SCS-C02 Management and Security Governance Practice Test 9 — 15 Questions

Question 1

A company wants to grant cross-account access to an S3 bucket owned by Account A to a user in Account B. The bucket policy in Account A allows access from Account B. What additional configuration is required?

Accepted Answer

The IAM user in Account B must have a policy that allows access to the S3 bucket.. Option B is correct because cross-account access requires both a resource-based policy (bucket policy) and an identity-based policy (IAM user/role policy) in the trusted account. Option A is wrong because the IAM role is not needed, but the user must have permissions. Option C is wrong because SCPs affect all accounts in an organization but are not required. Option D is wrong because the user's permissions are needed.

Answer

Nothing; the bucket policy is sufficient.

Answer

The bucket must be configured with ACLs.

Answer

An SCP must allow the s3:GetObject action.

Question 2

A security engineer notices that CloudTrail logs are not being delivered to the S3 bucket for the past 2 hours. The output of 'get-trail-status' is shown. What is the most likely cause?

Accepted Answer

The S3 bucket policy denies write access from CloudTrail.. Option D is correct because the latest delivery time is a Unix timestamp that is old (2 hours ago), but the delivery succeeded at that time. However, the 'LatestDeliveryAttemptSucceeded' shows a recent time, indicating a recent delivery. Wait: Actually, the 'LatestDeliveryTime' is 1625097600 which is July 1, 2021, but the current time might be later. If logs are not delivering, check S3 bucket policy. The bucket policy might have been changed to deny write access. Option A is wrong because the trail is logging. Option B is wrong because CloudWatch Logs delivery is also recent. Option C is wrong because the trail is not stopped.

Answer

The S3 bucket does not exist.

Answer

The trail has been stopped.

Answer

CloudWatch Logs delivery is failing.

Question 3

A company wants to enforce that all IAM users use multi-factor authentication (MFA) to access the AWS Management Console. Which AWS service can be used to enforce this requirement?

Accepted Answer

AWS Identity and Access Management (IAM). Option B is correct because IAM policies can include a condition that requires MFA. Option A is wrong because AWS Organizations manages accounts, not user MFA. Option C is wrong because AWS Config can check compliance but cannot enforce. Option D is wrong because Amazon Cognito is for external identity.

Answer

AWS Organizations

Answer

AWS Config

Answer

Amazon Cognito

Question 4

A security team needs to centralize audit logs from multiple AWS accounts into a single S3 bucket. The solution must be scalable and support future account additions. Which approach meets these requirements?

Accepted Answer

Use AWS Organizations to create a CloudTrail trail that applies to all accounts in the organization.. Option A is correct because AWS Organizations with CloudTrail allows creating a trail that logs all accounts in the organization, delivering to a single bucket. Option B is wrong because it requires manual configuration per account. Option C is wrong because CloudWatch Logs is not for cross-account log delivery. Option D is wrong because Trusted Advisor does not collect logs.

Answer

Use Amazon CloudWatch Logs to stream logs from each account to a central account.

Answer

Use AWS Trusted Advisor to collect logs from all accounts.

Answer

Configure CloudTrail in each account to deliver logs to the same S3 bucket.

Question 5

This SCP is attached to an organizational unit (OU). A developer in an account within the OU tries to launch a t2.small instance. What is the outcome?

Accepted Answer

The launch fails because the SCP denies non-t2.micro instances.. Option B is correct because the SCP denies ec2:RunInstances if the instance type is not t2.micro. Since t2.small is not t2.micro, the condition matches, and the action is denied. Option A is wrong because the condition is met. Option C is wrong because the condition applies to instance resource. Option D is wrong because SCPs apply to all principals.

Answer

The launch fails because the SCP denies all RunInstances actions.

Answer

The launch succeeds because the SCP allows t2.micro only.

Answer

The launch succeeds because SCPs do not apply to developers.

Question 6

A security engineer is designing a data encryption strategy for an S3 bucket that contains sensitive information. Which TWO of the following are valid options for enforcing encryption at rest?

Accepted Answer

Enable S3 default encryption on the bucket.. Options B and C are correct. S3 default encryption can be enabled to automatically encrypt objects, and bucket policies can enforce that objects are uploaded with encryption headers. Option A is wrong because CloudTrail does not encrypt data. Option D is wrong because IAM policies cannot enforce encryption at the service level. Option E is wrong because KMS keys are used for encryption but the question asks for enforcement methods.

