SCS-C02 Practice Test 13 — 15 Questions

Question 1

Refer to the exhibit. A security engineer runs the CLI command and receives the output shown. The engineer expects to see flow logs for a specific subnet, but the output shows the resource ID as a VPC. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The flow log was created at the VPC level, not at the subnet level.. The output shows the resource ID as a VPC (vpc-xxxx), but the security engineer expected to see flow logs for a specific subnet. This indicates that the flow log was created at the VPC level, not at the subnet level. In AWS, VPC Flow Logs can be created at the VPC, subnet, or network interface level, and the resource ID in the flow log output reflects the level at which the log was configured. Since the engineer expected subnet-level logs, the most likely reason is that the flow log was created for the entire VPC instead of the specific subnet.

Answer

The flow log is not active; it shows ACTIVE, so that's not the issue.

Answer

The flow log is configured to deliver to CloudWatch, but the log group name is incorrect.

Answer

The IAM role does not have permissions to deliver logs for subnets.

Question 2

A company uses AWS Organizations with multiple accounts. The security team needs to centrally monitor all API calls made in the member accounts. The team wants to ensure that all CloudTrail logs are delivered to a centralized S3 bucket in the management account. Which configuration should the security team implement?

Accepted Answer

Create an organization trail in the management account with the S3 bucket in the management account.. AWS Organizations supports creating an organization trail in the management account that automatically applies to all member accounts. This ensures that all API calls from every account in the organization are logged and delivered to a centralized S3 bucket in the management account without needing to configure individual trails or manage cross-account permissions manually.

Answer

Configure CloudWatch cross-account subscription to send logs from member accounts to the management account.

Answer

Enable CloudTrail in each member account and configure each trail to deliver logs to the same S3 bucket.

Answer

Use Amazon S3 replication to copy logs from member account buckets to the management account bucket.

Question 3

A company is using AWS Direct Connect with a private virtual interface (VIF) to connect its on-premises network to a VPC. The security team wants to encrypt traffic over the Direct Connect connection. Which TWO options can be used? (Choose TWO.)

Accepted Answer

Enable MACsec on the Direct Connect connection.. Option C is correct because AWS Direct Connect supports MACsec (IEEE 802.1AE) on dedicated connections at 10 Gbps and 100 Gbps, providing point-to-point Layer 2 encryption between the on-premises router and the AWS Direct Connect location. Option E is correct because you can run an IPsec VPN over the private VIF (or a transit VIF) on top of Direct Connect, which encrypts traffic end-to-end at Layer 3 between the on-premises VPN device and the AWS VPN endpoint. Option A is incorrect because AWS KMS is a key management service for encrypting data at rest, not for encrypting network traffic in transit over Direct Connect. Option B is incorrect because ACM issues and manages TLS certificates for AWS-integrated services, not for encrypting a Direct Connect link. Option D is incorrect because generic SSL/TLS is not a supported mechanism for encrypting the Direct Connect private VIF transport itself; encryption must come from MACsec or an IPsec VPN.

Answer

Use AWS KMS to encrypt the traffic.

Answer

Use AWS Certificate Manager to issue certificates for the connection.

Answer

Use SSL/TLS to encrypt the traffic between on-premises and AWS.

Question 4

A security engineer notices that an Amazon EC2 instance has a security group that allows inbound SSH (port 22) from 0.0.0.0/0. The instance is a bastion host. What is a more secure alternative to this configuration?

Accepted Answer

Remove the inbound SSH rule and use AWS Systems Manager Session Manager to access the instance.. AWS Systems Manager Session Manager provides secure, auditable, and keyless shell access to EC2 instances without opening any inbound ports. It uses the AWS Systems Manager agent to initiate an outbound connection to the AWS SSM endpoint over HTTPS (port 443), eliminating the need for a bastion host or any inbound SSH rule. This approach also integrates with AWS Identity and Access Management (IAM) for fine-grained access control and AWS CloudTrail for full session logging.

Answer

Change the SSH port to a non-standard port to avoid automated attacks.

Answer

Restrict the inbound SSH rule to a single IP address from the corporate network.

Answer

Replace the security group rule with a network ACL that allows SSH from 0.0.0.0/0.

Question 5

A healthcare company runs a HIPAA-compliant application on AWS. The application uses Amazon S3 to store Protected Health Information (PHI). The company has implemented the following controls: (1) All S3 buckets are configured with default encryption using SSE-S3. (2) Bucket policies restrict access to only authorized IAM roles. (3) S3 access logs are enabled and sent to a centralized logging account. (4) MFA Delete is enabled on all buckets. (5) Object lock is not enabled. Recently, an internal auditor discovered that when an authorized user deletes an object, the object is permanently deleted and cannot be recovered. The company's data retention policy requires that deleted PHI be recoverable for at least 30 days after deletion. A review of the IAM policies shows that users have s3:DeleteObject permission. The auditor also notes that the bucket versioning is not enabled. The security team needs to implement a solution that allows authorized users to delete objects but ensures that deleted objects can be recovered within 30 days. Which of the following is the MOST effective course of action?

