SCS-C02 Management and Security Governance Practice Test 9 — 15 Questions

Question 1

A company is using AWS Organizations and wants to restrict the use of specific AWS services in member accounts. Which TWO approaches can be used to enforce these restrictions? (Choose TWO.)

Accepted Answer

Apply a service control policy (SCP) to the organizational unit (OU).. The correct answers are C and D. Option C: Service control policies (SCPs) applied to an organizational unit (OU) can centrally restrict the use of specific AWS services across all member accounts in that OU. Option D: Creating IAM policies in each member account to deny access to services is another approach, though it requires per-account management. Option A is incorrect because Service Quotas only limits resource counts, not service availability. Option B is incorrect because AWS CloudTrail only logs API activity and does not enforce restrictions. Option E is incorrect because AWS Config rules can detect non-compliant resources but cannot prevent their creation or usage.

Answer

Use Service Quotas to limit the number of resources per service.

Answer

Enable AWS CloudTrail to log service usage.

Answer

Use AWS Config rules to automatically terminate resources.

Question 2

A security engineer runs the above CloudTrail lookup command to investigate a change to the S3 bucket policy. The command only returns one event, but the engineer knows that the bucket policy was changed multiple times. What is the most likely reason?

Accepted Answer

The command is limiting results to one event.. The command uses --max-results 1, limiting output to one event. Option A is wrong because changes through the AWS Management Console are logged by CloudTrail. Option B is wrong because PutBucketPolicy is supported by CloudTrail and the event shown confirms it. Option C is wrong because filtering by ResourceName is not the issue; the --max-results parameter is the cause.

Answer

The bucket policy changes were made through the AWS Management Console, which is not logged.

Answer

The event is not logged because PutBucketPolicy is not supported by CloudTrail.

Answer

The command is filtering by the wrong attribute.

Question 3

A company has a single AWS account with multiple IAM users. The security team wants to enforce that all IAM users must use multi-factor authentication (MFA) to access the AWS Management Console. They attach an IAM policy that denies all actions if the user does not have MFA. However, after attaching the policy, some users report that they are unable to perform any actions even after authenticating with MFA. The policy uses the condition "aws:MultiFactorAuthPresent": "false". The security team verifies that the users have MFA enabled and are using it. What is the most likely cause of this issue?

Accepted Answer

The policy is incorrectly written; it should use "Effect": "Allow" and the condition "aws:MultiFactorAuthPresent": "true".. The correct approach is to use an Allow policy with the condition that MFA must be present. The Deny policy as written will deny all actions even when MFA is present if there is no other Allow policy granting permissions. Since IAM defaults to implicit deny, a Deny policy is not sufficient to grant access; it only restricts. Therefore, users cannot perform any actions because there is no Allow statement. Option C correctly identifies this.

Answer

The condition should be "Bool": "aws:MultiFactorAuthPresent": "false" but the policy uses StringLike.

Answer

The policy is missing a NotAction element; it should deny all actions except for the ones needed for MFA enrollment.

Answer

The users are signing in as the root user of the account, not as IAM users.

Question 4

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all member accounts have AWS CloudTrail enabled and that the logs are delivered to a centralized S3 bucket in the management account. The team creates an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail. Additionally, they enable CloudTrail organizational trail. However, after some time, they discover that one member account has disabled CloudTrail. What is the most likely reason this happened?

Accepted Answer

The SCP was applied to the management account instead of the member accounts.. The security team created an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail. If this SCP is attached to the management account only, it does not apply to member accounts. Therefore, member accounts are not restricted and can disable their own CloudTrail trails. The most likely reason for the member account disabling CloudTrail is that the SCP was applied to the management account instead of the member accounts.

Answer

The member account's root user performed the action, which bypasses the SCP.

Answer

The SCP was not attached to the organizational unit (OU) containing the member account.

Answer

The member account's IAM user used the AWS Management Console to disable CloudTrail.

Question 5

A startup is deploying a web application on AWS. The application runs on EC2 instances behind an Application Load Balancer (ALB). The security team wants to ensure that all traffic to the EC2 instances is encrypted. They configure the ALB to listen on HTTPS (port 443) and forward traffic to the EC2 instances on HTTP (port 80). Additionally, they create a security group for the EC2 instances that only allows inbound traffic from the ALB's security group on port 80. However, a security audit reveals that the traffic between the ALB and EC2 instances is not encrypted. Which step should the security team take to encrypt the traffic between the ALB and EC2 instances?

