CCNA Security Governance Questions

The correct options are B and E. Option B: Enabling S3 default encryption on the bucket automatically encrypts objects at rest using the specified encryption method (SSE-S3 or SSE-KMS). Option E: A bucket policy can deny PutObject requests that do not include the x-amz-server-side-encryption header, ensuring objects are uploaded with encryption enforced.

Option A is incorrect because using an AWS KMS key with automatic key rotation is a method of encryption, not an enforcement mechanism; the question asks for ways to enforce encryption at rest. Option C is incorrect because AWS CloudTrail logs API calls, not encryption enforcement. Option D is incorrect because IAM policies control user permissions but cannot directly enforce encryption at the service level; they can deny actions but encryption enforcement is typically done via bucket policies or default encryption.

Option B uses an IAM policy with a condition on the ec2:InstanceProfile key to ensure that only approved instance profiles are used. This satisfies both requirements: a role must be attached, and it must be one of the approved roles.

Option A is incorrect because an SCP that requires an IAM role cannot restrict the role to a specific set of approved roles; it would allow any role.

Option C is incorrect because SCPs require AWS Organizations and apply to all principals in the account. While SCPs can technically use the ec2:InstanceProfile condition key, they are typically used for broad guardrails and not for user-specific restrictions. An IAM policy with a condition is the recommended method for this use case.

Option D is incorrect because AWS Config is a detective service; it cannot prevent unauthorized launches, only detect them after the fact.

The bucket owner (the root user of the AWS account that owns the bucket) is not subject to bucket policies. Since the IAM user is the bucket owner (same account), the bucket policy's deny condition does not restrict their actions. Therefore, the IAM user can delete objects from outside the VPC.

Option A is incorrect because the bucket policy does deny s3:DeleteObject for non-VPC requests; the issue is that the policy does not apply to the owner. Option B is incorrect because the VPC endpoint policy only applies to requests coming through the endpoint, and the user is not using the endpoint. Option D is incorrect because ACLs are not relevant here; even if an ACL allowed the deletion, the bucket policy would typically override it, but again, the policy does not apply to the owner.

By tagging accounts in AWS Organizations (e.g., Environment=Dev) and using Service Control Policies (SCPs) with conditions based on those tags, the security team can restrict usage of specific AWS services per account environment. SCPs are applied at the organization level and affect all users and roles in the account, providing preventive controls. Option A is incorrect because CloudTrail only logs API calls and does not prevent usage; revoking access after the fact is not a preventive measure.

Option B is incorrect because IAM roles are identity-based and do not restrict services at the account level; also, managing roles per account would be cumbersome. Option D is incorrect because AWS Config rules detect non-compliant resource configurations but do not prevent the use of services; they are detective controls.

Options A and D are correct. To monitor security group changes with AWS Config, you need to create an AWS Config rule (option D) that tracks changes to security groups. To receive notifications when the rule triggers, you configure an SNS topic and subscribe to it (option A).

Option B is incorrect because AWS CloudTrail logs API calls to security groups, but Config itself monitors resource configuration changes without requiring CloudTrail. Option C is incorrect because Amazon GuardDuty is a threat detection service, not a configuration change monitor. Option E is incorrect because VPC Flow Logs capture network traffic, not configuration changes.

The common pitfall is assuming CloudTrail or GuardDuty is necessary, but Config's built-in change tracking suffices.

(AWS Security Hub) is correct because it can aggregate findings from other services like AWS Config and Amazon GuardDuty, providing a centralized view and alerting for S3 bucket public access issues. Option C (AWS Config) is correct because it can evaluate S3 bucket policies against a managed rule (e.g., s3-bucket-public-read-prohibited) to detect public access and trigger alerts. Option D (AWS CloudTrail) is correct because it logs S3 API calls such as PutBucketPolicy, and you can create CloudWatch Events or metric filters to alert on changes that grant public access.

Option B (Amazon S3 Block Public Access) is incorrect; it is a preventive control that blocks public access but does not detect or alert on existing public buckets. Option E (Amazon VPC Flow Logs) is incorrect because it captures network traffic data, not S3 bucket policy changes.

To prevent accidental deletion of KMS keys, you must deny the kms:ScheduleKeyDeletion permission. An IAM policy attached to the key (key policy) or to the user/role can explicitly deny this action. Option B is correct because it directly denies the permission needed to schedule deletion.

