SCS-C02 Management and Security Governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Manually reset each user's password to a strong password.

  Why it's wrong here

  Manually resetting each user's password is an administrative one-off action that does not modify the account-level password policy or enforce future compliance. Even if you supply a strong temporary password, the user can immediately change it—unless your password policy already rejects weak passwords—and there is no guarantee that every user across the account is covered in a timely manner. This approach is not operationally feasible for large accounts and does not force existing users to adopt the new strong-password standard.

• ✗

  Enable 'Allow users to change their own password' in the policy.

  Why it's wrong here

  Enabling 'Allow users to change their own password' in the IAM password policy simply grants users the self-service permission to update their password; it does not create any obligation or mechanism to change an existing weak password. Users may continue using their current credentials indefinitely without ever setting a strong password, so this setting alone fails to meet the requirement that all IAM users must use strong passwords. A corresponding expiration or forced-reset setting is necessary.

• ✗

  Re-apply the password policy to each user.

  Why it's wrong here

  The IAM password policy is defined at the AWS account level, not per user, so 're-applying' it to individual users has no meaning and no effect on their current password state. Because the policy automatically governs all IAM users once set, existing passwords remain in force until they expire or are explicitly reset by an administrator. This action addresses no underlying problem and cannot compel users with weak passwords to rotate them immediately.

• ✓

  Set the password expiration period to 0 to force immediate password change.

  Why this is correct

  Setting the 'password expiration period' to 0 in the IAM account password policy causes every existing password to expire immediately, forcing each IAM user to choose a new password at the next sign-in. Because the account-level policy has already defined the required strength, the newly chosen passwords must satisfy those strong-complexity rules. This is the only listed option that enforces the strong-password requirement collectively on all users without requiring manual intervention per user.

Go deeper

Related to this question