SCS-C02 Practice Test 11 — 15 Questions

Question 1

A company wants to enforce encryption in transit for all data transferred between its Amazon EC2 instances and an Application Load Balancer (ALB). The company uses AWS Certificate Manager (ACM) to provision TLS certificates. Which TWO actions should the company take? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the target group to use HTTPS protocol.. Configuring the target group to use HTTPS protocol ensures that traffic between the Application Load Balancer (ALB) and the EC2 instances is encrypted in transit. This enforces TLS encryption on the backend connection, meeting the requirement for data-in-transit protection between the ALB and instances.

Answer

Enable encryption at rest on the EC2 instances.

Answer

Use a network load balancer instead of an ALB.

Answer

Assign a certificate from ACM to the ALB listener.

Question 2

A security engineer discovers that an IAM user has a policy that allows them to delete any S3 bucket in the account. The engineer wants to audit all delete actions performed by this user. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail logs all API calls made to the AWS API, including S3 bucket deletions, and is the appropriate service for auditing user actions. Option C (CloudTrail) is correct. Option A (GuardDuty) is a threat detection service that monitors for malicious activity but does not log all API calls. Option B (AWS Config) evaluates resource configurations and changes but does not log API calls. Option D (CloudWatch Logs) stores logs from various sources but does not capture API calls by default.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 3

Refer to the exhibit. A security engineer runs the AWS CLI command shown and receives an AccessDenied error. The IAM user Alice has a policy that grants kms:Decrypt on all resources. What is the most likely cause of the error?

Accepted Answer

The KMS key policy does not grant kms:Decrypt to the IAM user Alice.. The AccessDenied error is caused by the KMS key policy, which explicitly restricts which principals can decrypt using the key. Even though Alice's IAM policy allows kms:Decrypt on all resources, the key policy must also grant her access. If the key policy does not list Alice (or her role) as a principal allowed to decrypt, the request fails. Option A correctly identifies this as the most likely cause.

Answer

The IAM user policy does not allow kms:Decrypt.

Answer

The command uses the wrong key ID.

Answer

The ciphertext blob is corrupted.

Question 4

A company is using AWS Organizations to manage multiple accounts. The security team needs to enforce that all newly created S3 buckets across the organization have server-side encryption (SSE-S3) enabled by default. Which solution is MOST operationally efficient?

Accepted Answer

Apply an SCP to the root organizational unit that denies s3:CreateBucket if the bucket lacks encryption settings.. Applying an SCP to the root organizational unit that denies s3:CreateBucket unless encryption settings are specified is the most operationally efficient because it prevents noncompliant buckets from being created at the organizational level. Option A (Lambda triggered by S3 events) is reactive and requires ongoing management. Option B (setting default encryption per account) does not enforce across all accounts and can be overridden. Option D (AWS Config rule with remediation) only detects and fixes noncompliant buckets after creation, which is less efficient than prevention.

Answer

Create an AWS Lambda function that is triggered by S3 event notifications to enable encryption on any new bucket.

Answer

Set a default bucket encryption policy in each account’s S3 console.

Answer

Use AWS Config with a managed rule s3-bucket-server-side-encryption-enabled to trigger remediation.

Question 5

Which TWO actions are valid ways to enforce the principle of least privilege in an AWS environment?

Accepted Answer

Grant only the necessary actions in IAM policies. Options C and D are correct. Option C is correct because IAM policies should grant only the necessary actions, adhering to least privilege. Option D is correct because SCPs can deny actions that are not required across accounts, enforcing least privilege at the organization level. Option A is wrong because using the root user for daily administration grants unrestricted access, violating least privilege. Option B is wrong because S3 bucket policies that allow all IAM users do not restrict permissions per user. Option E is wrong because assigning the AdministratorAccess managed policy grants full access, contradicting least privilege.

Answer

Use the root user for daily administration

Answer

Use S3 bucket policies to allow all IAM users

Answer

Assign the AdministratorAccess managed policy to all users

Question 6

A company uses AWS CloudFormation to deploy infrastructure. The security team requires that all CloudTrail trails be encrypted with a customer-managed KMS key. Which CloudFormation template snippet correctly enforces this requirement?

Accepted Answer

Trail with KMSKeyId set to 'arn:aws:kms:us-east-1:123456789012:key/abcd1234-...'. It uses the full ARN of a specific customer-managed KMS key, ensuring the encryption requirement is met. Option C uses an alias, which could point to either an AWS managed key or a customer-managed key, so it does not guarantee compliance. Option A uses the AWS managed key 'aws/cloudtrail', not customer-managed. Option D omits encryption entirely.

Answer

Trail with KMSKeyId set to 'aws/cloudtrail'

Answer

Trail with KMSKeyId set to 'alias/my-cloudtrail-key'

Answer

Trail without KMSKeyId specified

Question 7

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that all accounts have AWS CloudTrail enabled and that logs are delivered to a central S3 bucket in the management account. What is the most efficient way to enforce this across all accounts?

Accepted Answer

Create a service control policy (SCP) that denies modifications to CloudTrail settings.. The most efficient way to enforce CloudTrail across all accounts in an AWS Organization is to use a Service Control Policy (SCP) that denies the ability to stop or modify CloudTrail settings. SCPs are applied at the organization level and affect all member accounts, preventing any user or role from disabling CloudTrail or changing trail configuration, regardless of their IAM permissions. This ensures compliance without needing per-account setup. Option B (Trusted Advisor) only provides alerts, not enforcement. Option C requires manual configuration per account, which is inefficient and error-prone. Option D (AWS Config rules) can detect non-compliance but cannot prevent changes from being made.

Answer

Use AWS Trusted Advisor to check CloudTrail status and send alerts.

