SCS-C02 Practice Test 10 — 10 Questions

Question 1

A company uses AWS Organizations with multiple accounts. The security team wants to centralize security logs (CloudTrail, VPC Flow Logs, AWS Config) from all accounts into a single S3 bucket for analysis. What is the MOST secure way to set up this centralized logging?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a dedicated S3 bucket in the security account with a bucket policy that grants write access to the logging services of all accounts and enforces encryption in transit and at rest.. It uses a dedicated S3 bucket in a security account (not the management account) with a bucket policy that explicitly grants write access to the logging services (CloudTrail, VPC Flow Logs, AWS Config) from all accounts, while enforcing encryption in transit (aws:SecureTransport) and at rest (default SSE-S3 or SSE-KMS). This follows the security best practice of isolating logs in a separate account and using resource-based policies to restrict access, preventing accidental deletion or modification by other accounts.

Answer

Create a dedicated S3 bucket in the management account, enable S3 default encryption, and configure service delivery for each account.

Answer

Configure each account to deliver logs to the same S3 bucket used for other data.

Answer

Create an S3 bucket in each account and use S3 replication to copy logs to a central bucket.

Question 2

A company has a multi-account AWS environment using AWS Organizations. The security team wants to centralize all CloudTrail logs from all accounts into a single S3 bucket in the management account. The bucket policy allows cross-account access. However, logs from member accounts are not being delivered. What is the most likely cause?

Accepted Answer

The S3 bucket policy does not grant `s3:PutObject` permission to the member accounts.. The S3 bucket policy must explicitly grant the `s3:PutObject` permission to the IAM roles or users from the member accounts that CloudTrail uses to deliver logs. Without this permission, CloudTrail in the member accounts cannot write log files to the central bucket, even if the bucket is configured for cross-account access. The bucket policy must also include a condition that the object ownership is set to the bucket owner (via `s3:x-amz-acl: bucket-owner-full-control`) to ensure the management account retains control.

Answer

CloudTrail cannot deliver logs to a bucket in a different account.

Answer

The S3 bucket is not configured with a CloudTrail prefix.

Answer

CloudTrail is not enabled in the member accounts.

Question 3

A company uses Amazon GuardDuty and receives a finding of type 'Backdoor:EC2/C&CActivity.B!DNS' for an EC2 instance. What does this finding indicate?

Accepted Answer

The instance is communicating with a known command and control server.. The finding 'Backdoor:EC2/C&CActivity.B!DNS' indicates that GuardDuty has detected DNS queries from the EC2 instance to a domain associated with known command and control (C&C) infrastructure. This is based on GuardDuty's threat intelligence feeds that map DNS request patterns to known malicious domains, signaling that the instance may be compromised and communicating with an attacker's server.

Answer

The instance is being targeted by an SSH brute force attack.

Answer

The instance is exfiltrating data to an S3 bucket.

Answer

The instance is being used in a DDoS attack.

Question 4

Refer to the exhibit. A security engineer is troubleshooting why an IAM user (Alice) cannot encrypt data using a KMS key. Alice has full S3 and KMS permissions via an IAM policy. The key policy is shown. Which statement explains the issue?

Accepted Answer

The key policy does not allow the IAM user to use the key for any action. The key policy does not grant Alice any permissions, and it does not enable IAM policies to allow access (no statement allowing root account to delegate via IAM). Since KMS requires explicit key policy authorization unless the key policy enables IAM policies, Alice cannot encrypt data even with full IAM permissions. Option D correctly identifies this. Option A is wrong because the key policy does not need a separate statement to allow IAM policies unless it explicitly enables IAM policy delegation. Option B is wrong because Alice has kms:Encrypt via IAM policy, but the key policy is restrictive. Option C is wrong because the root account is included (the Root principal).

Answer

The key policy is missing a statement to allow the IAM user to use the key via IAM policies

Answer

The IAM user does not have the kms:Encrypt permission in their IAM policy

Answer

The key policy does not include the root account principal

Question 5

A security engineer is investigating a potential breach. The engineer notices that an EC2 instance's security group allows inbound SSH (port 22) from 0.0.0.0/0. The instance is in a public subnet and has a public IP address. However, the engineer finds that SSH access is only possible from a specific IP address. What is the most likely explanation?

