Domain 6: Management and Security Governance

Implement security governance and compliance.

5 minutes 5 Questions

Domain 6: Management and Security Governance is a critical component of the AWS Certified Security – Specialty (SCS-C02) exam, focusing on how organizations establish, maintain, and enforce security policies, standards, and compliance frameworks within AWS environments. This domain covers several …

Concepts covered
Cost and Security Trade-offsAWS Organizations Security FeaturesAWS ArtifactAWS Control TowerAWS Audit Manager
Test mode:
Start practice test

AWS SCS-C02 - Domain 6: Management and Security Governance Example Questions

Test your knowledge of Domain 6: Management and Security Governance

Question 1

Which technology drastically reduces remote API transaction costs for high-volume encryption workloads by strategically trading strict per-message cryptographic separation for time-bound localized storage?

Correct Answer: AWS Encryption SDK data key caching mechanism

The AWS Encryption SDK data key caching mechanism is correct because it temporarily stores and reuses data keys within defined time or volume limits to drastically reduce Amazon KMS API calls and lower costs for high-volume workloads.

AWS Key Management Service symmetric encryption requires API calls per encryption action without an external caching strategy. AWS Certificate Manager private hardware enclave is a non-existent feature. AWS CloudHSM securely generates keys but does not inherently provide application-level key caching for API cost reduction.

The key concept tested is optimizing encryption API costs using AWS Encryption SDK data key caching.

Question 2

Which AWS platform tool provides the native capability to explicitly accept specialized binding legal documents necessary for processing regulated healthcare records?

Correct Answer: AWS Artifact, employing the dedicated Agreements framework

AWS Artifact is the correct service because its Agreements framework natively allows you to review, accept, and manage legally binding compliance documents, such as the Business Associate Addendum required for processing healthcare workloads.
AWS Organizations is incorrect as it governs multi-account environments using service control policies, not legal compliance contracts. AWS License Manager is wrong because it tracks third-party software usage limits. AWS Control Tower is incorrect as it automates the setup of standardized landing zones rather than hosting legal documents.
Key concept tested: Managing AWS compliance agreements and regulatory documentation.

Question 3

A security engineer at a healthcare company is auditing cloud infrastructure based on industry regulations. The team requires access to a restricted SOC 2 Type II report provided by AWS. However, the engineer encounters an administrative block when attempting to retrieve the document from AWS Artifact due to a missing confidentiality prerequisite. How should the firm resolve this access hurdle?

Correct Answer: Navigate to the designated agreements interface to formally accept the required confidentiality contract.

The correct answer is right because AWS Artifact requires users to explicitly accept a Non-Disclosure Agreement through the console before downloading restricted compliance reports like SOC 2 Type II.
Submitting an enterprise support request is incorrect because report access and agreement acceptance are entirely self-service within AWS Artifact. Attaching an administrative IAM policy is incorrect because IAM permissions alone cannot bypass the legal requirement to sign the confidentiality agreement. Configuring a service control policy is incorrect because SCPs only set maximum allowable permissions and do not automate or circumvent legal contract acceptances.
The key concept tested is managing compliance reports and confidentiality agreements using AWS Artifact.

More Domain 6: Management and Security Governance questions
282 questions (total)
Practice 100 questions
One session at a time, always new questions