SCS-C02 Practice Test 12 — 15 Questions

Question 1

A security engineer is designing a solution to automatically remediate noncompliant EC2 security groups. The company uses AWS Organizations with multiple accounts. The engineer wants to deploy an AWS Config rule and a custom Lambda function in a central security account to evaluate and remediate security groups across all accounts. Which combination of steps is REQUIRED to allow the Lambda function to modify security groups in member accounts? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an IAM role in each member account that allows the central security account to assume it.. The correct approach is to use AWS Config aggregated rules with remediation actions that invoke Lambda cross-account. Option A is required to allow the central account to assume a role in member accounts; Option C is required to invoke the Lambda function from Config. Option B (same account) is not cross-account. Option D is not required because Config aggregates can work with individual accounts. Option E is redundant.

Answer

Use AWS CloudFormation StackSets to deploy the Lambda function to all member accounts.

Answer

Attach a resource-based policy to the Lambda function granting access to Config from all member accounts.

Answer

Create the Lambda function in each member account and configure Config rules in each account.

Question 2

A security engineer is reviewing an IAM policy attached to a user. The policy is intended to allow the user to read objects from an S3 bucket only from the office IP range 192.0.2.0/24. However, the user reports that they can access objects from any IP address. What is the most likely reason?

Accepted Answer

The policy does not include an explicit Deny for requests outside the IP range.. IAM policies do not have an explicit Deny by default; the Allow with condition only grants access from the specified IP range. However, other policies (like a bucket policy or another IAM policy) could grant access from other IPs, overriding the condition. To prevent access from outside the IP range, an explicit Deny for all other IPs is required. Option B is incorrect because the condition key 'aws:SourceIp' is correctly spelled; it uses a capital 'S' and 'I'. Option C is incorrect because while a bucket policy allowing public access could override, the most likely reason in this scenario is that the IAM policy is missing an explicit Deny, as that is a common misconfiguration. Option D is incorrect because if the resource ARN is missing the bucket name, the policy would not apply to the bucket at all, and the user would not have access, contradicting the ability to access from any IP.

Answer

The condition key is misspelled; it should be aws:SourceIp without the 's'.

Answer

The policy is attached to the user, but the bucket has a bucket policy that allows public access.

Answer

The resource ARN is missing the bucket name.

Question 3

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The security engineer has set up a NAT gateway in a public subnet and updated the route tables accordingly. However, instances in the private subnets cannot reach the internet. The engineer checks the security group for the NAT gateway and finds that it allows all outbound traffic. What is the most likely cause of the issue?

Accepted Answer

The route table for the private subnet does not have a default route (0.0.0.0/0) pointing to the NAT gateway.. The most likely cause is that the route table for the private subnet does not have a default route (0.0.0.0/0) pointing to the NAT gateway. Without this route, traffic from private instances cannot reach the NAT gateway, and thus cannot access the internet. Option B is incorrect because a NAT gateway must have an Elastic IP assigned during creation, so it would not be missing. Option C is incorrect because NAT gateways do not have security groups; they are managed by AWS and the security group concept does not apply. Option D is incorrect because network ACLs are stateless and must allow both inbound and outbound traffic, but the issue here is more likely with routing.

Answer

The NAT gateway does not have an Elastic IP address assigned.

Answer

The security group for the NAT gateway does not allow inbound traffic from the private subnets.

Answer

The network ACL for the private subnet does not allow inbound HTTP/HTTPS traffic.

Question 4

A company uses AWS Organizations with multiple accounts. The security team wants to centralize the collection of VPC Flow Logs and AWS CloudTrail logs from all accounts into a single Amazon S3 bucket in the management account. The S3 bucket policy must allow cross-account log delivery. Which condition in the bucket policy should be used to restrict log delivery to only the organization's accounts?

Accepted Answer

aws:PrincipalOrgID. The correct condition key is `aws:PrincipalOrgID`, which restricts access to principals (accounts, IAM roles, or users) that are members of the specified AWS Organization. When used in a bucket policy, it ensures that only accounts within the company's organization can deliver logs to the S3 bucket, even if the source account ID changes. Note that `aws:SourceOrgId` is not a valid AWS condition key; `aws:PrincipalOrgID` is the appropriate key for this purpose.

Answer

aws:SourceArn

Answer

aws:SourceOrgId

Answer

aws:SourceAccount

Question 5

A company uses Amazon CloudFront with an Application Load Balancer (ALB) as the origin. The security team wants to restrict access to the ALB so that it only accepts traffic from CloudFront. Which configuration should be used?

