SCS-C02 Practice Test 12 — 15 Questions

Question 1

A security engineer must ensure that cross-account access to an S3 bucket is restricted to only accounts that are part of a specific AWS organization. Which IAM policy condition key should be used in the bucket policy?

Accepted Answer

aws:PrincipalOrgID. Option D is correct because 'aws:PrincipalOrgID' condition key checks that the principal's account belongs to a specific AWS organization. Option A is for MFA. Option B is for source IP. Option C is for VPC endpoint.

Answer

aws:SourceIp

Answer

aws:MultiFactorAuthPresent

Answer

aws:SourceVpce

Question 2

Drag and drop the steps to set up AWS Certificate Manager (ACM) for a custom domain in the correct order.

Question 3

Drag and drop the steps to configure Amazon GuardDuty for multi-account security in the correct order.

Question 4

Drag and drop the steps to implement a secure CI/CD pipeline with AWS CodePipeline and IAM in the correct order.

Question 5

Drag and drop the steps to respond to a suspected AWS IAM credential compromise in the correct order.

Question 6

Refer to the exhibit. A security engineer wants to monitor a Lambda function for errors and create a CloudWatch alarm when errors exceed a threshold. The engineer notices the log group exists but has no metric filters. What should the engineer do to set up the alarm?

Accepted Answer

Create a metric filter on the log group to count occurrences of 'ERROR' in log streams, then create an alarm based on that metric.. The exhibit shows no metric filters exist. To alarm on errors, the engineer must create a metric filter that parses logs for error patterns and emits a metric, then create an alarm on that metric.

Answer

Enable CloudWatch Contributor Insights for the Lambda function to automatically detect errors.

Answer

Configure the Lambda function to publish custom metrics for errors instead of relying on logs.

Answer

Use CloudWatch Logs Insights to query logs for errors and create an alarm directly from the query results.

Question 7

Match each AWS security control to its category.

Question 8

Match each AWS CloudHSM feature to its description.

Question 9

Match each AWS CloudTrail log type to its description.

Question 10

Match each AWS IAM policy type to its description.

Question 11

Match each AWS KMS key type to its description.

Question 12

Match each AWS security tool to its purpose.

Question 13

A security team suspects that an attacker has compromised an EC2 instance and is using it to launch outbound DDoS attacks. The team needs to quickly isolate the instance while preserving forensic data. Which combination of actions should the team take? (Choose TWO.)

Accepted Answer

Apply a restrictive security group that blocks all outbound traffic.. Option A is correct because applying a restrictive security group that blocks all outbound traffic immediately stops the EC2 instance from sending any network packets, including DDoS traffic, without terminating the instance. This preserves the running state and allows forensic data collection from the instance's memory and disk. Security groups act as a stateful virtual firewall at the instance level, so blocking outbound traffic effectively isolates the instance from the network.

Answer

Modify the network ACL for the subnet to deny all outbound traffic.

Answer

Detach the instance from the Auto Scaling group.

Answer

Terminate the EC2 instance immediately.

Question 14

An IAM user needs to rotate their own access keys. Which IAM policy action should be allowed?

Accepted Answer

iam:UpdateAccessKey. Option C is correct because IAM:UpdateAccessKey is used to manage a user's own access keys. Option A is wrong because IAM:CreateAccessKey creates a new key, but rotation involves updating. Option B is wrong because IAM:ChangePassword is for password. Option D is wrong because IAM:DeleteAccessKey deletes a key.

Answer

iam:DeleteAccessKey

Answer

iam:CreateAccessKey

Answer

iam:ChangePassword

Question 15

A security engineer needs to detect and alert on suspicious API calls made from a compromised EC2 instance. The instance is associated with an IAM role that has permissions to call various AWS APIs. Which AWS service should the engineer use to monitor API calls and trigger alerts?

Accepted Answer

AWS CloudTrail combined with Amazon CloudWatch Events. AWS CloudTrail records all API calls made by or on behalf of the EC2 instance's IAM role. By sending these logs to Amazon CloudWatch Events (now Amazon EventBridge), you can create rules that match specific API actions (e.g., 'ec2:TerminateInstances') and trigger alerts via SNS, Lambda, or other targets. This combination provides real-time monitoring and alerting for suspicious API activity from a compromised instance.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

VPC Flow Logs