Accepted Answer

Configure the target group to use HTTPS protocol and install a certificate on the EC2 instances.. To encrypt traffic between the ALB and EC2 instances, configure the target group to use HTTPS protocol and install a certificate on the EC2 instances. This ensures the ALB sends HTTPS requests to the instances, encrypting the traffic. Option A is wrong because opening port 443 on the EC2 security group alone does not enable encryption; the listener must also use HTTPS for target traffic. Option B is wrong because encryption at rest protects data stored on disk, not data in transit. Option D is wrong because changing the ALB listener to TCP would terminate TLS at the ALB and forward unencrypted traffic to the targets, which defeats the purpose.

Answer

Update the EC2 security group to allow traffic on port 443 from the ALB.

Answer

Enable encryption at rest on the EC2 instances.

Answer

Change the ALB listener to use TCP instead of HTTPS.

Question 6

A company uses AWS Organizations and has a requirement to enforce that all EC2 instances launched in any account must have a specific tag "Environment" with value "Production". The security team wants to prevent any instance without this tag from being launched. They implement a service control policy (SCP) that denies the ec2:RunInstances action if the request does not include the required tag. However, they find that users are still able to launch instances without the tag. The SCP is attached to the root OU. The team also has an IAM policy that allows ec2:RunInstances with no conditions. What is the most likely reason the SCP is not preventing the launches?

Accepted Answer

The SCP uses ec2:ResourceTag instead of aws:RequestTag for the condition.. The SCP condition must use the `aws:RequestTag` condition key to enforce tags on creation, not `ec2:ResourceTag`. The `ec2:ResourceTag` key only evaluates tags on existing resources, so it does not apply when an instance is launched. An SCP using `ec2:ResourceTag` would not deny the launch because the condition is not evaluated on the API request. To prevent launches without the required tag, the SCP should use `aws:RequestTag` to check the tags in the request. Options A, B, and C are incorrect: SCPs apply to all principals including root, IAM policies do not override SCP denies, and the SCP is attached to the root OU, not the management account.

Answer

The SCP does not apply to the root user in member accounts.

Answer

The IAM policy allows the action, which overrides the SCP deny.

Answer

The SCP is applied to the management account, not the member accounts.

Question 7

A company has a multi-account AWS Organizations setup with hundreds of accounts. The Security team needs to enforce a policy that prohibits the creation of any S3 bucket with public read access across all accounts. They have enabled all features in Organizations and are using Service Control Policies (SCPs). The team creates an SCP with a Deny effect for s3:PutBucketAcl and s3:PutBucketPolicy when the request includes a condition that would make the bucket public. They attach the SCP to the root OU. However, a developer in a member account under the root OU is able to create a bucket with a bucket policy that grants public read access. The SCP is evaluated and shows the Deny is effective for s3:PutBucketPolicy but the bucket policy is still created. What is the MOST likely reason for this behavior?

Accepted Answer

The developer used a different API call, such as PutObject with public-read canned ACL, which is not blocked by the SCP because it does not match the denied actions.. The SCP denies s3:PutBucketAcl and s3:PutBucketPolicy, but if the developer uses a different API call such as PutObject with a public-read canned ACL, that action is not denied by the SCP. This allows the bucket to be created with public read access without triggering the denied actions. Option A is incorrect because S3 Block Public Access settings can override explicit permissions, not SCPs. Option C is incorrect because SCPs apply to all principals in the account, including IAM roles. Option D is incorrect because SCPs apply to all requests within the organization, not just those from outside.

Answer

The S3 Block Public Access settings at the account level are overriding the SCP.

Answer

The developer used an IAM role that is attached to an Amazon EC2 instance, which bypasses SCPs.

Answer

The SCP only denies actions when the request comes from outside the organization, but the developer is within the organization.

Question 8

A security engineer needs to ensure that all API calls made to AWS services are logged for auditing. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to AWS services, capturing details such as the identity of the caller, the time of the call, the source IP address, request parameters, and response elements. This provides a complete audit trail of user activity and API usage, which is essential for security auditing and compliance.

Answer

AWS Config

Answer

Amazon VPC Flow Logs

Answer

Amazon CloudWatch Logs

Question 9

A company wants to enforce that all S3 buckets are encrypted with SSE-KMS. Which AWS service can be used to automatically remediate non-compliant buckets?

