SCS-C02 Management and Security Governance Practice Test 8 — 15 Questions

Question 1

An IAM policy is attached to a user. The user reports that they cannot list objects in the bucket 'example-bucket' from their home office IP address 203.0.113.50. What is the most likely cause?

Accepted Answer

The IP address condition restricts access to the 10.0.0.0/24 range.. The IAM policy likely includes a condition that restricts access to requests originating from the 10.0.0.0/24 IP range (a private IP range). Since the user's home office IP is 203.0.113.50 (a public IP), the condition fails and access is denied. Option A is incorrect because IAM policies are deny by default only when no explicit Allow exists; in this case, an Allow statement is present. Option B is incorrect because while using the wrong resource ARN (with /*) prevents bucket-level actions, the most likely cause given the specific IP mismatch is the condition. Option C is incorrect because the policy allows s3:* actions, which includes s3:ListBucket.

Answer

The policy effect is Deny by default.

Answer

The resource ARN should be arn:aws:s3:::example-bucket without the /*.

Answer

The policy does not allow the s3:ListBucket action.

Question 2

A company wants to grant cross-account access to an S3 bucket owned by Account A to a user in Account B. The bucket policy in Account A allows access from Account B. What additional configuration is required?

Accepted Answer

The IAM user in Account B must have a policy that allows access to the S3 bucket.. Cross-account access to an S3 bucket requires both a resource-based policy (the bucket policy in Account A) and an identity-based policy (an IAM policy attached to the user or role in Account B). The bucket policy grants access to the external account, but the IAM user in Account B must also have an explicit policy that allows the desired actions (e.g., s3:GetObject). Therefore, Option A is correct. Option B is incorrect because the bucket policy alone is not sufficient. Option C is incorrect because ACLs are not required and are generally not recommended for cross-account access. Option D is incorrect because SCPs (Service Control Policies) are used for organization-wide guardrails and are not required for this specific cross-account access.

Answer

Nothing; the bucket policy is sufficient.

Answer

The bucket must be configured with ACLs.

Answer

An SCP must allow the s3:GetObject action.

Question 3

A security engineer notices that CloudTrail logs are not being delivered to the S3 bucket for the past 2 hours. The output of 'get-trail-status' is shown. What is the most likely cause?

Accepted Answer

The S3 bucket policy denies write access from CloudTrail.. The 'get-trail-status' command shows that the trail is active (not stopped) and that the S3 bucket exists. However, the latest delivery time is 2 hours old, and the latest delivery attempt failed. This indicates that CloudTrail is unable to write logs to the S3 bucket, most likely because the S3 bucket policy has been modified to deny write access from CloudTrail. Option C is correct. Option A is incorrect because if the bucket did not exist, CloudTrail would report an error about the bucket not being found, and the trail status would indicate that. Option B is incorrect because the trail status shows it is still logging. Option D is incorrect because CloudWatch Logs delivery is separate; the issue is with S3 delivery.

Answer

The S3 bucket does not exist.

Answer

The trail has been stopped.

Answer

CloudWatch Logs delivery is failing.

Question 4

A company wants to enforce that all IAM users use multi-factor authentication (MFA) to access the AWS Management Console. Which AWS service can be used to enforce this requirement?

Accepted Answer

AWS Identity and Access Management (IAM). AWS IAM allows you to create a policy with a condition that requires MFA for console access. Option A is wrong because AWS Organizations is used to manage multiple accounts, not to enforce MFA on individual users. Option B is wrong because AWS Config can check compliance but cannot enforce the requirement; it only evaluates resource configurations. Option D is wrong because Amazon Cognito is used for external identity federation, not for enforcing MFA on IAM users.

Answer

AWS Organizations

Answer

AWS Config

Answer

Amazon Cognito

Question 5

A security team needs to centralize audit logs from multiple AWS accounts into a single S3 bucket. The solution must be scalable and support future account additions. Which approach meets these requirements?

Accepted Answer

Use AWS Organizations to create a CloudTrail trail that applies to all accounts in the organization.. Using AWS Organizations, you can create a CloudTrail trail that automatically applies to all accounts in the organization, delivering logs to a single S3 bucket. This approach is scalable and automatically includes new accounts as they are added. Option A is incorrect because Amazon CloudWatch Logs is not designed for cross-account log aggregation to a single bucket without complex subscription filters. Option B is incorrect because AWS Trusted Advisor does not collect logs; it provides best practice recommendations. Option C is incorrect because manually configuring CloudTrail in each account requires per-account setup and does not automatically include new accounts, making it less scalable.

Answer

Use Amazon CloudWatch Logs to stream logs from each account to a central account.

