SCS-C02 Practice Test 13 — 15 Questions

Question 1

A company has deployed a multi-tier web application on AWS. The web servers are in a public subnet, and the application servers are in a private subnet. The security team wants to ensure that the application servers cannot initiate outbound connections to the internet. What should the team do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Remove the default route (0.0.0.0/0) pointing to an internet gateway or NAT gateway from the private subnet's route table.. Removing the default route (0.0.0.0/0) from the private subnet's route table ensures that any traffic destined for the internet has no valid path, effectively preventing application servers from initiating outbound internet connections. Network ACLs and security groups are stateful or stateless filters but do not control routing; without a route, packets cannot leave the subnet regardless of allow rules. This aligns with the principle of using route tables to enforce network segmentation in a multi-tier architecture.

Answer

Add a deny rule for all outbound traffic in the network ACL of the private subnet.

Answer

Modify the security group of the application servers to deny all outbound traffic.

Answer

Attach an egress-only internet gateway to the private subnet.

Question 2

A security engineer is investigating a potential data exfiltration from an S3 bucket. Which AWS service should be used to analyze the VPC Flow Logs for the S3 bucket's endpoint?

Accepted Answer

Amazon Detective. Amazon Detective is the correct service because it can ingest and analyze VPC Flow Logs, including those for a VPC endpoint used to access an S3 bucket. Detective uses machine learning, statistical analysis, and graph theory to identify the root cause of suspicious network traffic patterns, such as unusual data volumes or connections to external IPs, which are indicative of data exfiltration.

Answer

Amazon Macie

Answer

Amazon Inspector

Answer

Amazon GuardDuty

Question 3

A Security Engineer is designing a network architecture for a multi-tier application. The web tier must be accessible from the internet, while the application tier should only be accessible from the web tier, and the database tier only from the application tier. All tiers are in the same VPC. Which configuration meets these requirements with minimal administrative overhead?

Accepted Answer

Use security groups with inbound rules that reference the security group of the previous tier.. Security groups are stateful and can reference other security groups as a source in inbound rules, allowing traffic from any instance associated with the referenced security group regardless of IP address changes. This creates a logical dependency chain (web SG → app SG → db SG) that enforces the required tier-to-tier access with zero maintenance when instances scale or subnets change. Option D meets the requirement with minimal administrative overhead because security group references automatically adapt to dynamic environments.

Answer

Use network ACLs with inbound rules that reference the prefix list of the previous tier's subnets.

Answer

Use network ACLs with inbound rules that allow traffic from the previous tier's subnet CIDR.

Answer

Use security groups with inbound rules that allow traffic from the previous tier's public IP addresses.

Question 4

Refer to the exhibit. A security engineer runs the CLI command and receives the output shown. The engineer expects to see flow logs for a specific subnet, but the output shows the resource ID as a VPC. What is the most likely reason?

Accepted Answer

The flow log was created at the VPC level, not at the subnet level.. The output shows the resource ID as a VPC (vpc-xxxx), but the security engineer expected to see flow logs for a specific subnet. This indicates that the flow log was created at the VPC level, not at the subnet level. In AWS, VPC Flow Logs can be created at the VPC, subnet, or network interface level, and the resource ID in the flow log output reflects the level at which the log was configured. Since the engineer expected subnet-level logs, the most likely reason is that the flow log was created for the entire VPC instead of the specific subnet.

Answer

The flow log is not active; it shows ACTIVE, so that's not the issue.

Answer

The flow log is configured to deliver to CloudWatch, but the log group name is incorrect.

Answer

The IAM role does not have permissions to deliver logs for subnets.

Question 5

A company uses AWS Organizations with multiple accounts. The security team needs to centrally monitor all API calls made in the member accounts. The team wants to ensure that all CloudTrail logs are delivered to a centralized S3 bucket in the management account. Which configuration should the security team implement?

Accepted Answer

Create an organization trail in the management account with the S3 bucket in the management account.. AWS Organizations supports creating an organization trail in the management account that automatically applies to all member accounts. This ensures that all API calls from every account in the organization are logged and delivered to a centralized S3 bucket in the management account without needing to configure individual trails or manage cross-account permissions manually.

Answer

Configure CloudWatch cross-account subscription to send logs from member accounts to the management account.

Answer

Enable CloudTrail in each member account and configure each trail to deliver logs to the same S3 bucket.

Answer

Use Amazon S3 replication to copy logs from member account buckets to the management account bucket.

Question 6

A security engineer notices that an Amazon EC2 instance has a security group that allows inbound SSH (port 22) from 0.0.0.0/0. The instance is a bastion host. What is a more secure alternative to this configuration?

Accepted Answer

Remove the inbound SSH rule and use AWS Systems Manager Session Manager to access the instance.. AWS Systems Manager Session Manager provides secure, auditable, and keyless shell access to EC2 instances without opening any inbound ports. It uses the AWS Systems Manager agent to initiate an outbound connection to the AWS SSM endpoint over HTTPS (port 443), eliminating the need for a bastion host or any inbound SSH rule. This approach also integrates with AWS Identity and Access Management (IAM) for fine-grained access control and AWS CloudTrail for full session logging.