Accepted Answer

The network ACL denies inbound SSH from all IPs except the specific IP. A network ACL (NACL) can override security group rules if it denies inbound traffic. Option A is wrong because if the NACL allowed SSH from anywhere, then the restriction to a specific IP would not occur. Option B is wrong because if the NACL allowed traffic, it wouldn't explain the restriction. Option C is wrong because security group rules are evaluated; the rule allowing all traffic would still apply.

Answer

The network ACL allows inbound SSH from 0.0.0.0/0

Answer

The security group rule is being overridden by a more restrictive security group attached to the same instance

Answer

The security group rule is being evaluated but the instance's operating system firewall is blocking SSH

Question 6

A security engineer needs to ensure that an IAM role can be assumed only from a specific VPC. Which IAM policy condition key should be used?

Accepted Answer

aws:SourceVpc. Aws:SourceVpc. This condition key allows you to restrict requests to originate from a specific VPC ID. Option A, aws:RequestedRegion, restricts region, not VPC. Option B, aws:VpcSourceIp, is not a valid condition key. Option D, aws:SourceIp, restricts source IP address, not VPC.

Answer

aws:RequestedRegion

Answer

aws:VpcSourceIp

Answer

aws:SourceIp

Question 7

A security engineer is troubleshooting an issue where an IAM role used by an EC2 instance cannot access an S3 bucket, even though the role has an attached policy that grants s3:GetObject on the bucket. The bucket policy does not explicitly deny access. What is the most likely cause?

Accepted Answer

The bucket policy does not grant access to the IAM role. The bucket policy does not grant access to the IAM role. For an IAM role used by an EC2 instance to access an S3 bucket, both the IAM policy attached to the role and the bucket policy must allow the action. Even though the IAM policy grants s3:GetObject, the bucket policy must also explicitly grant access to the role principal. Since the bucket policy does not explicitly deny access (option D is false), the lack of an explicit allow in the bucket policy is the most likely cause. Options A and C are incorrect: SCPs would deny at the organization level, and the IAM policy is attached to the role, not the user.

Answer

A service control policy (SCP) is denying access

Answer

The IAM policy is attached to the user instead of the role

Answer

The bucket has an explicit deny in its policy

Question 8

Refer to the exhibit. An IAM user has this policy attached. Can the user create a new IAM user in the us-east-1 region?

Accepted Answer

No, because the Deny statement blocks all IAM actions in us-east-1.. The Deny statement blocks all IAM actions in us-east-1, which overrides the Allow for CreateUser. Since the Deny is explicit, it blocks the action even though there is an Allow. The request fails.

Answer

Yes, because the Allow statement explicitly permits CreateUser.

Answer

No, because IAM is a global service and region conditions do not apply.

Answer

Yes, because the Deny only applies to us-east-1.

Question 9

Refer to the exhibit. An IAM user has this policy attached. The user tries to download an object from the S3 bucket using the AWS CLI from an on-premises server with IP address 198.51.100.50. What will happen?

Accepted Answer

The request will fail because the user's IP is not in the allowed range.. The policy includes a condition that restricts access to only requests originating from a specific IP address range. Since the user's on-premises server IP (198.51.100.50) is not within that allowed range, the request will be denied. Option A is incorrect because the policy does not grant unconditional access; the condition overrides the Allow effect. Option B is incorrect because the policy does not require HTTPS; it only checks the source IP. Option D is incorrect because there is no MFA condition in the policy.

Answer

The request will succeed because the policy allows s3:GetObject.

Answer

The request will fail because the user must use HTTPS.

Answer

The request will fail because the user must use MFA.

Question 10

A company is migrating on-premises data to AWS using AWS Snowball Edge. The data must be encrypted in transit and at rest. Which combination of steps should be taken?

Accepted Answer

Use Snowball Edge with default encryption settings; data is encrypted at rest and in transit.. Snowball Edge automatically encrypts data at rest using AES-256 and uses TLS for data in transit. Option A is incorrect because client-side encryption is not required; Snowball Edge handles encryption automatically. Option B is incorrect because Snowball Edge transfers data via its own secure protocol, not VPN. Option C is incorrect because KMS is not directly used for Snowball encryption; the device manages its own encryption keys.

Answer

Encrypt the data with a client-side tool before copying to Snowball Edge.

Answer

Set up a VPN connection to AWS and transfer data over the VPN.

Answer

Use AWS KMS to generate a key and apply it to the Snowball Edge device.