SCS-C02 Management and Security Governance Practice Question
A security engineer is auditing IAM policies. The engineer wants to identify if any policy grants 'Effect: Allow' with 'Action: *' and 'Resource: *'. Which TWO AWS services can be used to detect such overly permissive policies?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Config
IAM Access Analyzer can analyze policies for broad permissions. AWS Config can evaluate custom rules to check for such policies. Option A (CloudTrail) logs usage, not policy content. Option B (Trusted Advisor) checks some but not all policies. Option E (GuardDuty) does not analyze IAM policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS CloudTrail
Why it's wrong here
CloudTrail logs usage, not policy content.
- ✗
AWS Trusted Advisor
Why it's wrong here
Trusted Advisor checks some but not all policies.
- ✓
AWS Config
Why this is correct
AWS Config can evaluate custom rules to check for overly permissive policies.
- ✓
IAM Access Analyzer
Why this is correct
IAM Access Analyzer can analyze policies for broad permissions.
- ✗
Amazon GuardDuty
Why it's wrong here
GuardDuty does not analyze IAM policies.
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 376-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.