SCS-C02 Management and Security Governance Practice Test 9 — 15 Questions

Question 1

A company uses AWS Organizations with a single management account and multiple member accounts. The security team needs to ensure that all member accounts automatically deploy AWS Config rules to audit security group configurations. Which solution meets this requirement with minimal operational overhead?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS Config conformance packs deployed via AWS CloudFormation StackSets from the management account.. AWS Config conformance packs, deployed via AWS CloudFormation StackSets from the management account, allow you to centrally deploy a collection of AWS Config rules and remediation actions across all member accounts in an AWS Organization. This approach ensures consistent security group auditing with minimal operational overhead, as StackSets automatically handle deployment, updates, and drift detection across accounts and Regions.

Answer

Configure an AWS Lambda function in each account that periodically checks security group compliance.

Answer

Enable AWS Security Hub and rely on its built-in security group checks.

Answer

Create an AWS Config rule in each member account manually using AWS CloudFormation templates.

Question 2

A security engineer is designing a solution to monitor and remediate non-compliant resources across multiple AWS accounts. The company uses AWS Organizations and wants to enforce that any S3 bucket with public read access is automatically remediated. The solution must be centralized and scalable. Which approach should the engineer take?

Accepted Answer

Deploy an AWS Config conformance pack with a rule and an auto-remediation action using AWS Systems Manager Automation.. AWS Config conformance packs allow you to deploy a collection of AWS Config rules and remediation actions across multiple accounts and Regions in AWS Organizations. By including an auto-remediation action using AWS Systems Manager Automation, the solution can automatically remediate S3 buckets with public read access in a centralized and scalable manner, without manual intervention or per-account configuration.

Answer

Create an AWS Config rule in each account and configure an Amazon CloudWatch Events rule to trigger an AWS Lambda function for remediation.

Answer

Use AWS Trusted Advisor to identify public buckets and manually remediate them.

Answer

Deploy an AWS Config conformance pack with a rule that checks for public buckets and reports non-compliance.

Question 3

A company has multiple AWS accounts managed through AWS Organizations. The security team needs to ensure that no EC2 instances are launched without an approved Amazon Machine Image (AMI). Which governance control should be implemented?

Accepted Answer

Use a service control policy (SCP) that denies ec2:RunInstances unless the AMI ID is in an approved list.. A service control policy (SCP) is the correct governance control because it operates at the AWS Organizations level, allowing the security team to enforce a deny on ec2:RunInstances across all member accounts unless the AMI ID matches an approved list. SCPs are account permission boundaries that cannot be overridden by IAM policies within the account, ensuring that no user or role can launch an EC2 instance with an unapproved AMI, even if they have full administrative privileges. This provides a preventive control that blocks non-compliant actions before they occur, which is more robust than detective or reactive measures.

Answer

Deploy an AWS Config rule that triggers a Lambda function to terminate non-compliant instances.

Answer

Use AWS CloudTrail to monitor instance launches and alert the security team.

Answer

Use an IAM policy that restricts ec2:RunInstances to approved AMIs.

Question 4

A company wants to use AWS CloudFormation to manage infrastructure. The security team requires that all templates are scanned for security vulnerabilities before deployment. Which service should be integrated into the pipeline?

Accepted Answer

AWS CloudFormation Guard. AWS CloudFormation Guard (cfn-guard) is a policy-as-code tool that allows you to define rules to validate CloudFormation templates against security best practices before deployment. It integrates into CI/CD pipelines to enforce compliance with organizational policies, such as ensuring encryption is enabled or public access is restricted, directly addressing the requirement to scan templates for security vulnerabilities.

Answer

Amazon Inspector

Answer

AWS Config

Answer

AWS Shield Advanced

Question 5

A company uses AWS Secrets Manager to store database credentials. The security team needs to ensure that secrets are automatically rotated every 30 days. Which configuration should be used?

Accepted Answer

Enable automatic rotation using an AWS Lambda function.. AWS Secrets Manager provides a built-in mechanism to automatically rotate secrets using an AWS Lambda function. By configuring a rotation schedule (e.g., every 30 days), Secrets Manager invokes the Lambda function to create a new version of the secret and update the database credentials, ensuring compliance without manual intervention.

