SCS-C02 Practice Test 14 — 15 Questions

Question 1

A company uses AWS Organizations with SCPs to restrict services. An administrator creates an SCP that denies access to EC2. A developer in a member account tries to launch an EC2 instance but fails. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The SCP from the organization denies EC2. Service Control Policies (SCPs) in AWS Organizations act as a centralized governance mechanism that applies a deny effect across all IAM principals in member accounts. When an SCP explicitly denies access to EC2, it overrides any allow permissions at the account level, including those granted by IAM policies. The developer's launch attempt fails because the SCP's deny is evaluated before any account-level permissions, effectively blocking the action regardless of the developer's IAM role or user permissions.

Answer

The root user of the account has denied EC2

Answer

The developer's IAM permissions boundary blocks EC2

Answer

The EC2 instance has a resource-based policy denying access

Question 2

Which TWO actions can be used to restrict access to an S3 bucket to only users who authenticate using multi-factor authentication (MFA)? (Choose TWO.)

Accepted Answer

Use pre-signed URLs with MFA credentials. The correct answers are B and E. Option B: Pre-signed URLs generated with MFA credentials require the user to authenticate with MFA before accessing the S3 object. Option E: A bucket policy with a condition `aws:MultiFactorAuthPresent: true` enforces MFA for all operations on the bucket. Option A is wrong because AWS CloudTrail only logs API calls, it does not enforce access control. Option C is wrong because S3 bucket ACLs do not support conditions to check MFA. Option D is wrong because IAM policies with MFA conditions apply at the user/group level, not directly to the S3 bucket; the bucket policy is needed to restrict bucket access.

Answer

Use AWS CloudTrail to log requests and deny those without MFA

Answer

Set an S3 bucket ACL that requires MFA

Answer

Add a condition in the IAM policy that checks aws:MultiFactorAuthPresent is true

Question 3

A security engineer is designing a network architecture in AWS. The engineer needs to ensure that all outbound traffic from a VPC goes through a centrally managed NAT device for logging and filtering. The VPC has multiple private subnets. Which TWO steps are required to accomplish this? (Choose TWO.)

Accepted Answer

Create a route table for the private subnets with a default route (0.0.0.0/0) pointing to the NAT device.. To route all outbound traffic from private subnets through a centrally managed NAT device, you need to configure the route tables for those subnets to send default traffic (0.0.0.0/0) to the NAT device (Option B). Additionally, the NAT device must be placed in a public subnet with a route to an internet gateway so it can translate the private IPs and forward traffic to the internet (Option E). Option A is wrong because an HTTP forward proxy is not necessary for this purpose. Option C is wrong because a transit gateway does not replace the need for a NAT device and route table configuration. Option D is wrong because a gateway endpoint is for private access to services like S3 or DynamoDB, not for general internet traffic.

Answer

Deploy an HTTP forward proxy in the public subnet.

Answer

Set up a transit gateway and attach the VPC to it.

Answer

Create a gateway endpoint for Amazon S3.

Question 4

A company is deploying a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The security engineer needs to protect the application from common web exploits such as SQL injection and cross-site scripting. Which TWO services can be used together to achieve this? (Choose TWO.)

Accepted Answer

AWS Shield Advanced. AWS WAF (Option D) can be associated with an ALB to filter web requests and protect against common exploits like SQL injection and cross-site scripting. AWS Shield Advanced (Option B) provides enhanced DDoS protection and integrates with WAF for additional layer 7 protections. Option A is wrong because GuardDuty is a threat detection service, not an inline web application firewall. Option C is wrong because Network ACLs operate at the subnet level and do not provide application-layer filtering. Option E is wrong because CloudFront is a CDN, and while it can be used with WAF, it alone does not provide WAF rules.

Answer

Amazon GuardDuty

Answer

Network ACLs

Answer

Amazon CloudFront

Question 5

A company needs to protect sensitive data in Amazon S3 from accidental deletion or overwriting. The data must be retained for at least 7 years after creation. Which combination of S3 features should be used?

Accepted Answer

Enable S3 Object Lock in Governance mode and configure a lifecycle policy to expire objects after 7 years. S3 Object Lock in Governance mode prevents objects from being deleted or overwritten during the retention period, and a lifecycle policy can automatically expire objects after 7 years to meet the retention requirement. Option A is incorrect because Object Lock in Compliance mode also prevents deletion and overwriting, but without specifying a retention period, it does not enforce the 7-year retention; additionally, Compliance mode cannot be overridden, which may be too restrictive. Option B is incorrect because S3 Intelligent-Tiering and lifecycle policies manage storage costs and transitions, not protection against deletion or overwriting. Option C is incorrect because versioning and MFA Delete protect against accidental deletion and preserve overwritten versions, but do not guarantee a 7-year retention period; lifecycle policies would be needed to enforce it.

Answer

Enable S3 Versioning and enable S3 Object Lock in Compliance mode

Answer

Use S3 Intelligent-Tiering and lifecycle policies

Answer

Enable S3 Versioning and MFA Delete

Question 6

Refer to the exhibit. A security engineer applies the above bucket policy to an S3 bucket. What is the effect of this policy?

Accepted Answer

All objects must be encrypted with SSE-S3. The policy denies PutObject requests that do not include the x-amz-server-side-encryption header with value AES256, thus enforcing SSE-S3 encryption on all uploads. Therefore, all objects must be encrypted with SSE-S3. Option A is incorrect because the condition is valid. Option B is incorrect because the policy denies unencrypted uploads, preventing objects without encryption headers. Option C is incorrect because the condition specifies AES256 (SSE-S3), not SSE-KMS.