Answer

Configure each account individually with a CloudTrail trail pointing to the central bucket.

Answer

Use AWS Config rules in each account to detect non-compliant trails.

Question 8

A company is using AWS Direct Connect with a private virtual interface (VIF) to connect its on-premises network to a VPC. The security team wants to encrypt traffic over the Direct Connect connection. Which TWO options can be used? (Choose TWO.)

Accepted Answer

Enable MACsec on the Direct Connect connection.. MACsec (IEEE 802.1AE) provides encryption at Layer 2 (data link layer) and can be enabled directly on a Direct Connect connection. This encrypts all traffic between the on-premises router and the AWS Direct Connect endpoint without requiring any changes to higher-layer protocols, making it transparent to applications.

Answer

Use AWS KMS to encrypt the traffic.

Answer

Use AWS Certificate Manager to issue certificates for the connection.

Answer

Use SSL/TLS to encrypt the traffic between on-premises and AWS.

Question 9

A company wants to encrypt data at rest in an Amazon RDS for MySQL DB instance. Which AWS service or feature should be used to achieve this?

Accepted Answer

AWS Key Management Service (KMS). AWS Key Management Service (KMS) is the correct service because Amazon RDS for MySQL uses KMS-managed customer master keys (CMKs) to enable encryption at rest for DB instances. When you enable RDS encryption, RDS automatically integrates with KMS to encrypt the underlying storage, automated backups, read replicas, and snapshots using AES-256 encryption. This is the foundational service that provides the key management and encryption operations for RDS at-rest encryption.

Answer

Amazon S3 server-side encryption

Answer

RDS encryption feature

Answer

SSL/TLS certificates

Question 10

A security engineer needs to monitor for suspicious API calls in near real-time and trigger an automated response. Which AWS service should be used to capture and analyze these API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it captures all API calls made to the AWS environment, including those from the AWS Management Console, SDKs, CLI, and AWS services. By enabling CloudTrail Insights or using CloudWatch Events with CloudTrail logs, you can monitor for suspicious API calls in near real-time and trigger automated responses via Lambda functions or SNS notifications.

Answer

AWS CloudHSM

Answer

Amazon GuardDuty

Answer

AWS Config

Question 11

An administrator wants to audit all IAM actions in the account. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity, including all IAM actions. AWS Config tracks resource configuration changes, not API actions. Amazon GuardDuty is a threat detection service. Amazon CloudWatch monitors metrics and logs, but does not record API calls.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

Amazon CloudWatch

Question 12

A company wants to ensure that all data transmitted between its EC2 instances and an Application Load Balancer (ALB) is encrypted. Which configuration should be applied?

Accepted Answer

Configure the ALB with an HTTPS listener and a target group that uses HTTPS as the protocol.. It establishes end-to-end encryption between clients and the ALB (via HTTPS listener) and between the ALB and EC2 instances (via HTTPS target group). This ensures that data transmitted over both legs of the connection is encrypted using TLS, meeting the requirement that all data between the EC2 instances and the ALB is encrypted.

Answer

Install SSL certificates on each EC2 instance and configure the ALB to use TCP passthrough.

Answer

Use a Network Load Balancer with TLS listeners and target groups.

Answer

Configure security groups to allow only HTTPS traffic.

Question 13

A company uses AWS Organizations with multiple accounts. The security team wants a centralized view of all security alerts and findings from services like GuardDuty, Security Hub, and Inspector across all accounts. What is the MOST efficient way to achieve this?

Accepted Answer

Use AWS Security Hub with cross-account aggregation in the management account.. AWS Security Hub is designed to aggregate findings from multiple security services (GuardDuty, Inspector, etc.) across accounts. By enabling cross-account aggregation in the management account of AWS Organizations, Security Hub provides a single, centralized dashboard for all security alerts and findings without needing to collect raw logs or build custom dashboards. This is the most efficient and native approach for a multi-account environment.

Answer

Use AWS Systems Manager OpsCenter to centrally view all security findings.

Answer

Use individual service consoles (GuardDuty, Security Hub, Inspector) for each account.

Answer

Use Amazon CloudWatch Logs to collect logs from each account and create custom dashboards.

Question 14

A company wants to encrypt data at rest for an Amazon RDS for MySQL DB instance. Which THREE options can be used to achieve this? (Choose THREE.)

Accepted Answer

Take a snapshot of the unencrypted instance, copy it with encryption, and restore.. You can take a snapshot of an unencrypted Amazon RDS for MySQL DB instance, create an encrypted copy of that snapshot, and then restore a new DB instance from the encrypted snapshot. This process effectively encrypts the data at rest, as the restored instance will inherit the encryption setting from the snapshot. AWS RDS does not allow enabling encryption on an existing unencrypted DB instance directly, so this snapshot-based approach is the standard workaround.

Answer

Modify the DB instance to enable encryption after creation.

Answer

Create a read replica with encryption enabled, even if the source is unencrypted.

Question 15

A company has a multi-account AWS environment using AWS Organizations. The security team needs to enforce that all new S3 buckets created in any account in the organization are encrypted with a specific KMS key. Which approach should be used?

Accepted Answer

Apply a Service Control Policy (SCP) that denies s3:CreateBucket unless encryption is configured. Service Control Policies (SCPs) in AWS Organizations can centrally deny the creation of S3 buckets unless specific encryption conditions are met. By using an SCP with a condition that requires `s3:x-amz-server-side-encryption-aws-kms-key-id` to match the specific KMS key ARN, the security team can enforce encryption at the organizational level, preventing any account from creating non-compliant buckets regardless of IAM permissions.

Answer

Set up AWS Config rules to detect non-compliant buckets

Answer

Create an IAM role that requires encryption and attach it to all users

Answer

Use an S3 bucket policy with a condition for encryption