SCS-C02 Practice Test 12 — 15 Questions

Question 1

A company is using Amazon GuardDuty to detect threats. The security team notices that GuardDuty findings are not triggering the intended automated response via a CloudWatch Events rule. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The CloudWatch Events rule's event pattern does not match the GuardDuty finding event structure.. GuardDuty findings are sent to CloudWatch Events as events with a specific structure, including fields like 'detail-type' set to 'GuardDuty Finding' and 'source' set to 'aws.guardduty'. If the CloudWatch Events rule's event pattern does not match this exact structure—for example, if it filters on the wrong 'source' or 'detail-type'—the rule will not trigger the intended automated response. This is the most common reason for the described failure.

Answer

The GuardDuty detector is in a different region than the CloudWatch Events rule.

Answer

The Lambda function invoked by CloudWatch Events does not have an IAM role assigned.

Answer

VPC Flow Logs are not enabled.

Question 2

A DevOps engineer needs to monitor failed SSH login attempts to Amazon EC2 instances. Which AWS service should the engineer use to collect and analyze the login events?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is the correct service because it can ingest, monitor, and analyze log data from EC2 instances, including SSH authentication logs (e.g., /var/log/secure or /var/log/auth.log). By installing the CloudWatch Logs agent on the EC2 instance, the engineer can stream these log events to CloudWatch Logs, where they can be searched, visualized, and used to trigger alarms on failed SSH attempts. AWS Config tracks resource configuration changes, not OS-level login events; CloudTrail records AWS API calls, not guest OS logs; and VPC Flow Logs capture network traffic metadata, not application or authentication logs.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

VPC Flow Logs

Question 3

A company uses AWS CloudFormation to deploy infrastructure. The security team wants to ensure that all S3 buckets created by CloudFormation have encryption enabled by default. Which TWO approaches can achieve this?

Accepted Answer

Create an AWS Config rule that checks for S3 bucket encryption and auto-remediates. An AWS Config rule can check that S3 buckets have encryption enabled and automatically remediate any non-compliant buckets. Option C is correct because a service control policy (SCP) can be attached to the root OU to deny the creation of S3 buckets without encryption, using a condition on the s3:x-amz-server-side-encryption header. Option B is incorrect because S3 Block Public Access does not enforce encryption. Option D is incorrect because attaching an IAM role to CloudFormation only grants permissions but does not enforce encryption. Option E is incorrect because CloudFormation stack policies only protect existing resources from updates and cannot enforce conditions on bucket creation.

Answer

Enable S3 Block Public Access at the account level

Answer

Attach an IAM role to the CloudFormation service that grants permissions to encrypt buckets

Answer

Use a CloudFormation stack policy to deny creation of S3 buckets without encryption

Question 4

A security engineer needs to monitor for unauthorized changes to security group rules in an AWS account. Which AWS service can evaluate security group rules against a desired configuration and alert on changes?

Accepted Answer

AWS Config. AWS Config is correct because it provides a managed rule called 'restricted-ssh' or custom rules using AWS Config managed rules or Lambda functions to evaluate security group rules against a desired configuration. When a security group rule is added, removed, or modified, AWS Config detects the configuration change, evaluates it against the defined rules, and can trigger an Amazon SNS notification to alert the security engineer. This makes AWS Config the appropriate service for continuous monitoring and alerting on unauthorized changes to security group rules.

Answer

AWS Security Hub

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Question 5

A company is deploying a web application on EC2 instances behind an Application Load Balancer. The security team requires that all traffic between the ALB and the EC2 instances be encrypted. Which configuration should the engineer implement?

Accepted Answer

Configure the ALB listener with HTTPS protocol and the target group with HTTPS protocol, and install SSL certificates on the EC2 instances.. It ensures end-to-end encryption between the ALB and EC2 instances. The ALB listener uses HTTPS to terminate client SSL/TLS, and the target group uses HTTPS to re-encrypt traffic to the instances, requiring SSL certificates on the EC2 instances to decrypt and re-encrypt. This satisfies the security requirement that all traffic between the ALB and EC2 instances be encrypted.

Answer

Configure the ALB listener with HTTP protocol and the target group with HTTP protocol, then use a security group to restrict traffic.

Answer

Configure the ALB listener with HTTPS protocol and the target group with HTTP protocol.

