SCS-C02 Practice Test 11 — 15 Questions

Question 1

Refer to the exhibit. A security engineer is reviewing an IAM policy attached to a user. The policy is intended to allow the user to get and put objects in the S3 bucket 'example-bucket' only from the IP range 203.0.113.0/24. However, the user reports that they are unable to put objects from an IP within that range. What is the most likely cause of this issue?

Accepted Answer

The policy lacks a separate statement to allow 's3:ListBucket' on the bucket resource.. Option D is correct because the policy only grants s3:GetObject and s3:PutObject actions on the bucket's objects (arn:aws:s3:::example-bucket/*), but does not include a separate statement allowing s3:ListBucket on the bucket resource (arn:aws:s3:::example-bucket). Without s3:ListBucket, the user cannot list the bucket's contents, which is often required by the AWS CLI or SDK to resolve object keys before performing put operations. The IP condition is correctly applied, so the issue is the missing list permission.

Answer

The condition key should be 'aws:sourceIp' (lowercase 's').

Answer

The policy should use the 'NotIpAddress' condition operator instead of 'IpAddress'.

Answer

The resource ARN should be 'arn:aws:s3:::example-bucket' without the '/*' suffix.

Question 2

A company uses AWS Organizations with multiple accounts and has enabled AWS Security Hub in the management account. The security team wants to automatically remediate a specific finding type that appears in Security Hub. Which combination of services should be used to achieve this?

Accepted Answer

Amazon EventBridge and AWS Lambda. Amazon EventBridge can capture Security Hub findings as events using an event rule that matches the specific finding type. When the rule triggers, it invokes an AWS Lambda function that contains the remediation logic, such as modifying security group rules or disabling access keys. This combination provides a serverless, event-driven architecture for automated response to Security Hub findings.

Answer

AWS Config conformance packs and AWS Systems Manager Automation

Answer

Amazon Inspector and AWS Step Functions

Answer

Amazon GuardDuty and AWS Lambda

Question 3

A security engineer is configuring an automated incident response workflow for Amazon GuardDuty findings. Which TWO actions should the engineer take to ensure that the response is triggered for all current and future GuardDuty findings?

Accepted Answer

Create an Amazon EventBridge rule with an event pattern that matches GuardDuty finding events.. Option B is correct because Amazon EventBridge can capture all GuardDuty findings by using an event pattern that matches the 'GuardDuty Finding' event type. This ensures that both current and future findings automatically trigger the rule without requiring manual updates or additional configuration.

Answer

Enable GuardDuty to export findings to CloudWatch Logs and then create a metric filter.

Answer

Create an Amazon SNS topic and subscribe the Lambda function to it, then configure GuardDuty to publish to SNS.

Answer

Set up a CloudWatch Logs subscription filter to forward GuardDuty logs to the Lambda function.

Question 4

A security engineer is investigating a potential credential compromise. An IAM user's access key was used to launch EC2 instances in a region where the user has never operated before. The engineer wants to quickly identify all API calls made by this user in the last 24 hours, including the source IP addresses. Which AWS service or feature should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made by IAM users, including the source IP address, user identity, and request details. By querying CloudTrail logs for the specific IAM user's access key over the last 24 hours, the engineer can identify every EC2-related and other API call, along with the originating IP addresses, enabling rapid investigation of the potential credential compromise.

Answer

VPC Flow Logs

Answer

AWS Trusted Advisor

Answer

Amazon CloudWatch Logs

Question 5

A company is using AWS Organizations with multiple accounts. The security team needs to centrally monitor all root user API activity across all accounts and receive alerts within minutes. What is the MOST efficient solution?

Accepted Answer

Create an organization trail in CloudTrail that logs all accounts. Use CloudWatch Logs metric filters and alarms to detect root login events.. Option A is correct because an organization trail in AWS CloudTrail logs API activity for all accounts in AWS Organizations from a single point, eliminating the need to manage per-account trails. By sending these logs to CloudWatch Logs, you can create metric filters to detect root user login events (e.g., the 'RootLogin' event) and configure CloudWatch Alarms to trigger SNS notifications within minutes, meeting the requirement for centralized monitoring and rapid alerts.

Answer

Enable CloudTrail in each account and aggregate logs to a centralized S3 bucket. Use Athena queries to detect root activity and send alerts via SNS.

Answer

Use AWS Lambda functions in each account to poll CloudTrail logs and send root activity to a central SQS queue.

Answer

Enable AWS Config rules in each account to detect root user activity and send notifications to a central SNS topic.

Question 6

A company uses AWS CloudTrail to log all API calls. The security team notices that some expected log entries are missing for actions performed by an IAM role assumed by an EC2 instance. The instance has the required permissions. What is the MOST likely cause of the missing log entries?

