SCS-C02 Practice Test 11 — 15 Questions

Question 1

A company wants to audit all API calls made to Amazon S3 within a specific AWS account. Which combination of services should be used to meet this requirement?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Logs.. AWS CloudTrail is the service that records all API calls made to Amazon S3 (and other AWS services) within an AWS account, capturing details such as the identity of the caller, the time of the call, the source IP address, and the request parameters. By delivering these logs to Amazon CloudWatch Logs, you can monitor, search, and set alarms on the API activity in real time, enabling comprehensive auditing of S3 operations.

Answer

Amazon Inspector and Amazon CloudWatch Logs.

Answer

Amazon GuardDuty and Amazon CloudWatch Logs.

Answer

AWS Config and Amazon CloudWatch Logs.

Question 2

A company uses cross-account IAM roles to allow a third-party vendor to access resources in the company's AWS account. The security team wants to ensure that the vendor can only access the specific S3 bucket named 'vendor-bucket'. What should the security team do?

Accepted Answer

In the trust policy of the role, specify the vendor's AWS account and attach a permissions policy that allows s3:* on 'vendor-bucket'. Also create a bucket policy that allows the role.. The correct approach is to create a cross-account IAM role for the vendor. In the role's trust policy, specify the vendor's AWS account as the trusted entity. Attach a permissions policy to the role that grants access only to the specific S3 bucket 'vendor-bucket' (e.g., s3:GetObject, s3:PutObject). Additionally, create a bucket policy on 'vendor-bucket' that allows the role to access the bucket. This ensures the vendor can only assume the role and access the designated bucket.

Answer

Create an IAM user for the vendor and attach a policy that allows access to 'vendor-bucket'.

Answer

Use an SCP to deny access to all S3 buckets except 'vendor-bucket'.

Answer

Create a new AWS account for the vendor and use VPC peering.

Question 3

A company uses Amazon GuardDuty to monitor for malicious activity in its AWS environment. The security team receives a high number of findings, many of which are false positives. They want to reduce noise by suppressing findings for known benign activities, such as internal vulnerability scans performed by the security team. GuardDuty has a feature to create suppression rules based on finding criteria. However, the team also wants to ensure that if a new type of threat is detected, it is immediately escalated. What is the MOST effective way to manage GuardDuty findings?

Accepted Answer

Create suppression rules that automatically archive findings matching the known benign activity criteria, and periodically review the suppressed findings.. GuardDuty suppression rules automatically archive findings that match specified criteria (e.g., a known internal scanner IP), removing them from the active findings list without disabling detection. Periodically reviewing suppressed findings ensures that if the benign activity pattern changes or a real threat reuses that IP, the team can catch it. This balances noise reduction with the requirement to escalate genuinely new threats.

Answer

Set GuardDuty to only generate findings for medium and high severity, ignoring low severity findings.

Answer

Create a suppression rule that blocks all findings from the internal IP range used by the security team.

Answer

Disable the specific GuardDuty finding types that generate false positives.

Question 4

A security engineer needs to ensure that all data in transit between an Application Load Balancer and EC2 instances is encrypted using TLS. Which configuration is required?

Accepted Answer

Configure the ALB with an HTTPS listener and the target group with HTTPS protocol.. To encrypt data in transit between the Application Load Balancer and EC2 instances, the ALB must have an HTTPS listener and the target group must use HTTPS protocol. This ensures end-to-end TLS encryption from client to ALB and from ALB to EC2 instances. Option A correctly specifies this configuration.

Answer

Configure the ALB with an HTTPS listener and the target group with HTTP protocol.

Answer

Configure the ALB with a TLS listener and the target group with TCP protocol.

Answer

Configure the ALB with a TCP listener and the target group with HTTP protocol.

Question 5

A company is deploying a multi-tier web application on AWS. The application uses an Application Load Balancer (ALB) to distribute traffic to EC2 instances in private subnets. The security team wants to protect the application from common web exploits like SQL injection and cross-site scripting. Which AWS service should be used?

Accepted Answer

AWS WAF.. AWS WAF is a web application firewall that helps protect web applications from common web exploits such as SQL injection and cross-site scripting (XSS). It integrates directly with an Application Load Balancer (ALB) to inspect HTTP/HTTPS requests and filter malicious traffic based on customizable rules, including managed rule groups for OWASP Top 10 threats.

Answer

AWS Network Firewall.

Answer

AWS Shield Advanced.

Answer

AWS Security Hub.

Question 6

This SCP is attached to an organizational unit (OU). A developer in an account within the OU tries to launch a t2.small instance. What is the outcome?