Answer

Use an AWS KMS key with automatic key rotation.

Answer

Enable AWS CloudTrail to log all object uploads.

Answer

Attach an IAM policy to users to require encryption.

Question 7

A company has a security requirement that any Amazon RDS database must be encrypted at rest. Which TWO actions should be taken to enforce this requirement?

Accepted Answer

Use an AWS Config rule to detect unencrypted RDS instances and trigger auto-remediation.. Options A and C are correct. To enforce encryption, you can use IAM policies with conditions that require encryption parameters, and use AWS Config rules to detect unencrypted databases and trigger remediation. Option B is wrong because enabling encryption on existing databases requires a snapshot restore. Option D is wrong because SCPs cannot enforce encryption at the service level. Option E is wrong because VPC security groups control network access, not encryption.

Answer

Configure VPC security groups to block unencrypted connections.

Answer

Attach an SCP to the OU to require encryption for all RDS instances.

Answer

Enable encryption on all existing RDS instances using a Lambda function.

Question 8

A security engineer needs to grant a user read-only access to an S3 bucket. Which THREE of the following are required in the IAM policy?

Accepted Answer

Action: s3:ListBucket. Options A, B, and D are correct. To grant read-only access, the policy must allow s3:ListBucket on the bucket resource and s3:GetObject on the object resources. Option C is wrong because s3:PutObject is write access. Option E is wrong because s3:DeleteObject is not needed for read-only.

Answer

Action: s3:PutObject

Answer

Action: s3:DeleteObject

Question 9

A company uses AWS Organizations to manage 50 accounts. The security team has enabled AWS CloudTrail in the management account with an organization trail that delivers logs to a central S3 bucket. The bucket policy grants necessary permissions to CloudTrail. Recently, the security team noticed that logs from two member accounts stopped appearing in the bucket. Other accounts continue to deliver logs correctly. The CloudTrail status in the management account shows that the trail is logging and deliveries are succeeding. The security team checked the CloudTrail configuration in the affected member accounts and found that they do not have any trails configured. The IAM roles used for CloudTrail in the management account have sufficient permissions. What is the most likely cause of the missing logs?

Accepted Answer

The S3 bucket policy does not grant write access to the CloudTrail service for the affected member accounts.. Option A is correct. An organization trail automatically logs all accounts in the organization, but if a member account is not configured to allow CloudTrail to deliver logs to the central bucket, it may fail. However, the most common issue is that the bucket policy does not grant the necessary permissions for the member accounts' CloudTrail service to write logs. The bucket policy must have a statement that allows the CloudTrail service from all accounts in the organization to write. If the policy only allows the management account, member accounts will fail. Option B is wrong because CloudTrail is not a service that can be disabled per account by SCPs unless explicitly denied. Option C is wrong because KMS key policy is not relevant if SSE-S3 is used. Option D is wrong because CloudTrail does not use a service-linked role for organization trails; it uses the CloudTrail service-linked role for the management account.

Answer

The KMS key used for encryption does not include permissions for the member accounts.

Answer

The CloudTrail service-linked role in the member accounts is missing.

Answer

An SCP attached to the affected member accounts denies cloudtrail:PutLogEvents.

Question 10

A company has a single AWS account with multiple IAM users. The security team wants to enforce that all users use MFA for API calls. An IAM policy is created that denies all actions unless MFA is present. The policy is attached to all users. However, users report that they can still make API calls without MFA. The security team reviews the policy and confirms it is correct. What is the most likely reason the policy is not being enforced?

Accepted Answer

The policy uses the wrong condition key; it should be 'aws:MultiFactorAuthPresent'.. Option C is correct. If users have an explicit Allow (e.g., from a group policy) that does not require MFA, the Deny in the MFA policy might not override if the Allow is from a different policy. However, the most common reason is that the policy is not attached to the user's groups or they have an inline policy that allows actions. But the question states the policy is attached to all users. Another possibility is that the condition key is misspelled. The correct condition key is 'aws:MultiFactorAuthPresent'. If the policy uses 'aws:MultiFactorAuthAge' or a different key, it may not work. Option A is wrong because SCPs are not used in a single account. Option B is wrong because CloudTrail does not enforce MFA. Option D is wrong because password policy does not affect API calls.

