Evaluate the compliance of AWS resources.
15 practice questions under this official exam objective (SCS-C02), each with the answer key, an option-by-option explanation and instant feedback.
Questions under this objective
15 total · page 1 of 1Use per-project S3 Lifecycle expiration after 60 days to purge project data cost-effective
Each data-science project gets a dedicated S3 prefix and must not leave data in the bucket after the project ends (up to 60 days). The most cost-effec
Grant the report Lambda Security Hub read-only access because findings are already in Secu
A Lambda builds a daily report from Amazon Inspector findings that are stored in AWS Security Hub. Because the data already resides in Security Hub, t
Fix CloudTrail-to-S3 delivery by verifying the bucket policy and that the bucket exists
CloudTrail is not delivering events to its S3 destination. The first checks are whether the S3 bucket named in the trail actually exists and whether t
Detect missing software with an AWS Config rule and auto-install via EventBridge, Lambda,
The company must find EC2 instances lacking a required corporate package and install it automatically. Centrally enabling AWS Config with the ec2-mana
Auto-enroll all org accounts in Security Hub via a delegated admin and a configuration pol
All new Control Tower-provisioned accounts must become Security Hub members with the least development effort. Designating a Security Hub delegated ad
Prepare a PHI/public-bucket audit with Macie, Audit Manager, and Security Hub FSBP
Before an audit, the company must find PHI in S3, find publicly accessible buckets, and collect compliance evidence with least overhead. Amazon Macie
Get automated email for exposed IAM access keys via an EventBridge rule on AWS Health Risk
The company wants automated email alerts when IAM access keys from developer accounts are found on public code-repository sites. AWS detects credentia
Remediate Security Hub non-compliance near-real-time via Config rule, Security Hub custom
Security Hub is already on for the organization and the team wants near-real-time detection and remediation of resources that fail security standards,
Block public access on the bucket and use an SCP to deny disabling Public Access Block
An S3 bucket is publicly accessible and must be made private and kept private. Enabling S3 Block Public Access on the bucket stops all public access p
Centralize Security Hub findings via delegated admin, EventBridge to Firehose/S3, and Athe
The company needs Security Hub findings combined across all accounts and Regions and visualized on a custom dashboard with operational data. The solut
Use an AWS Config managed rule with the AWS-EnableCloudTrail remediation to auto re-enable
To automatically turn CloudTrail back on across multiple Regions if it is disabled, use AWS Config with a managed rule that detects trails being off a
Auto-enable Security Hub for all accounts and aggregate findings across Regions
Security Hub must centrally monitor a dedicated account, automatically cover existing and new organization accounts, and receive findings from all Reg
Deploy an org-wide Config aggregator and remediate noncompliant S3 buckets with a Lambda f
To fix both existing and future noncompliant S3 buckets across many accounts and Regions, deploy an AWS Config aggregator with organization-wide aggre
Enable IAM Access Analyzer for the organization with a zone of trust and filter by account
To discover which external principals have access to which accounts across a large organization, enable IAM Access Analyzer for the organization and d
Use an EventBridge rule on the Config compliance-change event to notify an SNS topic
To monitor the restricted-ssh Config rule continuously and get near-real-time notification when a security group becomes noncompliant, configure an Am