SCS-C02 Practice Test 10 — 10 Questions

Question 1

A company runs a web application on Amazon EC2 behind an Application Load Balancer (ALB). The application handles payment card information (PCI) and must comply with PCI DSS. The security team wants to ensure that all data in transit between the client and the ALB is encrypted using TLS 1.2 or higher. The ALB currently uses a default certificate from AWS Certificate Manager (ACM) that was issued by Amazon. The compliance team has flagged that the certificate must be issued by a public Certificate Authority (CA) that is trusted by major browsers. The company wants to minimize operational overhead. What should the security team do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Request a public certificate from ACM and associate it with the ALB. AWS Certificate Manager (ACM) can issue public certificates that are signed by Amazon's public CA, which is trusted by all major browsers and operating systems. Requesting a public certificate in ACM and associating it with the ALB listener satisfies the PCI DSS requirement for TLS 1.2+ encryption with a publicly trusted CA, while ACM handles renewal automatically — minimising operational overhead. This is the canonical AWS-recommended approach for ALB TLS termination.

Answer

Use AWS CloudHSM to generate a certificate and import it into ACM

Answer

Configure CloudFront in front of the ALB and use a CloudFront default certificate

Answer

Generate a self-signed certificate on the EC2 instance and upload it to ACM, then associate it with the ALB

Question 2

A company uses AWS Organizations to manage multiple accounts. The security team needs to implement a centralized logging solution where all VPC Flow Logs from all accounts are sent to a central S3 bucket in the security account. The flow logs must be encrypted with a customer-managed KMS key (CMK) that is owned by the security account. The security engineer has enabled VPC Flow Logs in each account and configured the destination to be the central S3 bucket. However, the flow logs are not being delivered. The engineer checks the S3 bucket policy and confirms that it grants the required permissions to the Flow Logs service principal. What is the MOST likely cause of the failure?

Accepted Answer

The KMS key policy does not grant the Flow Logs service principal permission to use the key.. When VPC Flow Logs are delivered to an S3 bucket encrypted with a customer-managed KMS key, the Flow Logs service principal must have permission to use that key. Even if the S3 bucket policy grants access, the KMS key policy must also allow the Flow Logs service to encrypt data. Without this, the delivery fails. This is the most likely cause given the scenario.

Answer

The VPC Flow Logs service does not support cross-account delivery.

Answer

CloudTrail must be enabled in the source account for Flow Logs to work.

Answer

The S3 bucket policy is missing a condition for source account.

Question 3

A company has an S3 bucket with a bucket policy that grants access to an IAM role. The security team wants to restrict access to only requests that originate from the company's VPC. How can this be achieved?

Accepted Answer

Add a condition in the bucket policy using aws:SourceVpce with the VPC endpoint ID.. To restrict S3 bucket access to requests originating from a VPC, you add a condition to the bucket policy using the aws:SourceVpce condition key with the VPC endpoint ID. This ensures that only requests traversing the specified VPC endpoint (and thus originating from within the VPC) are allowed, which is the standard, secure way to enforce VPC-origin access for S3.

Answer

Create a new IAM role that can only be assumed by instances in the VPC.

Answer

Add a condition in the IAM role policy using aws:SourceVpce.

Answer

Add a condition in the bucket policy using aws:SourceIp with the VPC CIDR range.

Question 4

A company wants to deploy a web application that must be accessible over HTTPS only. The application runs behind an Application Load Balancer (ALB). The security team wants to enforce HTTP Strict Transport Security (HSTS) to prevent downgrade attacks. Which configuration achieves this?

Accepted Answer

Configure the ALB to redirect HTTP traffic to HTTPS and have the application set the Strict-Transport-Security header in the response. HSTS is enforced by the web application sending the `Strict-Transport-Security` header in HTTPS responses. By configuring the ALB to redirect HTTP to HTTPS, all traffic is forced over TLS, and the application can then set the HSTS header to instruct browsers to always use HTTPS for future requests. The ALB itself does not natively set HSTS headers; this must be done at the application layer.

Answer

Use AWS CloudFront with a custom header that enforces HSTS

Answer

Configure the ALB listener to use HTTPS only and set a custom header via a listener rule

Answer

Enable HSTS on the ALB via the AWS Management Console

Question 5

A company uses AWS Organizations with multiple accounts. The security team needs to enforce that all S3 buckets in the organization block public access. Which policy should be attached to the root organizational unit to achieve this?

Accepted Answer

Attach a service control policy (SCP) that denies s3:PutBucketPublicAccessBlock.. Attach a service control policy (SCP) that denies s3:PutBucketPublicAccessBlock. SCPs can be applied at the root organizational unit to centrally restrict permissions across all accounts, preventing any account from allowing public access to S3 buckets. Option A (CloudTrail) only logs events, not block access. Option B (AWS Config) can detect non-compliance but requires additional automation to enforce; the question asks for enforcement directly. Option D (IAM role) is account-specific and cannot enforce globally.