Accepted Answer

Enable S3 Versioning on the buckets and ensure that the IAM policies include s3:DeleteObjectVersion where appropriate.. Enabling S3 Versioning is the most effective solution because it preserves all object versions, including deleted objects (which become delete markers). With versioning enabled, authorized users can still use s3:DeleteObject to delete the current version, but the previous versions remain recoverable. Since the requirement is to recover deleted PHI within 30 days, versioning combined with a lifecycle policy to permanently delete old versions after 30 days would meet the retention policy without blocking immediate deletion.

Answer

Enable S3 Object Lock in Governance mode with a retention period of 30 days.

Answer

Remove the s3:DeleteObject permission from all IAM policies and use S3 Lifecycle policies to expire objects after 30 days.

Answer

Change the default encryption from SSE-S3 to SSE-C and use a separate key for each object.

Question 6

A security engineer is troubleshooting connectivity issues between an Amazon EC2 instance in a VPC and an on-premises server over a Direct Connect virtual interface. The EC2 instance has a security group that allows outbound traffic to the on-premises CIDR block (10.0.0.0/16). The VPC has a route table entry pointing the on-premises CIDR to the virtual private gateway. The on-premises firewall shows that packets are received from the EC2 instance but responses are not reaching the instance. What is the most likely cause?

Accepted Answer

The on-premises router does not have a route pointing the VPC CIDR back to the Direct Connect interface.. The on-premises firewall logs show packets are received from the EC2 instance, but responses are not reaching it. This indicates a routing issue on the on-premises side: the on-premises router must have a route pointing the VPC CIDR back to the Direct Connect interface (virtual interface) for return traffic to be forwarded correctly. Without this return route, the on-premises server sends responses via its default route (likely the internet), which are dropped by the VPC security group or never reach the EC2 instance.

Answer

The network ACL for the subnet is blocking outbound traffic to the on-premises CIDR.

Answer

The virtual private gateway is not attached to the VPC.

Answer

The security group does not allow inbound traffic from the on-premises server.

Question 7

A security engineer is configuring VPC Flow Logs to capture network traffic metadata. Which TWO attributes can be captured in VPC Flow Logs? (Choose TWO.)

Accepted Answer

Source IP address. VPC Flow Logs capture metadata about network traffic, including the source IP address (option B) and destination port (option D). The source IP address identifies the origin of the traffic, while the destination port indicates the application or service being targeted. These are standard fields in the flow log record format, as defined by AWS for capturing IP traffic metadata.

Answer

Packet payload

Answer

IAM user ID

Answer

DNS query name

Question 8

A company uses AWS CloudTrail to log all API activity. The security team wants to ensure that any changes to CloudTrail configuration (e.g., disabling the trail, deleting the trail, modifying the log delivery) are detected immediately. They have created a CloudWatch Events rule to capture the event 'StopLogging' and send an SNS notification. During testing, the team stops the trail and does not receive the notification. The CloudWatch Events rule is configured with the correct event pattern. What should the team check?

Accepted Answer

Check the IAM role associated with the CloudWatch Events rule to ensure it has permissions to publish to the SNS topic.. CloudWatch Events rules require an IAM role with permissions to invoke the target (e.g., publish to SNS). Even if the event pattern matches and the SNS topic exists, without a properly configured IAM role that grants `sns:Publish` to the CloudWatch Events service, the rule cannot deliver the notification. This is a common misconfiguration that causes silent failures.

Answer

Verify that the CloudTrail trail is logging management events.

Answer

Ensure that the event pattern includes the correct source and detail-type.

Answer

Confirm that the SNS topic subscription is confirmed.

Question 9

A financial services company runs a critical application on Amazon EC2 instances in a VPC. The application processes sensitive financial data and must meet strict compliance requirements. The security team recently discovered that an EC2 instance was compromised due to an unpatched vulnerability. The attacker used the instance's IAM role to access an S3 bucket containing customer data and exfiltrated the data. The security team needs to prevent such incidents in the future. They have implemented the following controls: 
- All EC2 instances are launched in private subnets. 
- The IAM roles used by EC2 instances follow the principle of least privilege. 
- Security groups restrict inbound and outbound traffic. 
- AWS Systems Manager Patch Manager is used to patch instances. 
- AWS CloudTrail is enabled and logs are sent to a centralized S3 bucket. 
- Amazon GuardDuty is enabled.

Despite these controls, the team is concerned about the blast radius if an instance is compromised again. Which additional measure would MOST effectively limit the blast radius of a compromised EC2 instance?