Answer

Manually update the secret in Secrets Manager every 30 days.

Answer

Use Amazon Macie to detect when secrets are stale.

Answer

Set an expiration date on the secret and recreate it.

Question 6

A security engineer is designing a governance framework for a multi-account AWS environment. The framework must enforce the principle of least privilege for cross-account access. Which TWO strategies should be implemented?

Accepted Answer

Use IAM roles with specific permissions and trust policies for cross-account access.. IAM roles with specific permissions and trust policies enable cross-account access without sharing long-term credentials. The trust policy defines which accounts can assume the role, and the permissions policy grants only the necessary actions, enforcing the principle of least privilege.

Answer

Enable AWS CloudTrail in all accounts and aggregate logs.

Answer

Grant full administrative access to a central security group.

Answer

Use a single IAM user across all accounts for administrative tasks.

Question 7

A company's security team is implementing controls to meet PCI DSS compliance. The environment includes Amazon EC2, RDS, and S3. Which THREE controls should be implemented to address logging and monitoring requirements?

Accepted Answer

Enable AWS Config to track resource configuration changes.. AWS Config is correct because it tracks resource configuration changes and records them as configuration items, which is essential for PCI DSS Requirement 10.5.2 that mandates logging of all actions taken by any individual with root or administrative privileges. By monitoring changes to EC2, RDS, and S3 configurations, AWS Config provides an audit trail of who made changes, what changed, and when, directly supporting logging and monitoring compliance.

Answer

Deploy Amazon CloudWatch Application Insights.

Answer

Enable detailed billing reports.

Question 8

A security engineer attaches the above SCP to an OU containing development accounts. The engineer expects that only t3.micro instances can be launched, but developers report that they cannot launch any EC2 instances. What is the MOST likely reason?

Accepted Answer

The SCP denies all ec2 actions because there is no explicit allow statement.. SCPs operate on a default-deny model: all actions are implicitly denied unless explicitly allowed. The policy only denies non-t3.micro instance types but does not include an explicit Allow statement for ec2:RunInstances or any other EC2 action. Without an explicit Allow, the implicit deny blocks all EC2 actions, including launching t3.micro instances.

Answer

The SCP syntax is invalid because it uses Deny without an explicit Allow.

Answer

The condition StringNotEquals is evaluated incorrectly for EC2 instance types.

Answer

The SCP is applied at the organization root and overrides the OU-level policy.

Question 9

A security engineer reviews the above CloudTrail event. Which action should the engineer take FIRST to mitigate a potential security issue?

Accepted Answer

Revert the bucket policy to remove the public access.. The CloudTrail event shows that the root user executed `s3:PutBucketPolicy` to apply a bucket policy that grants public access (e.g., `Principal: "*"` or `Effect: "Allow"` with `Action: "s3:GetObject"`). Reverting the bucket policy to remove public access is the immediate corrective action to stop unauthorized data exposure. This directly addresses the security issue by revoking the public read permissions that were just granted.

Answer

Delete the bucket to prevent data exposure.

Answer

Contact the root user to confirm the action.

Answer

Disable the root user's access keys.

Question 10

A company uses AWS Organizations with multiple accounts and wants to ensure that all newly created S3 buckets have encryption enabled. The Security team needs a solution that automatically remediates non-compliant buckets without manual intervention. What should they do?

Accepted Answer

Enable AWS Config with the s3-bucket-server-side-encryption-enabled rule and set up automatic remediation using Systems Manager Automation.. AWS Config can continuously evaluate S3 buckets against the s3-bucket-server-side-encryption-enabled rule and automatically remediate non-compliant buckets using Systems Manager Automation, requiring no manual intervention. Option A is incorrect because a service control policy (SCP) cannot enforce encryption on bucket creation; the described SCP is circular and unenforceable since it denies s3:PutBucketEncryption unless encryption is already enabled, which is impossible to satisfy at creation time.

Answer

Apply a service control policy (SCP) that denies the s3:PutBucketPublicAccessBlock and s3:PutBucketEncryption actions unless the bucket has encryption enabled.

Answer

Use an S3 bucket policy that denies PutObject unless the request includes the x-amz-server-side-encryption header.

Answer

Create an IAM role with permissions to enforce encryption and attach it to all accounts in the organization.