Accepted Answer

Configure the ALB security group to allow inbound traffic only from the CloudFront origin IP ranges published by AWS.. CloudFront publishes a list of its origin-facing IP address ranges, and you can restrict the ALB's security group to allow inbound traffic only from those ranges. This ensures that only CloudFront can reach the ALB directly, preventing bypass attacks. AWS provides these IP ranges in the ip-ranges.json file, which can be used to automate security group updates.

Answer

Configure the ALB to be internal and place it in a VPC with a CloudFront VPC origin.

Answer

Configure the ALB to require a specific header 'X-CloudFront-Origin' and reject requests without it.

Answer

Configure the ALB to use an IAM role that allows only CloudFront to invoke the ALB.

Question 6

A company runs a web application on an Auto Scaling group of EC2 instances behind an Application Load Balancer. The application stores user session data in an ElastiCache Redis cluster. The security team receives an alert from GuardDuty that one of the EC2 instances is communicating with a known command-and-control (C2) IP address. The instance ID is i-0a1b2c3d4e5f. The security engineer needs to contain the threat immediately while preserving the instance for forensic analysis. Which course of action should the security engineer take?

Accepted Answer

Apply a new security group that denies all inbound and outbound traffic to the instance.. Applying a new security group that denies all inbound and outbound traffic immediately stops the C2 communication at the network layer without destroying the instance. This preserves the instance for forensic analysis (e.g., memory dump, disk imaging) while containing the threat. The security group acts as a virtual firewall, and changing it is a non-destructive, reversible action that can be applied directly to the instance even if it is part of an Auto Scaling group.

Answer

Remove the security group from the Auto Scaling group to isolate the instance.

Answer

Terminate the EC2 instance immediately to stop the communication.

Answer

Create an AMI of the instance for forensic analysis and then terminate the instance.

Question 7

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all IAM users in the production account must use multi-factor authentication (MFA) to access the AWS Management Console. Which combination of actions should the security team take to enforce this requirement?

Accepted Answer

Create an IAM policy that denies all console actions unless MFA is present. Attach the policy to the IAM group that contains all production users.. An IAM policy with a condition that denies all console actions unless MFA is present can be attached to an IAM group containing all production users. This enforces MFA at the user level within the account, directly meeting the requirement to ensure all IAM users in the production account must use MFA to access the AWS Management Console.

Answer

Use an SCP to deny access to the AWS Management Console unless MFA is present. Attach the SCP to the production OU.

Answer

Disable password-based access for all IAM users and require federation with an identity provider that enforces MFA.

Answer

Enable MFA on the root user and apply a password policy that requires MFA.

Question 8

A security analyst needs to review all failed SSH login attempts to an EC2 instance. Which combination will provide this information?

Accepted Answer

Install the CloudWatch agent on the EC2 instance to collect /var/log/secure and stream to CloudWatch Logs.. The CloudWatch agent installed on the EC2 instance can collect OS-level logs such as /var/log/secure (on Linux), which contains detailed records of SSH authentication attempts, including failed logins. By streaming these logs to CloudWatch Logs, the analyst can query and review all failed SSH login attempts at the application layer. Options A, C, and D capture network-level metadata but do not provide information about authentication failures after a successful TCP connection.

Answer

Use AWS Config to record EC2 instance configuration and check for security group changes.

Answer

Enable AWS CloudTrail and search for EC2-related events.

Answer

Enable VPC Flow Logs for the subnet and query the logs in CloudWatch Logs Insights for rejected traffic on port 22.

Question 9

A company has a requirement to detect and alert on anomalous IAM user behavior, such as a user logging in from an unusual geographic location. The company uses AWS Organizations and has multiple accounts. Which services should the company use to meet this requirement? (Choose two.)

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty (C) is correct because it uses machine learning to detect anomalous IAM user behavior, such as logins from unusual geographic locations, across multiple accounts when integrated with AWS Organizations. AWS CloudTrail (E) is correct because it records all IAM user sign-in events and API calls, providing the raw data that GuardDuty analyzes. CloudTrail is essential for capturing the logs that enable GuardDuty to detect anomalies. IAM Access Analyzer (D) is incorrect because it focuses on resource policies and unintended external access, not user behavior anomalies like unusual login locations.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

IAM Access Analyzer

Question 10

A company wants to centralize logs from multiple AWS accounts into a single S3 bucket for analysis. The accounts are part of an AWS Organizations organization. Which set of steps will accomplish this?

