SCS-C02 Management and Security Governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  AWS IAM Access Analyzer

  Why this is correct

  AWS IAM Access Analyzer is correct because it performs automated, semantic analysis of the trust policy attached to the IAM role and identifies whether the role can be assumed by principals outside your AWS account or AWS organization. It generates concrete findings for external access, including the exact external principal and the action that grants access, so your security team can directly review and remediate the role. Other services merely log or aggregate activity; Access Analyzer specifically applies reachability logic to the policy statements.

• ✗

  AWS CloudTrail Insights

  Why it's wrong here

  AWS CloudTrail Insights is incorrect because it analyzes management-event telemetry to detect unusual API activity, such as large increases in AssumeRole calls or abnormal access patterns, but it never inspects the role's trust policy to determine whether external access is permitted. It can show that an external principal did assume the role after the fact, but it cannot proactively reveal that the trust relationship grants that capability. Without previously recorded calls, it has no way to model the permissions that the policy allows.

• ✗

  AWS Config

  Why it's wrong here

  AWS Config is incorrect because it evaluates IAM role configurations against compliance rules and tracks configuration changes, but its standard rule set does not parse trust-policy statements for external principals or compute effective cross-account access. A role with a trust policy that allows any AWS account can still be marked compliant unless you write and maintain a custom Config rule specifically for that check. Config is a configuration recorder, not a policy reachability analyzer.

• ✗

  AWS Security Hub

  Why it's wrong here

  AWS Security Hub is incorrect because it is an aggregation and correlation service that ingests findings from multiple enabled services, such as GuardDuty, Config, and IAM Access Analyzer, but it does not independently analyze IAM trust policies. If Access Analyzer is not enabled, Security Hub will never produce an external-access finding for this role, and even if a finding appears, the origin is Access Analyzer rather than Security Hub's own logic. Enabling Security Hub alone gives no visibility into the role's trust policy.

Go deeper

Related to this question