SCS-C02 Management and Security Governance — Timed 15 Questions

Question 1

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that all S3 buckets across all accounts are encrypted with AWS KMS. Which policy should be used to enforce this?

Accepted Answer

Create an SCP at the root OU that denies s3:PutBucketAction without encryption. Option B is correct because Service Control Policies (SCPs) at the root OU can deny the s3:PutBucketAction (which includes s3:PutBucketEncryption) unless the request includes encryption settings that use AWS KMS. This enforces encryption at the organizational level, overriding any account-level permissions, and ensures that all S3 buckets across all accounts are encrypted with KMS.

Answer

Apply a bucket policy on each bucket denying PutObject without encryption

Answer

Enable AWS Config with the s3-bucket-server-side-encryption-enabled rule

Answer

Attach an IAM policy to each account's admin user requiring encryption

Question 2

A security engineer needs to grant cross-account read access to an S3 bucket in Account A to a user in Account B. What is the correct combination of actions?

Accepted Answer

Apply a bucket policy in Account A granting access to the principal in Account B, and attach an IAM policy to the user in Account B allowing the action. Cross-account S3 access requires both a bucket policy in the resource account (Account A) that explicitly grants the cross-account principal (the user in Account B) the s3:GetObject action, and an IAM policy attached to the user in Account B that allows the same action. This two-way authorization is necessary because the bucket policy controls access to the S3 resource, while the IAM policy controls the user's permissions to initiate the request. Without both, the request will be denied by either the resource-based policy or the identity-based policy.

Answer

Attach an IAM policy to the user in Account B allowing the action; no bucket policy needed

Answer

Apply a bucket policy in Account A granting access to the user in Account B; no user policy needed

Answer

Use S3 bucket ACLs to grant READ access to the Account B user

Question 3

A company uses AWS Config to evaluate resource compliance. The security team notices that the AWS::IAM::Group resource type is not supported by AWS Config managed rules. What is the best way to detect IAM groups that have an inline policy allowing 'iam:CreateUser'?

Accepted Answer

Create a custom AWS Config rule using a Lambda function that evaluates IAM groups. AWS Config managed rules do not support the AWS::IAM::Group resource type, so you cannot use a managed rule to evaluate inline policies on IAM groups. The best approach is to create a custom AWS Config rule backed by a Lambda function that can evaluate the IAM group's inline policies and trigger a compliance check when the group configuration changes. This allows you to detect any inline policy that contains the 'iam:CreateUser' action.

Answer

Use IAM Access Analyzer to identify policies that grant broad access

Answer

Use AWS CloudTrail Insights to detect CreateUser events

Answer

Enable AWS Config advanced query and run a query on IAM groups

Question 4

A company wants to use AWS CloudTrail to log all API activity across multiple accounts in AWS Organizations. Which configuration meets the requirement of centralized logging with minimal operational overhead?

Accepted Answer

Create an organization trail in the management account that applies to all accounts. Option D is correct because creating an organization trail in the management account automatically applies to all accounts in AWS Organizations, centralizing CloudTrail logs into a single S3 bucket without requiring per-account configuration. This approach minimizes operational overhead by leveraging the Organizations integration, which handles log delivery from member accounts transparently.

Answer

Create a CloudTrail trail in each account and aggregate logs to a common S3 bucket

Answer

Enable CloudTrail in each account and use cross-account roles to centralize logs

Answer

Use AWS Config to record API calls and send to CloudWatch Logs

Question 5

A security team needs to audit all changes to IAM policies in their AWS account. Which AWS service should they use to record policy changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made in the AWS account, including IAM policy changes (e.g., CreatePolicy, PutRolePolicy, AttachUserPolicy). These events are captured as CloudTrail log entries, providing a complete audit trail of who made the change, when, and from which source IP. This directly meets the requirement to audit all changes to IAM policies.

Answer

Amazon Inspector

Answer

Amazon GuardDuty

Answer

AWS Config

Question 6

A company uses AWS Organizations with SCPs. The security team wants to ensure that no IAM user can be created without MFA. Which SCP should be applied at the root OU?

Accepted Answer

Deny iam:CreateUser unless the request includes a condition for MFA. Option C is correct because it uses a Service Control Policy (SCP) to deny the `iam:CreateUser` action unless the request includes a condition that MFA is present. SCPs are account-level permission boundaries in AWS Organizations, and this approach ensures that no IAM user can be created without MFA across all accounts in the organization, as SCPs are evaluated before any IAM policies.

Answer

Deny iam:CreateUser unconditionally

Answer

Use an IAM policy to require MFA for API calls

Answer

Attach an IAM policy to all users requiring MFA

Question 7

A security engineer needs to ensure that all EC2 instances launched in a development account are tagged with a cost center. What is the most effective way to enforce this?

Accepted Answer

Use an IAM policy that denies ec2:RunInstances unless the request includes the cost center tag. Option D is correct because using an IAM policy with a condition key (e.g., `aws:RequestTag`) that denies `ec2:RunInstances` unless the `cost center` tag is specified in the API call enforces tagging at launch time. This prevents any untagged instance from being created, providing proactive enforcement rather than reactive detection or remediation.

Answer

Use AWS Config to detect untagged instances and send alerts

Answer

Use AWS Systems Manager to tag instances after launch

Answer

Create a tag policy in AWS Organizations requiring the cost center tag

Question 8

A company wants to centrally manage access keys for IAM users. Which AWS service can generate and rotate access keys automatically?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct service because it natively supports automatic rotation of secrets, including IAM user access keys. You can configure a rotation schedule (e.g., every 30 days) and Secrets Manager will generate a new access key pair, update the IAM user, and optionally disable or delete the old key. This provides a fully managed, centralized solution for rotating access keys without custom scripting.