Answer

Use AWS Trusted Advisor to collect logs from all accounts.

Answer

Configure CloudTrail in each account to deliver logs to the same S3 bucket.

Question 6

This SCP is attached to an organizational unit (OU). A developer in an account within the OU tries to launch a t2.small instance. What is the outcome?

Accepted Answer

The launch fails because the SCP denies non-t2.micro instances.. The SCP denies ec2:RunInstances if the instance type is not t2.micro. Since t2.small is not t2.micro, the condition matches, and the action is denied. Option A is wrong because the SCP does not deny all RunInstances actions; it only denies those that do not match the condition. Option B is wrong because the launch fails, not succeeds. Option D is wrong because SCPs apply to all principals in the account, including developers.

Answer

The launch fails because the SCP denies all RunInstances actions.

Answer

The launch succeeds because the SCP allows t2.micro only.

Answer

The launch succeeds because SCPs do not apply to developers.

Question 7

A company has a security requirement that any Amazon RDS database must be encrypted at rest. Which TWO actions should be taken to enforce this requirement?

Accepted Answer

Use an AWS Config rule to detect unencrypted RDS instances and trigger auto-remediation.. To enforce encryption at rest for Amazon RDS, two effective actions are: using an IAM policy with a condition that denies rds:CreateDBInstance unless encryption is enabled (D), and using an AWS Config rule to detect unencrypted RDS instances and trigger auto-remediation (B). Option A is incorrect because VPC security groups control network access, not encryption. Option C is incorrect because SCPs can restrict actions but cannot enforce encryption parameters at the service level. Option E is incorrect because enabling encryption on existing RDS instances requires a snapshot restore, not a simple Lambda function.

Answer

Configure VPC security groups to block unencrypted connections.

Answer

Attach an SCP to the OU to require encryption for all RDS instances.

Answer

Enable encryption on all existing RDS instances using a Lambda function.

Question 8

A security engineer needs to grant a user read-only access to an S3 bucket. Which THREE of the following are required in the IAM policy?

Accepted Answer

Action: s3:ListBucket. Options A, B, and D are correct. To grant read-only access, the policy must allow s3:ListBucket on the bucket resource and s3:GetObject on the object resources. Option C is wrong because s3:PutObject is write access. Option E is wrong because s3:DeleteObject is not needed for read-only.

Answer

Action: s3:PutObject

Answer

Action: s3:DeleteObject

Question 9

A company has a single AWS account with multiple IAM users. The security team wants to enforce that all users use MFA for API calls. An IAM policy is created that denies all actions unless MFA is present. The policy is attached to all users. However, users report that they can still make API calls without MFA. The security team reviews the policy and confirms it is correct. What is the most likely reason the policy is not being enforced?

Accepted Answer

The policy uses the wrong condition key; it should be 'aws:MultiFactorAuthPresent'.. The most likely reason the MFA policy is not enforced is that it uses an incorrect condition key. To enforce MFA, the policy must use the condition key 'aws:MultiFactorAuthPresent' with a value of 'false' in the Deny statement. If the policy uses a different key (e.g., 'aws:MultiFactorAuthAge') or misspells it, the condition will not evaluate correctly, and the Deny effect will not apply. Option B is incorrect because CloudTrail is used for auditing, not enforcement. Option C is incorrect because SCPs are for multi-account organizations, not single accounts. Option D is incorrect because the password policy does not affect API call enforcement.

Answer

AWS CloudTrail is not enabled, so the policy cannot be evaluated.

Answer

An SCP at the root level allows all actions without MFA.

Answer

The IAM password policy does not require MFA.

Question 10

A company has an AWS account with multiple S3 buckets that contain sensitive data. The security team wants to ensure that no public access is granted to any bucket. The team has enabled AWS Config and set up a rule to detect public buckets. The rule reports that all buckets are compliant. However, during a security review, a team member finds that one bucket has a bucket policy that grants 's3:GetObject' to 'Principal': '*'. Why did the AWS Config rule not detect this?

Accepted Answer

The AWS Config rule only checks ACLs, not bucket policies.. The AWS Config managed rule 's3-bucket-public-read-prohibited' only checks for public read access via ACLs, not bucket policies. Therefore, a bucket policy granting 's3:GetObject' to 'Principal': '*' would not be flagged as non-compliant by this rule. To detect public access via bucket policies, a custom AWS Config rule or other mechanisms like IAM Access Analyzer are needed. Option A is incorrect because CloudTrail logs API calls but does not evaluate compliance. Option C is incorrect because the bucket is in the same account as per the scenario. Option D is incorrect because IAM Access Analyzer can analyze policies but does not enforce compliance rules.