Answer

Enable AWS CloudTrail to log public access attempts and alert the security team.

Answer

Use AWS Config rules to remediate non-compliant buckets automatically.

Answer

Create an IAM role with a bucket policy that blocks public access.

Question 6

A developer wants to allow an IAM role to be assumed by an EC2 instance that is part of an Auto Scaling group. Which TWO AWS services or features are required? (Choose TWO.)

Accepted Answer

Instance profile. Option B (Instance profile) is correct because an instance profile is the container that passes an IAM role's temporary credentials to an EC2 instance; without attaching an instance profile to the instance, the EC2 instance cannot assume the role. Option C (IAM role) is correct because the role defines the permissions and trust policy that the EC2 instance assumes to obtain temporary credentials via the instance metadata service (IMDS). AWS Config (A) is a compliance and configuration tracking service and is not required to assume a role. AWS CloudFormation (D) is an infrastructure-as-code service that could optionally launch resources but is not required for role assumption. AWS Single Sign-On (E) is for human user federated access, not for EC2 instance role assumption.

Answer

AWS Config

Answer

AWS CloudFormation

Answer

AWS Single Sign-On (SSO)

Question 7

A company is using Amazon S3 to store sensitive data. The security team wants to ensure that all data is encrypted in transit between the company's on-premises data center and AWS. Which solution should be used?

Accepted Answer

Use an AWS Site-to-Site VPN with IPsec to encrypt traffic. An AWS Site-to-Site VPN with IPsec is the correct solution because it creates an encrypted tunnel between the on-premises data center and AWS, ensuring all data in transit is protected. IPsec operates at the network layer (Layer 3) and encrypts the entire IP packet, providing confidentiality and integrity for data moving over the public internet. This directly addresses the requirement to encrypt data in transit between the two environments.

Answer

Use AWS CloudHSM to encrypt the data in transit

Answer

Enable SSE-S3 on the S3 bucket

Answer

Use AWS KMS to encrypt the data before transmission

Question 8

A company is using Amazon Macie to discover sensitive data in S3. The security team wants to be notified when Macie finds a high-severity alert. Which integration should be used?

Accepted Answer

Create an Amazon EventBridge rule that matches Macie findings and targets an SNS topic.. Amazon EventBridge can directly capture Macie findings (which are emitted as events) and route them to an SNS topic for notification. This is the native, event-driven integration that requires no intermediate storage or custom actions, making it the simplest and most reliable approach for real-time alerting on high-severity findings.

Answer

Configure Macie to store findings in an S3 bucket and enable S3 event notifications.

Answer

Integrate Macie with AWS Security Hub and create a custom action to send to SNS.

Answer

Configure Macie to send findings to CloudWatch Logs and create a metric filter.

Question 9

A company wants to protect data in transit between its on-premises network and Amazon VPC using IPsec VPN. Which AWS service should be used to establish this VPN connection?

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN is the service used to establish an IPsec VPN connection between an on-premises network and an Amazon VPC. It creates a secure tunnel over the internet using IPsec, terminating on a Virtual Private Gateway (VGW) or Transit Gateway on the AWS side and a Customer Gateway on the on-premises side.

Answer

AWS Client VPN

Answer

AWS Transit Gateway

Answer

AWS Direct Connect

Question 10

A company wants to restrict access to an S3 bucket so that only requests from a specific VPC endpoint are allowed. The bucket policy must deny all requests that do not come from the VPC endpoint. Which TWO statements are true for this configuration?

Accepted Answer

Use the aws:SourceVpce condition key in the bucket policy.. Option C is correct because the aws:SourceVpce condition key is the specific global condition key that evaluates the VPC endpoint ID (vpce-xxxxxxxx) from which the request originates, allowing the policy to match traffic coming through that endpoint. Option D is correct because to block everything except the endpoint, the statement must use "Effect": "Deny" combined with a condition such as "StringNotEquals": {"aws:SourceVpce": "vpce-12345678"}, which denies any request whose source VPC endpoint does not match the specified one. Option A is not appropriate because aws:SourceIp matches public IP addresses and cannot reliably identify traffic originating from a VPC endpoint, which uses private IPs and is better identified by its endpoint ID. Option B is incorrect because the Principal element identifies the AWS identity (account, user, or role) making the request, not the VPC endpoint; the endpoint is referenced through the aws:SourceVpce condition key instead. Option E is incorrect because an explicit Allow is not required for this restriction; a Deny with a negated condition is sufficient to block all non-endpoint requests, and adding an Allow would not by itself enforce the restriction.

Answer

Use the aws:SourceIp condition key to restrict IP addresses.

Answer

Set the Principal to the VPC endpoint ID.

Answer

Ensure the bucket policy has an explicit Allow for the VPC endpoint.