Accepted Answer

The launch fails because the SCP denies non-t2.micro instances.. The SCP denies ec2:RunInstances if the instance type is not t2.micro. Since t2.small is not t2.micro, the condition matches, and the action is denied. Option A is wrong because the SCP does not deny all RunInstances actions; it only denies those that do not match the condition. Option B is wrong because the launch fails, not succeeds. Option D is wrong because SCPs apply to all principals in the account, including developers.

Answer

The launch fails because the SCP denies all RunInstances actions.

Answer

The launch succeeds because the SCP allows t2.micro only.

Answer

The launch succeeds because SCPs do not apply to developers.

Question 7

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The security engineer has set up a NAT gateway in a public subnet and updated the route tables accordingly. However, instances in the private subnets cannot reach the internet. The engineer checks the security group for the NAT gateway and finds that it allows all outbound traffic. What is the most likely cause of the issue?

Accepted Answer

The route table for the private subnet does not have a default route (0.0.0.0/0) pointing to the NAT gateway.. The most likely cause is that the route table for the private subnet does not have a default route (0.0.0.0/0) pointing to the NAT gateway. Without this route, traffic from private instances cannot reach the NAT gateway, and thus cannot access the internet. Option B is incorrect because a NAT gateway must have an Elastic IP assigned during creation, so it would not be missing. Option C is incorrect because NAT gateways do not have security groups; they are managed by AWS and the security group concept does not apply. Option D is incorrect because network ACLs are stateless and must allow both inbound and outbound traffic, but the issue here is more likely with routing.

Answer

The NAT gateway does not have an Elastic IP address assigned.

Answer

The security group for the NAT gateway does not allow inbound traffic from the private subnets.

Answer

The network ACL for the private subnet does not allow inbound HTTP/HTTPS traffic.

Question 8

A company uses AWS Organizations with multiple accounts. The security team wants to centralize the collection of VPC Flow Logs and AWS CloudTrail logs from all accounts into a single Amazon S3 bucket in the management account. The S3 bucket policy must allow cross-account log delivery. Which condition in the bucket policy should be used to restrict log delivery to only the organization's accounts?

Accepted Answer

aws:PrincipalOrgID. The correct condition key is `aws:PrincipalOrgID`, which restricts access to principals (accounts, IAM roles, or users) that are members of the specified AWS Organization. When used in a bucket policy, it ensures that only accounts within the company's organization can deliver logs to the S3 bucket, even if the source account ID changes. Note that `aws:SourceOrgId` is not a valid AWS condition key; `aws:PrincipalOrgID` is the appropriate key for this purpose.

Answer

aws:SourceArn

Answer

aws:SourceOrgId

Answer

aws:SourceAccount

Question 9

A company uses Amazon CloudFront with an Application Load Balancer (ALB) as the origin. The security team wants to restrict access to the ALB so that it only accepts traffic from CloudFront. Which configuration should be used?

Accepted Answer

Configure the ALB security group to allow inbound traffic only from the CloudFront origin IP ranges published by AWS.. CloudFront publishes a list of its origin-facing IP address ranges, and you can restrict the ALB's security group to allow inbound traffic only from those ranges. This ensures that only CloudFront can reach the ALB directly, preventing bypass attacks. AWS provides these IP ranges in the ip-ranges.json file, which can be used to automate security group updates.

Answer

Configure the ALB to be internal and place it in a VPC with a CloudFront VPC origin.

Answer

Configure the ALB to require a specific header 'X-CloudFront-Origin' and reject requests without it.

Answer

Configure the ALB to use an IAM role that allows only CloudFront to invoke the ALB.

Question 10

A company uses AWS CloudHSM to generate and store encryption keys for a custom application. The application runs on Amazon EC2 instances and uses the PKCS#11 interface to interact with the HSM. The security team recently discovered that a former employee may have obtained a copy of the cryptographic materials from the HSM. What should the security team do to minimize the impact?

Accepted Answer

Delete the CloudHSM backup from the backup service. Then rotate all keys that were stored in the HSM.. Deleting the CloudHSM backup prevents the former employee from restoring the HSM's contents from a backup. Rotating all keys ensures that any keys the employee may have copied are no longer valid for encrypting/decrypting data, minimizing the impact of the exposure. Option A is incorrect because AWS KMS cannot manage keys stored in CloudHSM. Option C is incorrect because changing passwords does not invalidate cryptographic material that has already been copied. Option D is incorrect because deleting the HSM cluster alone does not delete the backup, and restoring from an old backup may reintroduce the compromised keys.