Answer

AWS CloudTrail must be enabled for Config to evaluate policies.

Answer

The bucket is in a different AWS account.

Answer

IAM Access Analyzer must be enabled first.

Question 11

A security engineer is auditing an S3 bucket policy that allows cross-account access. The engineer wants to ensure that only encrypted connections are permitted. Which condition should be added to the policy?

Accepted Answer

aws:SecureTransport. Aws:SecureTransport is the condition key that enforces HTTPS. Option A is wrong because aws:SourceIp controls IP addresses, not encryption. Option B is wrong because aws:Referer controls referrer headers, not encryption. Option D is wrong because s3:x-amz-server-side-encryption controls server-side encryption headers, not transport encryption.

Answer

aws:SourceIp

Answer

aws:Referer

Answer

s3:x-amz-server-side-encryption

Question 12

A company uses AWS Organizations with all features enabled. The security team needs to ensure that no member account can disable AWS CloudTrail logging or delete CloudTrail logs stored in S3. Which combination of preventive controls should be implemented?

Accepted Answer

Apply a service control policy (SCP) at the root OU to deny CloudTrail and S3 delete actions, and enable CloudTrail organizational trail.. SCPs can deny actions like cloudtrail:DeleteTrail and s3:DeleteObject, and a CloudTrail organizational trail prevents member accounts from stopping logging. Option A is wrong because IAM policies are not enforced by root users. Option C is wrong because resource-based policies alone cannot prevent root user actions. Option D is wrong because CloudWatch alarms are detective, not preventive.

Answer

Set up CloudWatch alarms to notify when CloudTrail is modified or logs are deleted.

Answer

Use IAM policies in each member account to deny CloudTrail and S3 delete actions.

Answer

Apply an S3 bucket policy denying delete actions, and enable CloudTrail organizational trail.

Question 13

A security engineer is designing a system to centrally manage IAM users and roles across multiple AWS accounts. The company uses AWS Organizations. Which AWS service should be used to manage permissions across accounts?

Accepted Answer

AWS IAM Identity Center (AWS SSO). AWS IAM Identity Center (formerly AWS SSO) is the service for centrally managing user access to multiple accounts. Option A is wrong because AWS Config is for resource compliance. Option B is wrong because AWS Artifact is for compliance reports. Option C is wrong because AWS CloudTrail is for auditing API activity.

Answer

AWS Config

Answer

AWS Artifact

Answer

AWS CloudTrail

Question 14

A company has a requirement to automatically rotate secrets for an RDS database every 90 days. The secrets are stored in AWS Secrets Manager. Which resource should be configured to perform the rotation?

Accepted Answer

AWS Lambda function. Secrets Manager uses a Lambda function to perform the actual rotation of secrets. Option A is wrong because a CloudWatch Logs subscription filter is used to stream log data to other services, not to rotate secrets. Option B is wrong because while an Amazon EventBridge scheduled rule can trigger the rotation, the actual rotation logic must be executed by a Lambda function. Option C is wrong because an AWS Config rule is for evaluating resource compliance, not for rotating secrets.

Answer

CloudWatch Logs subscription filter

Answer

Amazon EventBridge scheduled rule

Answer

AWS Config rule

Question 15

A security engineer is designing a logging solution for a multi-account environment using AWS Organizations. The solution must meet the following requirements: 
- Logs from all accounts must be centrally stored and immutable. 
- Only the security team should be able to delete logs. 
- Logs must be encrypted at rest. 
Which TWO steps should the engineer take to meet these requirements? (Choose TWO.)

Accepted Answer

Enable S3 Object Lock and configure a bucket policy to deny s3:DeleteObject unless the principal is the security team.. Options B and E are correct. Option B: S3 Object Lock prevents logs from being deleted or overwritten, ensuring immutability. Additionally, a bucket policy with a condition that denies s3:DeleteObject unless the principal is the security team ensures only they can delete logs. Option E: An organizational CloudTrail trail in the management account automatically delivers logs from all accounts in the organization to a single S3 bucket, meeting the centralized logging requirement. Option A is incorrect because S3 default encryption provides encryption at rest but does not address immutability or deletion control. Option C is incorrect because CloudWatch Logs retention policy does not prevent deletion by administrators and does not provide immutability. Option D is incorrect because creating an IAM role in each account does not centralize logs; it only provides access but logs remain in each account.

Answer

Enable S3 default encryption on the log bucket.

Answer

Stream logs to CloudWatch Logs and set a retention policy of 10 years.

Answer

Create an IAM role in each account that allows the security team to access logs.