Accepted Answer

Use S3 VPC Endpoints with a bucket policy that only allows access from the VPC endpoint, and use Systems Manager Session Manager instead of SSH.. Using an S3 VPC endpoint with a bucket policy that restricts access exclusively to that endpoint ensures that compromised EC2 instances can only reach S3 through the VPC endpoint, preventing data exfiltration over the internet. Additionally, replacing SSH with Systems Manager Session Manager eliminates the need for open inbound SSH ports and provides fine-grained access control through IAM, reducing the attack surface and blast radius.

Answer

Enable VPC Flow Logs to monitor traffic to S3.

Answer

Deploy AWS WAF in front of the S3 bucket.

Answer

Create an AWS Config rule to detect S3 access from EC2 instances.

Question 10

A company uses AWS CloudTrail to log all API activity. They want to ensure that log files are tamper-proof and can be validated for forensic purposes. Which of the following should they enable?

Accepted Answer

CloudTrail log file integrity validation. CloudTrail log file integrity validation uses a SHA-256 hash chain to detect if log files have been modified, deleted, or altered after delivery. When enabled, CloudTrail delivers a digest file that includes the hash of each log file and the hash of the previous digest, creating an immutable chain that can be used to verify log integrity for forensic purposes.

Answer

AWS KMS server-side encryption on the S3 bucket

Answer

S3 bucket versioning

Answer

S3 Object Lock with governance mode

Question 11

A company has a requirement that all S3 buckets must block public access. The security engineer needs to continuously monitor for compliance and automatically remediate any noncompliant buckets. Which combination of AWS services should the engineer use?

Accepted Answer

AWS Config and AWS Lambda (or SSM Automation). AWS Config continuously evaluates S3 bucket configurations against a managed rule such as 's3-bucket-public-read-prohibited' or 's3-bucket-level-public-access-prohibited', detecting any bucket that becomes noncompliant. Config can then trigger an EventBridge event that invokes a Lambda function or SSM Automation document to re-apply the Block Public Access settings, delivering both continuous monitoring and automatic remediation. This is the canonical AWS pattern for compliance enforcement.

Answer

Amazon GuardDuty and AWS Security Hub

Answer

AWS Organizations SCPs and AWS CloudTrail

Answer

AWS Trusted Advisor and Amazon SNS

Question 12

A company wants to receive real-time notifications for every root user login to the AWS Management Console. Which service should be used?

Accepted Answer

Amazon CloudWatch Events. Amazon CloudWatch Events (now part of Amazon EventBridge) can capture AWS API calls via CloudTrail and trigger a rule that matches the 'RootLogin' event. This allows real-time notification through SNS, Lambda, or other targets whenever a root user signs in to the Management Console.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

AWS Config

Question 13

A developer needs to allow a Lambda function to write logs to CloudWatch Logs. What is the MINIMUM IAM policy that should be attached to the Lambda execution role?

Accepted Answer

{"Effect":"Allow","Action":["logs:CreateLogGroup","logs:CreateLogStream","logs:PutLogEvents"],"Resource":"*"}. The minimum policy for a Lambda function to write logs to CloudWatch Logs must include logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents. Lambda creates the log group and stream on first invocation, so all three actions are required. Resource '*' is acceptable because the log group name is not known in advance and Lambda needs to create it dynamically.

Answer

{"Effect":"Allow","Action":"logs:PutLogEvents","Resource":"arn:aws:logs:us-east-1:123456789012:log-group:my-log-group:*"}

Answer

{"Effect":"Allow","Action":"logs:*","Resource":"*"}

Answer

{"Effect":"Allow","Action":["logs:DescribeLogGroups","logs:DescribeLogStreams"],"Resource":"*"}

Question 14

A security team needs to audit all changes to IAM resources in their AWS account. Which AWS service should they use?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity across the AWS account, including all IAM resource changes such as CreateUser, AttachPolicy, DeleteRole, and UpdateAssumeRolePolicy. It captures the identity of the caller, the time, the source IP, and the request parameters, making it the authoritative audit trail for IAM modifications. CloudTrail event history provides 90 days of management events by default, and trails can deliver logs to S3 for long-term retention.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 15

A security team needs to ensure that all IAM users in a production account use multi-factor authentication (MFA) before accessing the AWS Management Console. Which TWO steps should be taken? (Choose TWO.)

Accepted Answer

Enable MFA for each IAM user.. To enforce MFA for console access, you need to enable MFA for each user (B) and attach an IAM policy that denies console access if MFA is not present (C). Option E is incorrect because the IAM password policy cannot require MFA; it only requires MFA for password changes, not console login. Option A is incorrect because AWS Config rules can detect users without MFA but cannot enforce it. Option D is incorrect because SCPs apply to accounts, not individual user console access; they cannot directly require MFA for console login.

Answer

Use AWS Config rules to detect users without MFA.

Answer

Apply an SCP that requires MFA for console access.

Answer

Configure an IAM password policy to require MFA.