Answer

Change the SSH port to a non-standard port to avoid automated attacks.

Answer

Restrict the inbound SSH rule to a single IP address from the corporate network.

Answer

Replace the security group rule with a network ACL that allows SSH from 0.0.0.0/0.

Question 7

A healthcare company runs a HIPAA-compliant application on AWS. The application uses Amazon S3 to store Protected Health Information (PHI). The company has implemented the following controls: (1) All S3 buckets are configured with default encryption using SSE-S3. (2) Bucket policies restrict access to only authorized IAM roles. (3) S3 access logs are enabled and sent to a centralized logging account. (4) MFA Delete is enabled on all buckets. (5) Object lock is not enabled. Recently, an internal auditor discovered that when an authorized user deletes an object, the object is permanently deleted and cannot be recovered. The company's data retention policy requires that deleted PHI be recoverable for at least 30 days after deletion. A review of the IAM policies shows that users have s3:DeleteObject permission. The auditor also notes that the bucket versioning is not enabled. The security team needs to implement a solution that allows authorized users to delete objects but ensures that deleted objects can be recovered within 30 days. Which of the following is the MOST effective course of action?

Accepted Answer

Enable S3 Versioning on the buckets and ensure that the IAM policies include s3:DeleteObjectVersion where appropriate.. Enabling S3 Versioning is the most effective solution because it preserves all object versions, including deleted objects (which become delete markers). With versioning enabled, authorized users can still use s3:DeleteObject to delete the current version, but the previous versions remain recoverable. Since the requirement is to recover deleted PHI within 30 days, versioning combined with a lifecycle policy to permanently delete old versions after 30 days would meet the retention policy without blocking immediate deletion.

Answer

Enable S3 Object Lock in Governance mode with a retention period of 30 days.

Answer

Remove the s3:DeleteObject permission from all IAM policies and use S3 Lifecycle policies to expire objects after 30 days.

Answer

Change the default encryption from SSE-S3 to SSE-C and use a separate key for each object.

Question 8

A security engineer is troubleshooting connectivity issues between an Amazon EC2 instance in a VPC and an on-premises server over a Direct Connect virtual interface. The EC2 instance has a security group that allows outbound traffic to the on-premises CIDR block (10.0.0.0/16). The VPC has a route table entry pointing the on-premises CIDR to the virtual private gateway. The on-premises firewall shows that packets are received from the EC2 instance but responses are not reaching the instance. What is the most likely cause?

Accepted Answer

The on-premises router does not have a route pointing the VPC CIDR back to the Direct Connect interface.. The on-premises firewall logs show packets are received from the EC2 instance, but responses are not reaching it. This indicates a routing issue on the on-premises side: the on-premises router must have a route pointing the VPC CIDR back to the Direct Connect interface (virtual interface) for return traffic to be forwarded correctly. Without this return route, the on-premises server sends responses via its default route (likely the internet), which are dropped by the VPC security group or never reach the EC2 instance.

Answer

The network ACL for the subnet is blocking outbound traffic to the on-premises CIDR.

Answer

The virtual private gateway is not attached to the VPC.

Answer

The security group does not allow inbound traffic from the on-premises server.

Question 9

A company uses AWS CloudTrail to log all API activity. The security team wants to ensure that any changes to CloudTrail configuration (e.g., disabling the trail, deleting the trail, modifying the log delivery) are detected immediately. They have created a CloudWatch Events rule to capture the event 'StopLogging' and send an SNS notification. During testing, the team stops the trail and does not receive the notification. The CloudWatch Events rule is configured with the correct event pattern. What should the team check?

Accepted Answer

Check the IAM role associated with the CloudWatch Events rule to ensure it has permissions to publish to the SNS topic.. CloudWatch Events rules require an IAM role with permissions to invoke the target (e.g., publish to SNS). Even if the event pattern matches and the SNS topic exists, without a properly configured IAM role that grants `sns:Publish` to the CloudWatch Events service, the rule cannot deliver the notification. This is a common misconfiguration that causes silent failures.

Answer

Verify that the CloudTrail trail is logging management events.

Answer

Ensure that the event pattern includes the correct source and detail-type.

Answer

Confirm that the SNS topic subscription is confirmed.

Question 10

A company wants to monitor failed SSH login attempts to its EC2 instances. Which AWS service should be used to collect and analyze these logs?

Accepted Answer

Amazon CloudWatch Logs with the unified CloudWatch agent. Amazon CloudWatch Logs with the unified CloudWatch agent is the correct choice because the agent can be configured to collect and forward system log files, such as /var/log/secure (Amazon Linux) or /var/log/auth.log (Ubuntu), which record SSH authentication attempts including failures. This allows centralized monitoring and analysis of failed SSH logins via CloudWatch Logs Insights or metric filters.

