail delivering to Amazon CloudWatch Logs with a retention policy of 7 years, and exporting logs to Amazon S3 for archival.

Answer

AWS Config recording all resource changes, delivering to an Amazon S3 bucket with S3 Object Lock in governance mode, and using AWS Config rules to enforce retention.

Answer

AWS CloudTrail with log file validation enabled, delivering to an Amazon S3 bucket with versioning and MFA delete enabled, and a lifecycle policy to expire objects after 7 years.

Question 3

A security engineer needs to grant cross-account read access to an S3 bucket in Account A to a user in Account B. What is the correct combination of actions?

Accepted Answer

Apply a bucket policy in Account A granting access to the principal in Account B, and attach an IAM policy to the user in Account B allowing the action. Cross-account S3 access requires both a bucket policy in the resource account (Account A) that explicitly grants the cross-account principal (the user in Account B) the s3:GetObject action, and an IAM policy attached to the user in Account B that allows the same action. This two-way authorization is necessary because the bucket policy controls access to the S3 resource, while the IAM policy controls the user's permissions to initiate the request. Without both, the request will be denied by either the resource-based policy or the identity-based policy.

Answer

Attach an IAM policy to the user in Account B allowing the action; no bucket policy needed

Answer

Apply a bucket policy in Account A granting access to the user in Account B; no user policy needed

Answer

Use S3 bucket ACLs to grant READ access to the Account B user

Question 4

A company uses AWS Config to evaluate resource compliance. The security team notices that the AWS::IAM::Group resource type is not supported by AWS Config managed rules. What is the best way to detect IAM groups that have an inline policy allowing 'iam:CreateUser'?

Accepted Answer

Create a custom AWS Config rule using a Lambda function that evaluates IAM groups. AWS Config managed rules do not support the AWS::IAM::Group resource type, so you cannot use a managed rule to evaluate inline policies on IAM groups. The best approach is to create a custom AWS Config rule backed by a Lambda function that can evaluate the IAM group's inline policies and trigger a compliance check when the group configuration changes. This allows you to detect any inline policy that contains the 'iam:CreateUser' action.

Answer

Use IAM Access Analyzer to identify policies that grant broad access

Answer

Use AWS CloudTrail Insights to detect CreateUser events

Answer

Enable AWS Config advanced query and run a query on IAM groups

Question 5

A company wants to use AWS CloudTrail to log all API activity across multiple accounts in AWS Organizations. Which configuration meets the requirement of centralized logging with minimal operational overhead?

Accepted Answer

Create an organization trail in the management account that applies to all accounts. Creating an organization trail in the management account automatically applies to all accounts in AWS Organizations, centralizing CloudTrail logs into a single S3 bucket without requiring per-account configuration. This approach minimizes operational overhead by leveraging the Organizations integration, which handles log delivery from member accounts transparently.

Answer

Create a CloudTrail trail in each account and aggregate logs to a common S3 bucket

Answer

Enable CloudTrail in each account and use cross-account roles to centralize logs

Answer

Use AWS Config to record API calls and send to CloudWatch Logs

Question 6

A security team needs to audit all changes to IAM policies in their AWS account. Which AWS service should they use to record policy changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made in the AWS account, including IAM policy changes (e.g., CreatePolicy, PutRolePolicy, AttachUserPolicy). These events are captured as CloudTrail log entries, providing a complete audit trail of who made the change, when, and from which source IP. This directly meets the requirement to audit all changes to IAM policies.

Answer

Amazon Inspector

Answer

Amazon GuardDuty

Answer

AWS Config

Question 7

A company uses AWS Organizations with SCPs. The security team wants to ensure that no IAM user can be created without MFA. Which SCP should be applied at the root OU?

Accepted Answer

Deny iam:CreateUser unless the request includes a condition for MFA. It uses a Service Control Policy (SCP) to deny the `iam:CreateUser` action unless the request includes a condition that MFA is present. SCPs are account-level permission boundaries in AWS Organizations, and this approach ensures that no IAM user can be created without MFA across all accounts in the organization, as SCPs are evaluated before any IAM policies.

Answer

Deny iam:CreateUser unconditionally

Answer

Use an IAM policy to require MFA for API calls

Answer

Attach an IAM policy to all users requiring MFA

Question 8

A security engineer needs to ensure that all EC2 instances launched in a development account are tagged with a cost center. What is the most effective way to enforce this?

Accepted Answer

Use an IAM policy that denies ec2:RunInstances unless the request includes the cost center tag. Using an IAM policy with a condition key (e.g., `aws:RequestTag`) that denies `ec2:RunInstances` unless the `cost center` tag is specified in the API call enforces tagging at launch time. This prevents any untagged instance from being created, providing proactive enforcement rather than reactive detection or remediation.