Answer

Configure the ALB listener with TCP protocol and the target group with TCP protocol, then install SSL certificates on the EC2 instances.

Question 6

A company wants to detect and alert on changes to IAM roles and policies in their AWS account. Which combination of AWS services should they use?

Accepted Answer

AWS CloudTrail and Amazon EventBridge (CloudWatch Events). AWS CloudTrail records all API calls, including changes to IAM roles and policies, and delivers log files to an S3 bucket or CloudWatch Logs. Amazon EventBridge (formerly CloudWatch Events) can then be used to create rules that match specific CloudTrail events (e.g., PutRolePolicy, CreateRole) and trigger alerts via SNS, Lambda, or other targets. This combination provides real-time detection and notification of IAM modifications.

Answer

Amazon GuardDuty and AWS Shield

Answer

Amazon CloudWatch Logs and AWS Lambda

Answer

AWS Config and Amazon Inspector

Question 7

A DevOps engineer notices that an EC2 instance's CloudWatch agent is not sending custom metrics to CloudWatch. The agent is installed and the configuration file is valid. The instance has an IAM role attached. What is the most likely reason for the failure?

Accepted Answer

The IAM role attached to the instance does not have the cloudwatch:PutMetricData permission.. The CloudWatch agent requires IAM permissions to publish custom metrics. Even if the agent is installed, running, and has a valid configuration, it will fail to send metrics if the attached IAM role lacks the `cloudwatch:PutMetricData` action. This is a common misconfiguration where the instance has an IAM role, but the role's policy does not explicitly grant the necessary CloudWatch write permissions.

Answer

The instance does not have internet access to reach CloudWatch endpoints.

Answer

The CloudWatch agent is not running as root.

Answer

The CloudWatch agent configuration file has a syntax error.

Question 8

A company wants to block SSH access (port 22) to all EC2 instances from the internet, but allow SSH from a specific management VPN IP range (10.0.0.0/16). Which configuration should be used?

Accepted Answer

Configure a security group to allow inbound SSH from 10.0.0.0/16 only.. Security groups are stateful firewalls that control inbound and outbound traffic at the instance level. By configuring a security group to allow inbound SSH (port 22) only from the management VPN IP range (10.0.0.0/16), all other inbound traffic on port 22 is implicitly denied because security groups operate on a default-deny principle. This meets the requirement to block SSH from the internet while permitting access from the specified internal range.

Answer

Use an IAM policy to restrict SSH access to the management IP range.

Answer

Configure a network ACL to allow inbound SSH from 10.0.0.0/16 and deny from 0.0.0.0/0.

Answer

Configure a security group to allow inbound SSH from 0.0.0.0/0 and deny from 10.0.0.0/16.

Question 9

A company has a multi-account AWS environment using AWS Organizations. The security team needs to enforce that all new S3 buckets created in any account in the organization are encrypted with a specific KMS key. Which approach should be used?

Accepted Answer

Apply a Service Control Policy (SCP) that denies s3:CreateBucket unless encryption is configured. Service Control Policies (SCPs) in AWS Organizations can centrally deny the creation of S3 buckets unless specific encryption conditions are met. By using an SCP with a condition that requires `s3:x-amz-server-side-encryption-aws-kms-key-id` to match the specific KMS key ARN, the security team can enforce encryption at the organizational level, preventing any account from creating non-compliant buckets regardless of IAM permissions.

Answer

Set up AWS Config rules to detect non-compliant buckets

Answer

Create an IAM role that requires encryption and attach it to all users

Answer

Use an S3 bucket policy with a condition for encryption

Question 10

Refer to the exhibit. A security engineer is unable to SSH into an EC2 instance in subnet-12345678. The instance's security group allows inbound SSH from 10.0.0.0/8, and the instance has a public IP. What is the most likely reason for the failure?

Accepted Answer

The security group inbound rule restricts SSH to the 10.0.0.0/8 range, blocking the engineer's IP.. The network ACL allows inbound SSH from 0.0.0.0/0, but the security group only allows SSH from 10.0.0.0/8. Since the engineer is connecting from an IP outside that range, the security group blocks the connection.

Answer

The security group egress rule is blocking return traffic.

Answer

The network ACL's default deny rule (32767) is blocking all inbound traffic.

Answer

The network ACL inbound rule for SSH is misconfigured, denying all traffic.