Accepted Answer

Create an organization trail in the management account with logging enabled for all accounts.. AWS Organizations allows you to create an organization trail from the management account. When you enable logging for all accounts in the organization, CloudTrail automatically creates a trail that applies to every account in the organization, delivering log files from all accounts to a single S3 bucket without needing per-account configuration.

Answer

Use AWS Config to aggregate logs from all accounts into a central S3 bucket.

Answer

Create a CloudTrail trail in each account and configure each to write to the same S3 bucket.

Answer

Set up Amazon Kinesis Data Firehose in each account to stream logs to a central S3 bucket.

Question 11

A company is using Amazon GuardDuty to detect threats. The security team notices that GuardDuty findings are not triggering the intended automated response via a CloudWatch Events rule. What is the most likely reason?

Accepted Answer

The CloudWatch Events rule's event pattern does not match the GuardDuty finding event structure.. GuardDuty findings are sent to CloudWatch Events as events with a specific structure, including fields like 'detail-type' set to 'GuardDuty Finding' and 'source' set to 'aws.guardduty'. If the CloudWatch Events rule's event pattern does not match this exact structure—for example, if it filters on the wrong 'source' or 'detail-type'—the rule will not trigger the intended automated response. This is the most common reason for the described failure.

Answer

The GuardDuty detector is in a different region than the CloudWatch Events rule.

Answer

The Lambda function invoked by CloudWatch Events does not have an IAM role assigned.

Answer

VPC Flow Logs are not enabled.

Question 12

A DevOps engineer needs to monitor failed SSH login attempts to Amazon EC2 instances. Which AWS service should the engineer use to collect and analyze the login events?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is the correct service because it can ingest, monitor, and analyze log data from EC2 instances, including SSH authentication logs (e.g., /var/log/secure or /var/log/auth.log). By installing the CloudWatch Logs agent on the EC2 instance, the engineer can stream these log events to CloudWatch Logs, where they can be searched, visualized, and used to trigger alarms on failed SSH attempts. AWS Config tracks resource configuration changes, not OS-level login events; CloudTrail records AWS API calls, not guest OS logs; and VPC Flow Logs capture network traffic metadata, not application or authentication logs.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

VPC Flow Logs

Question 13

A security engineer needs to monitor for unauthorized changes to security group rules in an AWS account. Which AWS service can evaluate security group rules against a desired configuration and alert on changes?

Accepted Answer

AWS Config. AWS Config is correct because it provides a managed rule called 'restricted-ssh' or custom rules using AWS Config managed rules or Lambda functions to evaluate security group rules against a desired configuration. When a security group rule is added, removed, or modified, AWS Config detects the configuration change, evaluates it against the defined rules, and can trigger an Amazon SNS notification to alert the security engineer. This makes AWS Config the appropriate service for continuous monitoring and alerting on unauthorized changes to security group rules.

Answer

AWS Security Hub

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Question 14

A company wants to detect and alert on changes to IAM roles and policies in their AWS account. Which combination of AWS services should they use?

Accepted Answer

AWS CloudTrail and Amazon EventBridge (CloudWatch Events). AWS CloudTrail records all API calls, including changes to IAM roles and policies, and delivers log files to an S3 bucket or CloudWatch Logs. Amazon EventBridge (formerly CloudWatch Events) can then be used to create rules that match specific CloudTrail events (e.g., PutRolePolicy, CreateRole) and trigger alerts via SNS, Lambda, or other targets. This combination provides real-time detection and notification of IAM modifications.

Answer

Amazon GuardDuty and AWS Shield

Answer

Amazon CloudWatch Logs and AWS Lambda

Answer

AWS Config and Amazon Inspector

Question 15

A company wants to block SSH access (port 22) to all EC2 instances from the internet, but allow SSH from a specific management VPN IP range (10.0.0.0/16). Which configuration should be used?

Accepted Answer

Configure a security group to allow inbound SSH from 10.0.0.0/16 only.. Security groups are stateful firewalls that control inbound and outbound traffic at the instance level. By configuring a security group to allow inbound SSH (port 22) only from the management VPN IP range (10.0.0.0/16), all other inbound traffic on port 22 is implicitly denied because security groups operate on a default-deny principle. This meets the requirement to block SSH from the internet while permitting access from the specified internal range.

Answer

Use an IAM policy to restrict SSH access to the management IP range.

Answer

Configure a network ACL to allow inbound SSH from 10.0.0.0/16 and deny from 0.0.0.0/0.

Answer

Configure a security group to allow inbound SSH from 0.0.0.0/0 and deny from 10.0.0.0/16.