Question 11

Which TWO of the following are valid methods to centrally manage security policies and enforce compliance across multiple AWS accounts? (Choose two.)

Accepted Answer

Deploy AWS Config conformance packs using AWS CloudFormation StackSets across accounts.. AWS Config conformance packs provide a way to deploy a collection of AWS Config rules and remediation actions across multiple accounts and Regions. When combined with AWS CloudFormation StackSets, you can centrally deploy these conformance packs to all accounts in an AWS Organization, ensuring consistent compliance enforcement. This approach allows you to define and manage security policies as code, automatically evaluating resources against desired configurations.

Answer

Attach IAM policies to all IAM users in each account.

Answer

Use AWS Security Hub to automatically enforce compliance rules.

Answer

Enable VPC Flow Logs in each account and send them to a central S3 bucket.

Question 12

Refer to the exhibit. An organization applies this SCP to an OU containing a developer account. A developer in that account tries to launch an m5.large instance using the AWS Management Console. What is the outcome?

Accepted Answer

The launch fails because the SCP denies RunInstances for instance types other than t2.micro and t2.small.. The SCP explicitly denies the ec2:RunInstances action when the condition key ec2:InstanceType does not match t2.micro or t2.small. Since m5.large is not in the allowed list, the deny effect applies, and the launch fails regardless of any IAM policy that might allow it. SCPs act as a guardrail that overrides IAM permissions, so even if the developer has full IAM access, the SCP blocks the operation.

Answer

The instance launches successfully because the SCP only applies to StartInstances, not RunInstances.

Answer

The instance launches successfully because the SCP does not explicitly allow any actions.

Answer

The launch fails only if the developer's IAM policy also denies the action.

Question 13

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that all IAM users in the organization have multi-factor authentication (MFA) enabled. Which combination of actions should be taken to enforce this requirement?

Accepted Answer

Create an SCP that denies IAM actions without MFA and attach it to the root organizational unit (OU).. Service Control Policies (SCPs) in AWS Organizations can be attached to the root organizational unit (OU) to apply a blanket denial of IAM actions when MFA is not present, affecting all accounts and users within the organization. This leverages the `aws:MultiFactorAuthPresent` condition key in an SCP to enforce MFA at the organization level, ensuring that even if IAM users are created in member accounts, they cannot perform IAM actions without MFA. Attaching the SCP to the root OU ensures the policy cascades down to all child OUs and accounts, providing centralized enforcement.

Answer

Create an SCP that denies IAM actions without MFA and attach it to the IAM group that contains all users.

Answer

Create an SCP that denies IAM actions without MFA and attach it to each IAM user.

Answer

Create an SCP that denies IAM actions without MFA and attach it to the management account.

Question 14

A security engineer is designing a governance framework for a multi-account AWS environment. The engineer needs to ensure that all accounts comply with the principle of least privilege for IAM roles and that any non-compliant resources are automatically reported. Which two AWS services should the engineer use together to achieve this? (Choose TWO.)

Accepted Answer

AWS Security Hub. AWS Security Hub is correct because it provides a comprehensive view of security alerts and compliance status across multiple AWS accounts, aggregating findings from various AWS services and third-party tools. AWS Config is correct because it continuously monitors and records AWS resource configurations, enabling you to define rules (e.g., IAM least privilege policies) and automatically evaluate resource compliance, triggering notifications or remediation actions for non-compliant resources. Together, Security Hub can ingest AWS Config rule compliance results as findings, allowing centralized reporting and automated response to IAM role violations.

Answer

AWS Service Catalog

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Question 15

Refer to the exhibit. A security engineer applied the bucket policy shown. What is the effect of this policy?

Accepted Answer

Only GetObject requests that use HTTP are denied.. The bucket policy includes a Deny statement for s3:GetObject requests that are not using HTTPS. The condition `aws:SecureTransport` is set to false, meaning the request is over HTTP. Therefore, any GetObject request made over HTTP is denied. PutObject requests are not affected, and GetObject requests over HTTPS are allowed regardless of IP address.

Answer

All PutObject requests are denied.

Answer

Only GetObject requests from specific IP ranges are denied.

Answer

All GetObject requests to the bucket are denied.