Answer

AWS CloudHSM

Answer

AWS KMS

Answer

AWS Systems Manager Parameter Store

Question 9

A company uses AWS Config to record resources. Which TWO actions can be taken to automatically remediate non-compliant resources detected by AWS Config rules?

Accepted Answer

Configure AWS Config rules to invoke an AWS Lambda function for remediation. Option A is correct because AWS Config rules can be configured with remediation actions that invoke an AWS Lambda function. When a resource is evaluated as non-compliant, the rule triggers the Lambda function, which can execute custom logic to modify or fix the resource, such as adjusting security group rules or enabling encryption. This provides automated, programmable remediation directly integrated with AWS Config's evaluation lifecycle.

Answer

Configure AWS Config rules to send notifications to an SNS topic

Answer

Use AWS CloudTrail to log non-compliant events

Answer

Use Amazon CloudWatch Events to trigger an AWS Step Functions state machine

Question 10

A company wants to implement least privilege access for a data analytics team that uses Amazon Athena to query data in S3. Which THREE steps should be taken?

Accepted Answer

Grant write access to an S3 bucket for query results. Option B is correct because Athena requires a dedicated S3 bucket to store query results, and granting write access to that specific bucket ensures the service can write output without exposing other data. This aligns with least privilege by limiting write permissions to only the necessary location.

Answer

Grant full S3 access to all buckets

Answer

Grant access to Amazon Redshift

Question 11

A security engineer is designing a solution to protect sensitive data in S3. Which THREE mechanisms can be used to enforce encryption at rest?

Accepted Answer

Use an SCP to deny s3:PutObject without encryption. Option A is correct because an SCP (Service Control Policy) can be applied at the organizational level to deny any s3:PutObject action that does not include encryption parameters. This enforces encryption at rest across all accounts in the organization, preventing users from uploading unencrypted objects regardless of individual bucket policies or default encryption settings.

Answer

Enable cross-region replication

Answer

Enable MFA Delete on the S3 bucket

Question 12

Refer to the exhibit. A security engineer applies this bucket policy to an S3 bucket. A user without HTTPS tries to download an object. What is the outcome?

Accepted Answer

The request is denied because the condition matches. The bucket policy includes a condition that denies requests when `aws:SecureTransport` is `false`. Since the user attempts to download an object without HTTPS, the condition matches, and the explicit Deny effect overrides any Allow. Therefore, the request is denied.

Answer

The request fails because the condition does not match

Answer

The request succeeds because the policy has a Deny effect

Answer

The request succeeds because the resource is not specific enough

Question 13

Refer to the exhibit. A role has two policies attached. The custom policy includes an Allow for s3:PutObject. An IAM user assumes this role and tries to upload a file to S3. What happens?

Accepted Answer

The upload succeeds because the custom policy allows s3:PutObject. The upload succeeds because IAM evaluates policies in a default-deny environment, and the custom policy attached to the role explicitly allows s3:PutObject. When a user assumes the role, the effective permissions are the union of all attached policies; the managed policy's read-only restriction does not block the explicit allow for s3:PutObject. Since there is no explicit deny for s3:PutObject, the allow from the custom policy grants the action.

Answer

The upload fails because the managed policy only allows read

Answer

The upload is denied by default because no explicit allow

Answer

The upload fails because the managed policy overrides the custom policy

Question 14

A company runs a multi-account AWS environment using AWS Organizations. The security team uses AWS Config to monitor compliance. Recently, they noticed that a developer in the 'development' account created an S3 bucket that is publicly accessible. The security team wants to prevent this in the future by automatically remediating any public S3 bucket. They have an SCP that denies s3:PutBucketPublicAccessBlock, but developers are still making buckets public by using bucket ACLs. The security team wants to implement a solution that automatically fixes any bucket that becomes public. Which solution should they choose?

Accepted Answer

Use AWS Config with the s3-bucket-public-read-prohibited managed rule and an automatic remediation action using AWS Systems Manager Automation. Option B is correct because AWS Config's s3-bucket-public-read-prohibited managed rule evaluates S3 bucket ACLs and policies for public read access. When a noncompliant bucket is detected, an automatic remediation action using AWS Systems Manager Automation can invoke a custom SSM document (e.g., AWS-DisableS3BucketPublicReadWrite) to remove public ACLs or apply a bucket policy that denies public access. This provides automated, event-driven remediation without relying on manual intervention or incomplete SCPs.

Answer

Use CloudTrail to detect PutBucketAcl events and send to SNS for manual remediation

Answer

Update the SCP to deny s3:PutBucketAcl with a condition for public access

Answer

Attach an IAM policy to all users that denies s3:PutBucketAcl

Question 15

A company uses AWS Organizations with a single management account and multiple member accounts. The security team needs to ensure that all member accounts automatically deploy AWS Config rules to audit security group configurations. Which solution meets this requirement with minimal operational overhead?

Accepted Answer

Use AWS Config conformance packs deployed via AWS CloudFormation StackSets from the management account.. Option C is correct because AWS Config conformance packs, deployed via AWS CloudFormation StackSets from the management account, allow you to centrally deploy a collection of AWS Config rules and remediation actions across all member accounts in an AWS Organization. This approach ensures consistent security group auditing with minimal operational overhead, as StackSets automatically handle deployment, updates, and drift detection across accounts and Regions.

Answer

Configure an AWS Lambda function in each account that periodically checks security group compliance.

Answer

Enable AWS Security Hub and rely on its built-in security group checks.

Answer

Create an AWS Config rule in each member account manually using AWS CloudFormation templates.