Answer

Use AWS Config to detect untagged instances and send alerts

Answer

Use AWS Systems Manager to tag instances after launch

Answer

Create a tag policy in AWS Organizations requiring the cost center tag

Question 9

A company wants to centrally manage access keys for IAM users. Which AWS service can generate and rotate access keys automatically?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct service because it natively supports automatic rotation of secrets, including IAM user access keys. You can configure a rotation schedule (e.g., every 30 days) and Secrets Manager will generate a new access key pair, update the IAM user, and optionally disable or delete the old key. This provides a fully managed, centralized solution for rotating access keys without custom scripting.

Answer

AWS CloudHSM

Answer

AWS KMS

Answer

AWS Systems Manager Parameter Store

Question 10

A company uses AWS Config to record resources. Which TWO actions can be taken to automatically remediate non-compliant resources detected by AWS Config rules?

Accepted Answer

Configure AWS Config rules to invoke an AWS Lambda function for remediation. AWS Config rules can be configured with remediation actions that invoke an AWS Lambda function. When a resource is evaluated as non-compliant, the rule triggers the Lambda function, which can execute custom logic to modify or fix the resource, such as adjusting security group rules or enabling encryption. This provides automated, programmable remediation directly integrated with AWS Config's evaluation lifecycle.

Answer

Configure AWS Config rules to send notifications to an SNS topic

Answer

Use AWS CloudTrail to log non-compliant events

Answer

Use Amazon CloudWatch Events to trigger an AWS Step Functions state machine

Question 11

A company wants to implement least privilege access for a data analytics team that uses Amazon Athena to query data in S3. Which THREE steps should be taken?

Accepted Answer

Grant write access to an S3 bucket for query results. Athena requires a dedicated S3 bucket to store query results, and granting write access to that specific bucket ensures the service can write output without exposing other data. This aligns with least privilege by limiting write permissions to only the necessary location.

Answer

Grant full S3 access to all buckets

Answer

Grant access to Amazon Redshift

Question 12

A security engineer is designing a solution to protect sensitive data in S3. Which THREE mechanisms can be used to enforce encryption at rest?

Accepted Answer

Use an SCP to deny s3:PutObject without encryption. An SCP (Service Control Policy) can be applied at the organizational level to deny any s3:PutObject action that does not include encryption parameters. This enforces encryption at rest across all accounts in the organization, preventing users from uploading unencrypted objects regardless of individual bucket policies or default encryption settings.

Answer

Enable cross-region replication

Answer

Enable MFA Delete on the S3 bucket

Question 13

Refer to the exhibit. A security engineer applies this bucket policy to an S3 bucket. A user without HTTPS tries to download an object. What is the outcome?

Accepted Answer

The request is denied because the condition matches. The bucket policy includes a condition that denies requests when `aws:SecureTransport` is `false`. Since the user attempts to download an object without HTTPS, the condition matches, and the explicit Deny effect overrides any Allow. Therefore, the request is denied.

Answer

The request fails because the condition does not match

Answer

The request succeeds because the policy has a Deny effect

Answer

The request succeeds because the resource is not specific enough

Question 14

Refer to the exhibit. A role has two policies attached. The custom policy includes an Allow for s3:PutObject. An IAM user assumes this role and tries to upload a file to S3. What happens?

Accepted Answer

The upload succeeds because the custom policy allows s3:PutObject. The upload succeeds because IAM evaluates policies in a default-deny environment, and the custom policy attached to the role explicitly allows s3:PutObject. When a user assumes the role, the effective permissions are the union of all attached policies; the managed policy's read-only restriction does not block the explicit allow for s3:PutObject. Since there is no explicit deny for s3:PutObject, the allow from the custom policy grants the action.

Answer

The upload fails because the managed policy only allows read

Answer

The upload is denied by default because no explicit allow

Answer

The upload fails because the managed policy overrides the custom policy

Question 15

A company runs a multi-account AWS environment using AWS Organizations. The security team uses AWS Config to monitor compliance. Recently, they noticed that a developer in the 'development' account created an S3 bucket that is publicly accessible. The security team wants to prevent this in the future by automatically remediating any public S3 bucket. They have an SCP that denies s3:PutBucketPublicAccessBlock, but developers are still making buckets public by using bucket ACLs. The security team wants to implement a solution that automatically fixes any bucket that becomes public. Which solution should they choose?

Accepted Answer

Use AWS Config with the s3-bucket-public-read-prohibited managed rule and an automatic remediation action using AWS Systems Manager Automation. AWS Config's s3-bucket-public-read-prohibited managed rule evaluates S3 bucket ACLs and policies for public read access. When a noncompliant bucket is detected, an automatic remediation action using AWS Systems Manager Automation can invoke a custom SSM document (e.g., AWS-DisableS3BucketPublicReadWrite) to remove public ACLs or apply a bucket policy that denies public access. This provides automated, event-driven remediation without relying on manual intervention or incomplete SCPs.

Answer

Use CloudTrail to detect PutBucketAcl events and send to SNS for manual remediation

Answer

Update the SCP to deny s3:PutBucketAcl with a condition for public access

Answer

Attach an IAM policy to all users that denies s3:PutBucketAcl