Free Preparation Discussions
MENU
Amazon SCS-C02 Exam Questions
Free Amazon SCS-C02 Exam Actual Questions
Note: Premium Questions for SCS-C02 were last updated On May. 25, 2026 (see below)
[Identity and Access Management]
A security administrator is restricting the capabilities of company root user accounts. The company uses AWS Organizations and has all features enabled. The management account is used for billing and administrative purposes, but it is not used for operational AWS resource purposes.
How can the security administrator restrict usage of member root user accounts across the organization?
Restrict Root User Capabilities Using Service Control Policies (SCPs):
SCPs in AWS Organizations provide the ability to control permissions for AWS accounts in the organization.
Create a new organizational unit (OU) and move all member accounts into this OU.
Create SCP for Root User Restrictions:
Define an SCP that denies critical actions likeiam:CreateUser,iam:DeleteUser, or other high-risk actions for the root user. Example SCP:
{
'Version': '2012-10-17',
'Statement':
[
{
'Effect': 'Deny',
'Action': '*',
'Resource': '*',
'Condition': {
'StringEquals': {
'aws:PrincipalAccountRoot': 'true'
}
}
}
]
}
Enforce Multi-Factor Authentication (MFA):
Enable MFA on root accounts for additional security.
Monitor Root User Activity:
Use AWS CloudTrail to monitor and log root user actions. Configure alerts with CloudWatch for any unauthorized root usage.
AWS Organizations SCP Documentation
Best Practices for Root User Account
[Identity and Access Management]
A development team is attempting to encrypt and decode a secure string parameter from the IAM Systems Manager Parameter Store using an IAM Key Management Service (IAM KMS) CMK. However, each attempt results in an error message being sent to the development team.
Which CMK-related problems possibly account for the error? (Select two.)
https://docs.IAM.amazon.com/kms/latest/developerguide/services-parameter-store.html#parameter-store-cmk-fail
[Infrastructure Security]
A company has AWS accounts in an organization in AWS Organizations. The company needs to install a corporate software package on all Amazon EC2 instances for all the accounts in the organization.
A central account provides base AMIs for the EC2 instances. The company uses AWS Systems Manager for software inventory and patching operations.
A security engineer must implement a solution that detects EC2 instances ttjat do not have the required software. The solution also must automatically install the software if the software is not present.
Which solution will meet these requirements?
Utilizing AWS Config with a custom AWS Config rule (ec2-managedinstance-applications-required) enables detection of EC2 instances lacking the required software across all accounts in an organization. By creating an Amazon EventBridge rule that triggers on AWS Config events, and configuring it to invoke an AWS Lambda function, automated actions can be taken to ensure compliance. The Lambda function can leverage AWS Systems Manager Run Command to install the necessary software on non-compliant instances. This approach ensures continuous compliance and automated remediation, aligning with best practices for cloud security and management.
[Logging and Monitoring]
A company uses Amazon API Gateway to present REST APIs to users. An API developer wants to analyze API access patterns without the need to parse the log files.
Which combination of steps will meet these requirements with the LEAST effort? (Select TWO.)
[Logging and Monitoring]
A company needs to follow security best practices to deploy resources from an AWS CloudFormation template. The CloudFormation template must be able to configure sensitive database credentials.
The company already uses AWS Key Management Service (AWS KMS) and AWS Secrets Manager.
Which solution will meet the requirements?
Option A: This option meets the requirements of following security best practices and configuring sensitive database credentials in the CloudFormation template.A dynamic reference is a way to specify external values that are stored and managed in other services,such as Secrets Manager, in the stack templates1.When using a dynamic reference, CloudFormation retrieves the value of the specified reference when necessary during stack and change set operations1.Dynamic references can be used for certain resources that support them, such as AWS::RDS::DBInstance1. By using a dynamic reference to reference the database credentials in Secrets Manager, the company can leverage the existing integration between these services and avoid hardcoding the secret information in the template.Secrets Manager is a service that helps you protect secrets needed to access your applications, services, and IT resources2.Secrets Manager enables you to rotate, manage,and retrieve database credentials, API keys, and other secrets throughout theirlifecycle2.
- Select Question Types you want
- Set your Desired Pass Percentage
- Allocate Time (Hours : Minutes)
- Create Multiple Practice tests with Limited Questions
- Customer Support
William Rivera
10 days agoDorothy Parker
10 days agoDeborah Hall
10 days agoRobert Nelson
10 days agoBarbara Carter
13 days agoRyan Phillips
20 days agoRobert Morris
21 days agoJessica Johnson
1 month agoSusan King
1 month agoJoseph Parker
1 month agoEmily Lopez
23 days agoEmily Hernandez
1 month agoSharon Hernandez
29 days agoJohn Cook
1 month agoTwana
2 months agoEarlean
2 months agoTyisha
2 months agoLajuana
3 months agoTammi
3 months agoJustine
3 months agoNiesha
3 months agoJonelle
4 months agoLatosha
4 months agoAlita
4 months agoTitus
4 months agoHelaine
5 months agoRoyal
5 months agoAnnelle
5 months agoAudrie
5 months agoMiesha
6 months agoRossana
6 months agoSharika
6 months agoVivienne
6 months agoRasheeda
7 months agoDannette
7 months agoDorinda
7 months agoShakira
7 months agoLashunda
8 months agoNoe
8 months agoWava
8 months agoIsadora
8 months agoNydia
9 months agoAnnabelle
9 months agoSusana
11 months agoNaomi
12 months agoLauran
1 year agoDelmy
1 year agoIzetta
1 year agoKanisha
1 year agoMiesha
1 year agoCandra
1 year agoDan
1 year agoElliott
1 year agoAdelina
1 year agoAnnabelle
1 year agoStephane
1 year agoBerry
1 year agoLura
1 year agoEden
1 year agoFelicia
1 year agoRolande
1 year agoLeonie
1 year agoLarae
1 year agoRolland
2 years agoLorrine
2 years agoFausto
2 years agoCurtis
2 years agoBrock
2 years agoLazaro
2 years agoCasie
2 years agoGerald
2 years agoMarcos
2 years agoTawny
2 years agoClemencia
2 years agoArthur
2 years agoRashad
2 years agoRodrigo
2 years agoElvera
2 years agoDorinda
2 years agoJames
2 years agoGary
2 years agoShaniqua
2 years agoRory
2 years agoStephaine
2 years agoAmmie
2 years agoChristiane
2 years agoNu
2 years agoLamonica
2 years ago