SCS-C02 Management and Security Governance Practice Question
A company wants to centrally manage and enforce backup policies for all EC2 instances across multiple AWS accounts. Which AWS service should be used?
⚠ Common exam trap
It's easy for candidates to confuse AWS Config's compliance evaluation (which can detect missing backups) with actual backup enforcement, or they mistakenly think CloudFormation StackSets can schedule backups, but neither service provides the centralized backup lifecycle management that AWS Backup offers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Backup
AWS Backup is the correct service because it provides a centralized, policy-based solution to define and enforce backup policies across multiple AWS accounts and regions. It integrates with AWS Organizations to manage backups for EC2 instances and other supported resources, ensuring compliance with governance requirements without needing custom scripts or manual processes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Config
Why it's wrong here
AWS Config is a governance service that records and evaluates the configuration of AWS resources against conformance packs and rules. While a Config rule can detect resources that lack a backup plan, it cannot schedule or perform backups itself—it only reports compliance and optionally triggers an automated remediation action. Because it is a detective control rather than an enforcement mechanism for backup policies, it does not meet the requirement.
- ✗
AWS CloudFormation StackSets
Why it's wrong here
AWS CloudFormation StackSets extends CloudFormation to deploy identical stacks across multiple accounts and regions, which is useful for provisioning infrastructure consistently. You could use StackSets to deploy AWS Backup resources like backup plans or IAM roles, but StackSets itself is an IaC deployment mechanism, not a backup policy authority—it has no inherent concept of backup schedules, retention windows, or lifecycle rules. Centrally managing and enforcing backup policies requires the AWS Backup service, not just resource deployment.
- ✓
AWS Backup
Why this is correct
AWS Backup is the fully managed, policy-based backup service that centralizes and automates backup scheduling, retention, and cross-region/cross-account copying across AWS services. You define backup plans with rules for frequency and retention, assign resources via tags or resource IDs, and AWS Backup enforces those policies continuously—including creating backups on schedule and enforcing lifecycle transitions to cold storage or expiration. This meets the requirement to centrally manage and enforce backup policies.
- ✗
AWS Systems Manager
Why it's wrong here
AWS Systems Manager is an operations and management service for patching, running commands, inventory, and automation—it is not a backup orchestration layer. While Systems Manager Automation documents can invoke AWS Backup APIs or AWS CLI commands like manual backup triggers, the service has no native policy model for backup frequency, retention, or resource assignment. The responsibility for enforcing a central backup policy lies with AWS Backup, making Systems Manager the wrong service for this requirement.
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 1,205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.