SCS-C02 Practice Test 1 — 10 Questions

Question 1

The exhibit shows an SCP attached to an organizational unit. What is the effect of this policy?

Accepted Answer

It allows s3:PutBucketPolicy only if the bucket ACL is set to bucket-owner-full-control.. The SCP denies s3:PutBucketPolicy only when the bucket ACL is not set to 'bucket-owner-full-control'. If the ACL is set to that value, the action is allowed. Thus, it ensures that when a bucket policy is created, the ACL must grant full control to the bucket owner. It does not deny all PutBucketPolicy actions.

Answer

It denies all s3:PutBucketPolicy actions on all buckets.

Answer

It denies s3:PutBucketPolicy for any bucket that does not have an ACL.

Answer

It allows s3:PutBucketPolicy for buckets owned by the management account.

Question 2

A security team is designing an automated incident response system. The system must meet the following requirements: (1) automatically respond to GuardDuty findings, (2) ensure that response actions are logged and immutable, and (3) allow for human approval before destructive actions. Which services should the team use? (Select THREE.)

Accepted Answer

Amazon EventBridge. Amazon EventBridge (A) is correct because it can receive GuardDuty findings in near real-time and route them to downstream targets for automated response. This enables the first requirement by triggering workflows directly from GuardDuty events without custom polling.

Answer

AWS Lambda

Answer

Amazon Simple Notification Service (SNS)

Question 3

A security engineer finds this IAM policy attached to a user. The user is able to create CloudTrail trails but cannot start logging. What is the MOST likely reason?

Accepted Answer

The user lacks `iam:PassRole` permission for the CloudTrail service role.. The user can create CloudTrail trails but cannot start logging because starting logging requires the `iam:PassRole` permission to pass the CloudTrail service role to the CloudTrail service. Without this permission, CloudTrail cannot assume the role needed to write logs to the S3 bucket and deliver them to CloudWatch Logs, even though the user has `cloudtrail:CreateTrail` and `cloudtrail:StartLogging` actions in the policy.

Answer

The `StartLogging` action is not listed in the policy.

Answer

The policy does not specify the `cloudtrail:StartLogging` action.

Answer

The user does not have permission to create CloudTrail trails.

Question 4

A security engineer is investigating a potential data exfiltration incident where an attacker used a compromised EC2 instance to transfer data to an external IP. Which TWO AWS services can provide evidence of the network traffic and the API calls made from the instance?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture metadata about IP traffic going to and from network interfaces, including the source/destination IP, ports, protocol, and packet/byte counts. This provides direct evidence of data being transferred to an external IP address from the compromised EC2 instance. AWS CloudTrail records API calls made within the AWS environment, such as those executed by the EC2 instance's IAM role or the instance itself (e.g., via the AWS CLI or SDK), which can reveal actions like starting data transfers or modifying security groups to allow exfiltration.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Question 5

During a security incident, a forensic investigator needs to capture the memory of a running EC2 instance without shutting it down. Which AWS feature should be used?

Accepted Answer

EC2 Rescue for Linux or Systems Manager Run Command with a memory dump script. EC2 Rescue for Linux (via Systems Manager Run Command) includes a built-in script that can capture a full memory dump from a running EC2 instance without requiring a shutdown. This is essential for forensic analysis to preserve volatile data like running processes, network connections, and kernel structures. The script leverages the Linux 'vmcore' or 'LiME' (Linux Memory Extractor) tool to safely extract memory contents while the instance remains operational.

Answer

Amazon CloudWatch agent

Answer

AWS CloudTrail

Answer

Amazon EBS snapshot

Question 6

A security engineer needs to monitor for unusual outbound network traffic from an EC2 instance. Which AWS service provides this capability?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture metadata about IP traffic going to and from network interfaces in a VPC, including source/destination IPs, ports, protocols, and packet counts. This allows a security engineer to analyze outbound traffic patterns from an EC2 instance and detect anomalies such as data exfiltration or communication with known malicious IPs. The logs can be published to Amazon CloudWatch Logs or Amazon S3 for further analysis with tools like Amazon Athena or third-party SIEMs.

Answer

Amazon CloudWatch Logs agent

Answer

Amazon Inspector

Answer

AWS Config

Question 7

A security engineer creates an Amazon CloudWatch Events rule with this event pattern to trigger an AWS Lambda function for automated response to GuardDuty findings. However, the Lambda function is not triggered for new findings. What is the MOST likely cause?

Accepted Answer

The event pattern does not match the actual structure of GuardDuty findings.. The event pattern provided in the CloudWatch Events rule must exactly match the JSON structure of a GuardDuty finding as it is published to the default event bus. GuardDuty findings are delivered with a specific schema that includes a `detail` object containing `type`, `severity`, and other fields. If the event pattern uses incorrect field names, nesting, or missing required elements (e.g., `source` must be `aws.guardduty`), CloudWatch Events will not match the incoming events, and the Lambda function will not be triggered.

Answer

The finding type is not specified in the pattern.

Answer

CloudTrail is not enabled in the account.

Answer

The Lambda function does not have permission to be invoked by CloudWatch Events.

Question 8

A company has an Amazon S3 bucket with a bucket policy that restricts access to a specific VPC endpoint. However, users are still able to access the bucket from outside the VPC. Which THREE steps should the security engineer take to troubleshoot this issue? (Choose THREE.)

Accepted Answer

Check the VPC endpoint policy to ensure it allows the actions the users are performing.. The VPC endpoint policy acts as an additional access control layer. Even if the bucket policy correctly restricts access to the VPC endpoint, the endpoint policy must explicitly allow the actions (e.g., s3:GetObject) that users are performing. If the endpoint policy denies or does not include those actions, the request will fail at the endpoint level, but if it is too permissive, it can allow access from outside the intended VPC if the bucket policy condition is misconfigured. Checking the endpoint policy ensures that it does not inadvertently grant broader permissions than intended.

Answer

Verify that the security group associated with the VPC endpoint allows inbound traffic.

Answer

Ensure the VPC endpoint is in the same region as the S3 bucket.

Question 9

Which TWO actions should a security engineer take to ensure that Amazon GuardDuty can effectively monitor for suspicious activity in a VPC? (Choose two.)

Accepted Answer

Enable DNS query logging and publish to CloudWatch Logs.. Amazon GuardDuty relies on DNS query logs to detect suspicious domain name resolution patterns, such as DNS tunneling or communication with known malicious domains. By enabling DNS query logging and publishing to CloudWatch Logs, GuardDuty can ingest this data as a source for its threat detection algorithms. Without DNS logs, GuardDuty cannot analyze DNS-based attack vectors within the VPC.

Answer

Enable CloudTrail data events for S3.

Answer

Enable S3 server access logs.

Answer

Enable AWS Config configuration history.

Question 10

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all API calls in the organization are logged and retained for at least one year. Which AWS services or features should be used to meet these requirements? (Choose TWO.)

Accepted Answer

Amazon S3 lifecycle policy to transition logs to S3 Glacier after one year.. An Amazon S3 lifecycle policy can automatically transition CloudTrail log objects from S3 Standard to S3 Glacier after one year, meeting the retention requirement cost-effectively. Option E is correct because AWS CloudTrail with an organization trail logs all API calls across all accounts in the AWS Organization, ensuring comprehensive logging.

Answer

Amazon GuardDuty with threat detection enabled.

Answer

AWS Config with recording enabled for all resources.

Answer

VPC Flow Logs for all VPCs.