Answer

VPC Flow Logs

Answer

AWS CloudTrail

Answer

AWS Config

Question 11

A financial services company runs a critical application on Amazon EC2 instances in a VPC. The application processes sensitive financial data and must meet strict compliance requirements. The security team recently discovered that an EC2 instance was compromised due to an unpatched vulnerability. The attacker used the instance's IAM role to access an S3 bucket containing customer data and exfiltrated the data. The security team needs to prevent such incidents in the future. They have implemented the following controls: 
- All EC2 instances are launched in private subnets. 
- The IAM roles used by EC2 instances follow the principle of least privilege. 
- Security groups restrict inbound and outbound traffic. 
- AWS Systems Manager Patch Manager is used to patch instances. 
- AWS CloudTrail is enabled and logs are sent to a centralized S3 bucket. 
- Amazon GuardDuty is enabled.

Despite these controls, the team is concerned about the blast radius if an instance is compromised again. Which additional measure would MOST effectively limit the blast radius of a compromised EC2 instance?

Accepted Answer

Use S3 VPC Endpoints with a bucket policy that only allows access from the VPC endpoint, and use Systems Manager Session Manager instead of SSH.. Using an S3 VPC endpoint with a bucket policy that restricts access exclusively to that endpoint ensures that compromised EC2 instances can only reach S3 through the VPC endpoint, preventing data exfiltration over the internet. Additionally, replacing SSH with Systems Manager Session Manager eliminates the need for open inbound SSH ports and provides fine-grained access control through IAM, reducing the attack surface and blast radius.

Answer

Enable VPC Flow Logs to monitor traffic to S3.

Answer

Deploy AWS WAF in front of the S3 bucket.

Answer

Create an AWS Config rule to detect S3 access from EC2 instances.

Question 12

A company uses AWS CloudTrail to log all API activity. They want to ensure that log files are tamper-proof and can be validated for forensic purposes. Which of the following should they enable?

Accepted Answer

CloudTrail log file integrity validation. CloudTrail log file integrity validation uses a SHA-256 hash chain to detect if log files have been modified, deleted, or altered after delivery. When enabled, CloudTrail delivers a digest file that includes the hash of each log file and the hash of the previous digest, creating an immutable chain that can be used to verify log integrity for forensic purposes.

Answer

AWS KMS server-side encryption on the S3 bucket

Answer

S3 bucket versioning

Answer

S3 Object Lock with governance mode

Question 13

A company wants to protect data at rest in Amazon S3 using client-side encryption. The application will run on Amazon EC2 instances. Which approach meets these requirements?

Accepted Answer

Use the AWS Encryption SDK to encrypt data before uploading to S3. Client-side encryption requires the encryption process to occur on the client side before data is uploaded to S3. The AWS Encryption SDK is designed for this purpose, allowing you to encrypt data locally on the EC2 instance using your own keys, ensuring that S3 never sees the plaintext data. This meets the requirement to protect data at rest with client-side encryption, as the data is encrypted before leaving the application environment.

Answer

Use SSE-S3 and rely on S3 to manage keys

Answer

Enable S3 default encryption on the bucket

Answer

Use SSE-KMS with a customer managed key

Question 14

A security engineer is designing a solution to detect and alert on any S3 bucket that is publicly accessible. Which THREE services can be used together to achieve this?

Accepted Answer

AWS Security Hub. (AWS Security Hub) is correct because it can aggregate findings from other services like AWS Config and Amazon GuardDuty, providing a centralized view and alerting for S3 bucket public access issues. Option C (AWS Config) is correct because it can evaluate S3 bucket policies against a managed rule (e.g., s3-bucket-public-read-prohibited) to detect public access and trigger alerts. Option D (AWS CloudTrail) is correct because it logs S3 API calls such as PutBucketPolicy, and you can create CloudWatch Events or metric filters to alert on changes that grant public access. Option B (Amazon S3 Block Public Access) is incorrect; it is a preventive control that blocks public access but does not detect or alert on existing public buckets. Option E (Amazon VPC Flow Logs) is incorrect because it captures network traffic data, not S3 bucket policy changes.

Answer

Amazon S3 Block Public Access settings

Answer

Amazon VPC Flow Logs

Question 15

A company uses AWS Key Management Service (KMS) to encrypt data at rest. The security team needs to ensure that only specific IAM roles can use a particular KMS key to encrypt and decrypt data. What is the most secure way to achieve this?

Accepted Answer

Create a KMS key policy that grants access only to the specific IAM roles using the kms:CallerArn condition.. Using a key policy with a condition for the kms:CallerArn attribute restricts usage to the specified roles. Option A is wrong because IAM policies alone cannot restrict KMS key usage if the key policy allows all principals. Option C is wrong because key policy with Principal "*" grants access to all, even with a condition. Option D is wrong because a condition for the IAM role's ARN is not a standard KMS condition key.

Answer

Create an IAM policy that allows kms:Encrypt and kms:Decrypt for the roles and attach it to the roles.

Answer

Create a KMS key policy that grants access to the account and use IAM policies to restrict the roles.

Answer

Create a KMS key policy with Principal "*" and a condition that the request originates from the roles.