Accepted Answer

AWS Config with auto-remediation. AWS Config with auto-remediation can enforce that all S3 buckets are encrypted with SSE-KMS. You create an AWS Config rule (e.g., s3-bucket-server-side-encryption-enabled) that evaluates bucket encryption settings, and attach an AWS Systems Manager Automation document (e.g., AWS-EnableS3BucketEncryption) as a remediation action. When a non-compliant bucket is detected, AWS Config automatically triggers the remediation action to enable SSE-KMS encryption on that bucket.

Answer

AWS CloudTrail with CloudWatch Events

Answer

AWS Service Catalog

Answer

AWS Organizations

Question 10

A security team needs to centrally manage permissions for multiple AWS accounts. Which AWS service should they use?

Accepted Answer

AWS Organizations with service control policies (SCPs). AWS Organizations with service control policies (SCPs) is the correct choice because SCPs allow you to centrally manage permissions across multiple AWS accounts by defining maximum permissions for member accounts. Unlike IAM policies that are attached to users or roles within a single account, SCPs act as a guardrail at the organization or organizational unit (OU) level, restricting what actions accounts and their IAM principals can perform, even if the account's own IAM policies allow more.

Answer

AWS IAM

Answer

AWS Config

Answer

AWS CloudTrail

Question 11

A company wants to grant cross-account access to an S3 bucket. What is the best practice for managing permissions?

Accepted Answer

Use an S3 bucket policy that grants access to the other account. An S3 bucket policy can explicitly grant cross-account access by specifying the other AWS account ID as the principal in the policy's Principal element. This allows the bucket owner to centrally manage permissions without requiring the target account to create an IAM role, and it works seamlessly with IAM user or role permissions in the external account. It is the recommended best practice for cross-account S3 access as per AWS documentation.

Answer

Use an IAM role in the target account

Answer

Use S3 ACLs with the other account ID

Answer

Use an SCP to allow access

Question 12

Which AWS service provides a centralized view of compliance status for AWS resources?

Accepted Answer

AWS Config. AWS Config is the correct answer because it provides a centralized view of compliance status by continuously evaluating your AWS resource configurations against desired policies (e.g., managed or custom rules). It generates compliance scores and detailed reports for each resource, enabling you to track whether your infrastructure adheres to internal or regulatory standards. This is distinct from other services because Config focuses specifically on configuration compliance, not threat detection or API activity.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

AWS Security Hub

Question 13

A company wants to enforce that all EC2 instances use a specific AMI ID. Which AWS service can be used to detect and remediate non-compliant instances?

Accepted Answer

AWS Config. AWS Config is the correct service because it continuously evaluates your AWS resource configurations against desired policies, such as requiring a specific AMI ID for all EC2 instances. You can create an AWS Config rule (e.g., a custom Lambda rule or a managed rule like 'ec2-instance-managed-by-systems-manager') to detect non-compliant instances, and then use AWS Config auto-remediation with Systems Manager Automation documents to terminate or replace them. This directly enforces compliance by both detecting and remediating violations.

Answer

AWS Systems Manager

Answer

Amazon Inspector

Answer

AWS CloudTrail

Question 14

A security engineer needs to monitor for unauthorized API calls in real-time. Which combination of services should be used?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Logs with metric filters. AWS CloudTrail records all API calls in an AWS account, and CloudWatch Logs can ingest those logs. By creating metric filters on CloudWatch Logs, you can define patterns that match unauthorized API calls (e.g., AccessDenied errors) and trigger alarms in real time. This combination provides the necessary logging and real-time monitoring capability.

Answer

Amazon S3 event notifications and AWS Lambda

Answer

AWS Config and Amazon SNS

Answer

Amazon GuardDuty and AWS CloudTrail

Question 15

Which AWS service allows you to create and manage encryption keys for your AWS resources?

Accepted Answer

AWS Key Management Service (KMS). AWS Key Management Service (KMS) is the managed service designed specifically for creating, storing, and managing encryption keys used to encrypt data across AWS services. It integrates with AWS CloudTrail for auditing key usage and supports symmetric and asymmetric keys, with automatic key rotation and fine-grained access control via IAM and key policies.

Answer

AWS CloudHSM

Answer

AWS Certificate Manager

Answer

AWS Secrets Manager