Question 11

A company has deployed a multi-tier web application on AWS. The web servers are in a public subnet, and the application servers are in a private subnet. The security team wants to ensure that the application servers cannot initiate outbound connections to the internet. What should the team do?

Accepted Answer

Remove the default route (0.0.0.0/0) pointing to an internet gateway or NAT gateway from the private subnet's route table.. Removing the default route (0.0.0.0/0) from the private subnet's route table ensures that any traffic destined for the internet has no valid path, effectively preventing application servers from initiating outbound internet connections. Network ACLs and security groups are stateful or stateless filters but do not control routing; without a route, packets cannot leave the subnet regardless of allow rules. This aligns with the principle of using route tables to enforce network segmentation in a multi-tier architecture.

Answer

Add a deny rule for all outbound traffic in the network ACL of the private subnet.

Answer

Modify the security group of the application servers to deny all outbound traffic.

Answer

Attach an egress-only internet gateway to the private subnet.

Question 12

A company uses Amazon RDS for MySQL with encryption at rest enabled using AWS KMS. They need to ensure that automated backups and snapshots are also encrypted. Which configuration is required?

Accepted Answer

No additional configuration is needed; backups are encrypted automatically.. Amazon RDS automatically encrypts automated backups and snapshots when the source database is encrypted at rest. This encryption is inherited from the primary database, so no additional steps are required. Options B, C, and D are incorrect: manually encrypting each snapshot is unnecessary; assigning a new KMS key to backups is not required; and enabling encryption after creation is not possible for an existing unencrypted instance.

Answer

Manually encrypt each snapshot with a separate KMS key.

Answer

Create a new KMS key and assign it to the backup configuration.

Answer

Enable encryption on the RDS instance after creation.

Question 13

A security engineer creates an Amazon CloudWatch Events rule with this event pattern to trigger an AWS Lambda function for automated response to GuardDuty findings. However, the Lambda function is not triggered for new findings. What is the MOST likely cause?

Accepted Answer

The event pattern does not match the actual structure of GuardDuty findings.. The event pattern provided in the CloudWatch Events rule must exactly match the JSON structure of a GuardDuty finding as it is published to the default event bus. GuardDuty findings are delivered with a specific schema that includes a `detail` object containing `type`, `severity`, and other fields. If the event pattern uses incorrect field names, nesting, or missing required elements (e.g., `source` must be `aws.guardduty`), CloudWatch Events will not match the incoming events, and the Lambda function will not be triggered.

Answer

The finding type is not specified in the pattern.

Answer

CloudTrail is not enabled in the account.

Answer

The Lambda function does not have permission to be invoked by CloudWatch Events.

Question 14

A security engineer is investigating a potential data exfiltration from an S3 bucket. Which AWS service should be used to analyze the VPC Flow Logs for the S3 bucket's endpoint?

Accepted Answer

Amazon Detective. Amazon Detective is the correct service because it can ingest and analyze VPC Flow Logs, including those for a VPC endpoint used to access an S3 bucket. Detective uses machine learning, statistical analysis, and graph theory to identify the root cause of suspicious network traffic patterns, such as unusual data volumes or connections to external IPs, which are indicative of data exfiltration.

Answer

Amazon Macie

Answer

Amazon Inspector

Answer

Amazon GuardDuty

Question 15

A Security Engineer is designing a network architecture for a multi-tier application. The web tier must be accessible from the internet, while the application tier should only be accessible from the web tier, and the database tier only from the application tier. All tiers are in the same VPC. Which configuration meets these requirements with minimal administrative overhead?

Accepted Answer

Use security groups with inbound rules that reference the security group of the previous tier.. Security groups are stateful and can reference other security groups as a source in inbound rules, allowing traffic from any instance associated with the referenced security group regardless of IP address changes. This creates a logical dependency chain (web SG → app SG → db SG) that enforces the required tier-to-tier access with zero maintenance when instances scale or subnets change. Option D meets the requirement with minimal administrative overhead because security group references automatically adapt to dynamic environments.

Answer

Use network ACLs with inbound rules that reference the prefix list of the previous tier's subnets.

Answer

Use network ACLs with inbound rules that allow traffic from the previous tier's subnet CIDR.

Answer

Use security groups with inbound rules that allow traffic from the previous tier's public IP addresses.