Option A (SCP denying kms:ScheduleKeyDeletion) can be used at the organizational level but is not the most direct per-key control. Option C (automatic key rotation) does not prevent deletion. Option D is invalid because KMS does not have a deletion protection toggle; protection is achieved through IAM/key policies.

IAM policies do not have an explicit Deny by default; the Allow with condition only grants access from the specified IP range. However, other policies (like a bucket policy or another IAM policy) could grant access from other IPs, overriding the condition. To prevent access from outside the IP range, an explicit Deny for all other IPs is required.

Option B is incorrect because the condition key 'aws:SourceIp' is correctly spelled; it uses a capital 'S' and 'I'. Option C is incorrect because while a bucket policy allowing public access could override, the most likely reason in this scenario is that the IAM policy is missing an explicit Deny, as that is a common misconfiguration. Option D is incorrect because if the resource ARN is missing the bucket name, the policy would not apply to the bucket at all, and the user would not have access, contradicting the ability to access from any IP.

To enforce encryption at rest using AWS KMS for all objects uploaded to an S3 bucket, the security engineer should:

Option A (enabling bucket keys) is wrong because it reduces KMS API calls for already KMS-encrypted objects, but does not enforce encryption. Option C (enforcing SSL) addresses encryption in transit, not at rest, and thus does not meet the policy requirement.

The correct answer. SCPs cannot enable CloudTrail, but they can prevent disabling it and modifying the S3 bucket policy. To actually enable CloudTrail across all accounts with minimal overhead, AWS CloudFormation StackSets can deploy a CloudTrail trail in each account automatically.

Option A is incorrect because SCPs cannot enable services—they only deny or allow actions. Option B is incorrect because AWS Trusted Advisor only checks and alerts; it does not enforce configurations. Option D is incorrect because AWS Config rules with auto-remediation can work but involve more setup and overhead compared to using StackSets, which is purpose-built for deploying resources across multiple accounts.

Therefore, C provides the least operational overhead.

The correct action is to create an IAM policy that denies access unless MFA is present and attach it to all IAM users. This policy uses a condition key like 'aws:MultiFactorAuthPresent' to block API calls when MFA is not used, effectively enforcing MFA for console login. Option A is incorrect because service control policies (SCPs) apply at the AWS Organizations level, not to individual IAM users, and cannot enforce MFA on console login.

Option C is wrong because sharing root user credentials violates security best practices and does not enforce MFA for each user. Option D is incorrect because AWS account password policies do not include an MFA requirement; they only manage password complexity and rotation.

Using S3 pre-signed URLs grants time-limited access to specific objects without requiring the auditor to have AWS credentials. Option A is wrong because CloudTrail does not provide built-in console access for auditors. Option B is wrong because granting s3:GetObject on the entire bucket would allow access to all objects, not just specific log files.

Option D is wrong because a bucket policy granting s3:GetObject to a specific prefix still requires the auditor to have AWS credentials, and the policy must explicitly deny s3:ListBucket to prevent listing; even then, managing credentials for a third party is less secure than using pre-signed URLs.

The most cost-effective because it uses an S3 lifecycle policy to transition objects to S3 Glacier after 30 days (reducing storage costs for older logs) and then expires (deletes) them after 7 years to meet the retention requirement. Option A is wrong because storing logs directly in S3 Glacier Deep Archive is not cost-effective for logs that may be accessed occasionally and does not automatically expire after 7 years without additional policy. Option B is wrong because simply deleting after 7 years does not take advantage of cheaper storage tiers.

Option C is wrong because CloudTrail trails do not have a retention setting; retention must be managed via S3 lifecycle policies.

The most likely cause is that the S3 bucket policy does not grant write access to the CloudTrail service for the affected member accounts. When an organization trail is created, CloudTrail uses the management account's permissions to deliver logs to the S3 bucket. However, the bucket policy must explicitly allow the CloudTrail service principal from each member account to write logs.

If the policy only allows the management account, member accounts' logs will be rejected. Option A is incorrect because the issue is not about KMS key permissions; if SSE-KMS is used, the key policy must also grant decrypt permissions to CloudTrail, but the question does not mention KMS. Option C is incorrect because CloudTrail does not use a service-linked role for organization trails; it uses the CloudTrail service role in the management account.

Option D is incorrect because an SCP denying cloudtrail:PutLogEvents would affect all CloudTrail actions, but the logs from other accounts are still arriving, so it is unlikely.