Answer

Use AWS KMS to create a new key and re-encrypt all data. Then revoke the old key.

Answer

Change the HSM administrator password and the crypto user passwords.

Answer

Delete the HSM cluster and create a new one. Restore the backup from a known good time.

Question 11

A company runs a web application on an Auto Scaling group of EC2 instances behind an Application Load Balancer. The application stores user session data in an ElastiCache Redis cluster. The security team receives an alert from GuardDuty that one of the EC2 instances is communicating with a known command-and-control (C2) IP address. The instance ID is i-0a1b2c3d4e5f. The security engineer needs to contain the threat immediately while preserving the instance for forensic analysis. Which course of action should the security engineer take?

Accepted Answer

Apply a new security group that denies all inbound and outbound traffic to the instance.. Applying a new security group that denies all inbound and outbound traffic immediately stops the C2 communication at the network layer without destroying the instance. This preserves the instance for forensic analysis (e.g., memory dump, disk imaging) while containing the threat. The security group acts as a virtual firewall, and changing it is a non-destructive, reversible action that can be applied directly to the instance even if it is part of an Auto Scaling group.

Answer

Remove the security group from the Auto Scaling group to isolate the instance.

Answer

Terminate the EC2 instance immediately to stop the communication.

Answer

Create an AMI of the instance for forensic analysis and then terminate the instance.

Question 12

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all IAM users in the production account must use multi-factor authentication (MFA) to access the AWS Management Console. Which combination of actions should the security team take to enforce this requirement?

Accepted Answer

Create an IAM policy that denies all console actions unless MFA is present. Attach the policy to the IAM group that contains all production users.. An IAM policy with a condition that denies all console actions unless MFA is present can be attached to an IAM group containing all production users. This enforces MFA at the user level within the account, directly meeting the requirement to ensure all IAM users in the production account must use MFA to access the AWS Management Console.

Answer

Use an SCP to deny access to the AWS Management Console unless MFA is present. Attach the SCP to the production OU.

Answer

Disable password-based access for all IAM users and require federation with an identity provider that enforces MFA.

Answer

Enable MFA on the root user and apply a password policy that requires MFA.

Question 13

A security analyst needs to review all failed SSH login attempts to an EC2 instance. Which combination will provide this information?

Accepted Answer

Install the CloudWatch agent on the EC2 instance to collect /var/log/secure and stream to CloudWatch Logs.. The CloudWatch agent installed on the EC2 instance can collect OS-level logs such as /var/log/secure (on Linux), which contains detailed records of SSH authentication attempts, including failed logins. By streaming these logs to CloudWatch Logs, the analyst can query and review all failed SSH login attempts at the application layer. Options A, C, and D capture network-level metadata but do not provide information about authentication failures after a successful TCP connection.

Answer

Use AWS Config to record EC2 instance configuration and check for security group changes.

Answer

Enable AWS CloudTrail and search for EC2-related events.

Answer

Enable VPC Flow Logs for the subnet and query the logs in CloudWatch Logs Insights for rejected traffic on port 22.

Question 14

A company has a requirement to detect and alert on anomalous IAM user behavior, such as a user logging in from an unusual geographic location. The company uses AWS Organizations and has multiple accounts. Which services should the company use to meet this requirement? (Choose two.)

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty (C) is correct because it uses machine learning to detect anomalous IAM user behavior, such as logins from unusual geographic locations, across multiple accounts when integrated with AWS Organizations. AWS CloudTrail (E) is correct because it records all IAM user sign-in events and API calls, providing the raw data that GuardDuty analyzes. CloudTrail is essential for capturing the logs that enable GuardDuty to detect anomalies. IAM Access Analyzer (D) is incorrect because it focuses on resource policies and unintended external access, not user behavior anomalies like unusual login locations.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

IAM Access Analyzer

Question 15

A company wants to centralize logs from multiple AWS accounts into a single S3 bucket for analysis. The accounts are part of an AWS Organizations organization. Which set of steps will accomplish this?

Accepted Answer

Create an organization trail in the management account with logging enabled for all accounts.. AWS Organizations allows you to create an organization trail from the management account. When you enable logging for all accounts in the organization, CloudTrail automatically creates a trail that applies to every account in the organization, delivering log files from all accounts to a single S3 bucket without needing per-account configuration.

Answer

Use AWS Config to aggregate logs from all accounts into a central S3 bucket.

Answer

Create a CloudTrail trail in each account and configure each to write to the same S3 bucket.

Answer

Set up Amazon Kinesis Data Firehose in each account to stream logs to a central S3 bucket.