Answer

AWS CloudTrail is not enabled, so the policy cannot be evaluated.

Answer

An SCP at the root level allows all actions without MFA.

Answer

The IAM password policy does not require MFA.

Question 11

A company has an AWS account with multiple S3 buckets that contain sensitive data. The security team wants to ensure that no public access is granted to any bucket. The team has enabled AWS Config and set up a rule to detect public buckets. The rule reports that all buckets are compliant. However, during a security review, a team member finds that one bucket has a bucket policy that grants 's3:GetObject' to 'Principal': '*'. Why did the AWS Config rule not detect this?

Accepted Answer

The AWS Config rule only checks ACLs, not bucket policies.. Option A is correct. The AWS Config managed rule 's3-bucket-public-read-prohibited' checks for public read access via ACLs, not bucket policies. To detect public access via bucket policies, a custom rule is needed. Option B is wrong because CloudTrail would log access, not detect compliance. Option C is wrong because SCPs are for Organizations. Option D is wrong because IAM Access Analyzer analyzes resource-based policies but does not enforce.

Answer

AWS CloudTrail must be enabled for Config to evaluate policies.

Answer

The bucket is in a different AWS account.

Answer

IAM Access Analyzer must be enabled first.

Question 12

A security engineer is auditing an S3 bucket policy that allows cross-account access. The engineer wants to ensure that only encrypted connections are permitted. Which condition should be added to the policy?

Accepted Answer

aws:SecureTransport. Option C is correct because aws:SecureTransport is the condition key that enforces HTTPS. Option A is wrong because aws:SourceIp controls IP addresses, not encryption. Option B is wrong because s3:x-amz-server-side-encryption controls server-side encryption headers, not transport encryption. Option D is wrong because aws:Referer controls referrer headers.

Answer

aws:SourceIp

Answer

aws:Referer

Answer

s3:x-amz-server-side-encryption

Question 13

A company uses AWS Organizations with all features enabled. The security team needs to ensure that no member account can disable AWS CloudTrail logging or delete CloudTrail logs stored in S3. Which combination of preventive controls should be implemented?

Accepted Answer

Apply a service control policy (SCP) at the root OU to deny CloudTrail and S3 delete actions, and enable CloudTrail organizational trail.. Option B is correct because SCPs can deny actions like cloudtrail:DeleteTrail and s3:DeleteObject, and a CloudTrail organizational trail prevents member accounts from stopping logging. Option A is wrong because IAM policies are not enforced by root users. Option C is wrong because resource-based policies alone cannot prevent root user actions. Option D is wrong because CloudWatch alarms are detective, not preventive.

Answer

Set up CloudWatch alarms to notify when CloudTrail is modified or logs are deleted.

Answer

Use IAM policies in each member account to deny CloudTrail and S3 delete actions.

Answer

Apply an S3 bucket policy denying delete actions, and enable CloudTrail organizational trail.

Question 14

A security engineer is designing a system to centrally manage IAM users and roles across multiple AWS accounts. The company uses AWS Organizations. Which AWS service should be used to manage permissions across accounts?

Accepted Answer

AWS IAM Identity Center (AWS SSO). Option A is correct because AWS IAM Identity Center (formerly AWS SSO) is the service for centrally managing user access to multiple accounts. Option B is wrong because AWS Config is for resource compliance. Option C is wrong because AWS CloudTrail is for auditing API activity. Option D is wrong because AWS Artifact is for compliance reports.

Answer

AWS Config

Answer

AWS Artifact

Answer

AWS CloudTrail

Question 15

A company has a requirement to automatically rotate secrets for an RDS database every 90 days. The secrets are stored in AWS Secrets Manager. Which resource should be configured to perform the rotation?

Accepted Answer

AWS Lambda function. Option D is correct because Secrets Manager uses a Lambda function to rotate secrets. Option A is wrong because AWS Config is for compliance, not rotation. Option B is wrong because Amazon EventBridge can trigger rotation but the actual rotation logic is in Lambda. Option C is wrong because CloudWatch Logs is for log storage.

Answer

CloudWatch Logs subscription filter

Answer

Amazon EventBridge scheduled rule

Answer

AWS Config rule