The most efficient way to enforce CloudTrail across all accounts in an AWS Organization is to use a Service Control Policy (SCP) that denies the ability to stop or modify CloudTrail settings. SCPs are applied at the organization level and affect all member accounts, preventing any user or role from disabling CloudTrail or changing trail configuration, regardless of their IAM permissions. This ensures compliance without needing per-account setup.

Option B (Trusted Advisor) only provides alerts, not enforcement. Option C requires manual configuration per account, which is inefficient and error-prone. Option D (AWS Config rules) can detect non-compliance but cannot prevent changes from being made.

Using the 'aws:SourceAccount' condition key with the company's account ID ensures that only requests originating from that account are allowed, effectively blocking cross-account access from other accounts. Option A is incorrect because SCPs apply to principals within the organization and cannot restrict access from external accounts ('aws:SourceAccount' is not evaluated for SCPs). Option B is incorrect because simply removing the bucket policy would break all cross-account access but also removes any existing policy-based permissions within the account; adding IAM policies alone does not grant cross-account access and may not be the most effective solution.

Option C is incorrect because 'aws:SourceArn' is typically used for service-to-service access (e.g., SNS to S3) and does not reliably restrict by account; the proper condition key for account-level restriction is 'aws:SourceAccount'.

Using an IAM policy with a condition key 'aws:RequestTag/Creator' set to '${aws:username}' ensures that any EC2 RunInstances request must include the tag 'Creator' with the IAM user's name, otherwise the request is denied. This enforces tagging at the time of instance creation. Option A (CloudTrail) only provides auditing, not enforcement.

Option C (AWS Config rules) can detect and remediate after creation but is less efficient than proactive enforcement. Option D (SCP) can deny based on missing tags but cannot enforce the tag value to match the user name; also, SCPs are used for account-wide policies, not per-user.

AWS Config rules can detect EC2 instances that are missing the required tag and trigger an automatic remediation action via a Lambda function to terminate them, providing a fully automated solution with minimal effort. Option A is wrong because SCPs cannot enforce tagging on individual EC2 instances at launch time; they can only deny actions based on conditions, but tagging conditions are not supported for ec2:RunInstances. Option B is wrong because AWS Organizations Tag Policies enforce tagging on resources but do not automatically remediate non-compliant resources; they only prevent creation of resources without tags if applied at the service level, which is not the case here.

Option D is wrong because CloudTrail logs events but cannot automatically terminate instances; it would require manual intervention or additional automation.

AWS CloudTrail logs IAM CreateUser, CreateRole, and AttachRolePolicy events. Amazon CloudWatch Logs can use metric filters to capture these events and trigger CloudWatch Alarms for real-time alerts. CloudTrail also stores historical logs for analysis.

Option A is the correct combination. Option B (GuardDuty and Lambda) is focused on threat detection, not specific IAM administrative privilege creation events. Option C (Trusted Advisor and SES) provides best-practice recommendations and email notifications, not real-time API monitoring.

Option D (AWS Config and SNS) evaluates resource configuration compliance but does not monitor API calls in real time.

Options C and D are correct. Option C is correct because IAM policies should grant only the necessary actions, adhering to least privilege. Option D is correct because SCPs can deny actions that are not required across accounts, enforcing least privilege at the organization level.

Option A is wrong because using the root user for daily administration grants unrestricted access, violating least privilege. Option B is wrong because S3 bucket policies that allow all IAM users do not restrict permissions per user. Option E is wrong because assigning the AdministratorAccess managed policy grants full access, contradicting least privilege.

Amazon EventBridge (option B) can detect S3 bucket policy changes via CloudTrail (e.g., PutBucketPolicy events) and invoke an AWS Lambda function to remove the public policy, providing automatic remediation. Option A is incorrect because S3 event notifications on ObjectCreated only respond to object-level events, not bucket policy changes. Option C is incorrect because CloudWatch Logs with a metric filter and alarm can only send notifications, not directly remediate the bucket policy.

Option D is incorrect because while AWS Config can detect non-compliant buckets with the managed rule 's3-bucket-public-read-prohibited', automatic remediation typically requires a custom Lambda function or Systems Manager Automation, and the option specifies Systems Manager, which is not as serverless-native as using Lambda directly; moreover, the combination described does not automatically revoke access without additional components.