Accepted Answer

The IAM role used by the EC2 instance has a permissions boundary that excludes cloudtrail:PutLogEvents.. Option D is correct because CloudTrail logs are delivered to an S3 bucket, and the IAM role must have permissions to write logs via `cloudtrail:PutLogEvents`. If a permissions boundary on the role explicitly denies this action, the role cannot deliver log entries to CloudTrail, even if the role has other required permissions. This explains why expected log entries are missing despite the instance having the necessary permissions to perform the API calls.

Answer

The EC2 instance is in a VPC that has a VPC endpoint for CloudTrail, but the endpoint policy denies logging.

Answer

CloudTrail is not logging read-only API calls by default; the trail must be configured to log read events.

Answer

CloudTrail trail is not configured to log data events for EC2.

Question 7

A security engineer wants to receive real-time notifications when an AWS API call is made to delete an S3 bucket. Which service should be used to capture and forward these events to an Amazon SNS topic?

Accepted Answer

AWS CloudTrail with CloudWatch Events. AWS CloudTrail captures all API calls made to S3, including DeleteBucket. By sending these CloudTrail events to Amazon CloudWatch Events (now part of Amazon EventBridge), you can create a rule that matches the specific API call and forwards it to an SNS topic for real-time notification. This combination provides the exact event-driven pipeline needed for immediate alerting on S3 bucket deletions.

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Answer

AWS Config

Question 8

A security engineer is designing a monitoring solution for a multi-account AWS environment using AWS Organizations. The solution must provide a centralized view of all API activities and send alerts for suspicious events. Which TWO services together can achieve this? (Choose TWO.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail is correct because it records all API activity across an AWS environment, and when integrated with AWS Organizations, it can deliver a centralized view of API calls from all accounts into a single CloudTrail trail. Amazon CloudWatch Logs is correct because it can ingest CloudTrail logs from a centralized logging account, allowing the security engineer to create metric filters and alarms that trigger alerts for suspicious events based on specific API patterns.

Answer

Amazon GuardDuty

Answer

AWS Lambda

Answer

AWS Config

Question 9

Match each AWS service to its primary security function.

Question 10

Match each AWS Storage service encryption feature to its description.

Question 11

Match each AWS VPC flow log type to its description.

Question 12

Match each AWS security-related acronym to its definition.

Question 13

Refer to the exhibit. A developer receives an 'UnauthorizedOperation' error when launching an EC2 instance with the specified security group. The developer has permissions to use ec2:RunInstances. What is the most likely cause?

Accepted Answer

The security group contains an inbound rule with a source of 0.0.0.0/0 for port 80, which is too permissive and triggers a service control policy (SCP) that denies launching instances with overly permissive rules.. The 'UnauthorizedOperation' error indicates an IAM or SCP permissions issue. Since the developer has ec2:RunInstances permissions, an SCP likely denies the action when the security group has a rule allowing 0.0.0.0/0. Option C is the most plausible given the exhibit.

Answer

The security group allows inbound HTTPS from the entire RFC 1918 address space, but the instance is in a public subnet.

Answer

The security group allows outbound all traffic, which violates the principle of least privilege.

Answer

The instance type t2.micro is not available in the specified subnet's Availability Zone.

Question 14

A company needs to monitor for unauthorized changes to its Amazon S3 bucket policies. Which TWO services can be used together to achieve this? (Choose two.)

Accepted Answer

AWS Config. AWS Config can track changes to S3 bucket policies and trigger a notification via Amazon SNS. Options A and D are correct. Option B is wrong because CloudTrail logs API calls but does not evaluate configuration changes against a baseline. Option C is wrong because VPC Flow Logs are for network traffic. Option E is wrong because Route 53 is for DNS.

Answer

Amazon Route 53

Answer

AWS CloudTrail

Answer

VPC Flow Logs

Question 15

A developer has created an S3 bucket policy that grants public read access. The security team wants to prevent any S3 bucket from becoming public. Which AWS service can enforce this restriction across all accounts?

Accepted Answer

A service control policy (SCP) denying s3:PutBucketPolicy. AWS Organizations SCPs can deny specific S3 actions that make buckets public. Option C is correct. Option A (IAM policies) are per-user, not account-wide. Option B (S3 Block Public Access) is per-account or per-bucket, but can be overridden. Option D (CloudTrail) only logs.

Answer

AWS CloudTrail with a metric filter

Answer

S3 Block Public Access settings on each account

Answer

IAM permissions boundary

SCS-C02 Practice Test 11 — 15 Questions

Exhibit

SCS-C02 Practice Test 11 — 15 Questions

Exhibit