Answer

The policy has no effect because the condition is invalid

Answer

Objects without encryption headers are allowed

Answer

All objects must be encrypted with SSE-KMS

Question 7

A company's security team is implementing a solution to automatically revoke public access to Amazon S3 buckets that become public. The solution must be serverless and use native AWS services. Which combination of services should be used?

Accepted Answer

Amazon EventBridge (CloudWatch Events) to detect PutBucketPolicy events and invoke an AWS Lambda function to remove the policy. Amazon EventBridge (option B) can detect S3 bucket policy changes via CloudTrail (e.g., PutBucketPolicy events) and invoke an AWS Lambda function to remove the public policy, providing automatic remediation. Option A is incorrect because S3 event notifications on ObjectCreated only respond to object-level events, not bucket policy changes. Option C is incorrect because CloudWatch Logs with a metric filter and alarm can only send notifications, not directly remediate the bucket policy. Option D is incorrect because while AWS Config can detect non-compliant buckets with the managed rule 's3-bucket-public-read-prohibited', automatic remediation typically requires a custom Lambda function or Systems Manager Automation, and the option specifies Systems Manager, which is not as serverless-native as using Lambda directly; moreover, the combination described does not automatically revoke access without additional components.

Answer

Amazon S3 event notifications on ObjectCreated events to invoke a Lambda function

Answer

Amazon CloudWatch Logs with a metric filter and alarm to trigger an SNS notification

Answer

AWS Config with managed rule 's3-bucket-public-read-prohibited' and auto-remediation via Systems Manager

Question 8

A company uses AWS KMS to encrypt data in Amazon S3. The security team notices that a KMS key has been deleted accidentally, causing data loss. The company wants to implement a solution to prevent accidental key deletion and enable recovery. What should the security team do?

Accepted Answer

Create a multi-Region key and enable automatic key rotation.. Creating a multi-Region key replicates the key material to another AWS Region, providing a backup that can be used if the primary key is accidentally deleted. Enabling automatic key rotation further enhances security by regularly rotating the backing keys, but it does not prevent deletion. However, the multi-Region key approach allows recovery from accidental deletion by using the replica in another Region. Option A is incorrect because disabling the key only prevents its use, not its deletion; the deletion waiting period allows recovery only if the deletion is canceled within the waiting period. Option B is incorrect because automatic key rotation does not prevent deletion; it only creates new cryptographic material. Option D is incorrect because AWS CloudHSM does not directly integrate with S3 server-side encryption using KMS (SSE-KMS) for automatic encryption; it requires custom applications.

Answer

Enable the key's 'Disable key' option and set a deletion waiting period of 7 days.

Answer

Enable automatic key rotation for the KMS key.

Answer

Use AWS CloudHSM to store the key material and create a backup in another Region.

Question 9

A company has an S3 bucket that contains sensitive data. The bucket policy allows access only from a specific VPC endpoint. A security engineer notices that objects in the bucket are being deleted by an IAM user from outside the VPC. The engineer checks the bucket policy and confirms that the policy denies access if the request does not come from the VPC endpoint. However, the deletions continue. What is the most likely cause?

Accepted Answer

The IAM user is the bucket owner and the bucket policy does not apply to the owner.. The bucket owner (the root user of the AWS account that owns the bucket) is not subject to bucket policies. Since the IAM user is the bucket owner (same account), the bucket policy's deny condition does not restrict their actions. Therefore, the IAM user can delete objects from outside the VPC. Option A is incorrect because the bucket policy does deny s3:DeleteObject for non-VPC requests; the issue is that the policy does not apply to the owner. Option B is incorrect because the VPC endpoint policy only applies to requests coming through the endpoint, and the user is not using the endpoint. Option D is incorrect because ACLs are not relevant here; even if an ACL allowed the deletion, the bucket policy would typically override it, but again, the policy does not apply to the owner.

Answer

The bucket policy is missing a Deny statement for the s3:DeleteObject action.

Answer

The VPC endpoint policy allows the deletion.

Answer

The bucket has an ACL that allows the IAM user to delete objects.

Question 10

A security engineer is designing a multi-account strategy using AWS Organizations. The engineer needs to centrally manage network security across all accounts. Which TWO AWS services are most appropriate for this task?

Accepted Answer

AWS Firewall Manager. AWS Firewall Manager (Option A) provides centralized management of firewall rules and policies across accounts in AWS Organizations, enabling consistent enforcement of network security. AWS Network Firewall (Option B) offers managed network firewall services that can be centrally deployed and managed via Firewall Manager. Option C (VPC Peering) is a network connectivity feature, not a security management service. Option D (AWS WAF) protects web applications at the application layer, not network-level security. Option E (Amazon GuardDuty) is a threat detection service, not a network security management tool.

Answer

VPC Peering

Answer

AWS WAF

Answer

Amazon GuardDuty

Question 11

A company uses AWS Organizations and wants to enforce that all S3 buckets created in any account within the organization have default encryption enabled. Which policy should be used?

Accepted Answer

Use a service control policy (SCP) to deny creation of buckets without default encryption. (SCP) is correct because a service control policy can be applied to all accounts in an AWS Organization to deny the creation of S3 buckets without default encryption, providing a preventive control. Option A is incorrect because bucket policies are applied per bucket and are not preventive during creation. Option C is incorrect because IAM policies are account-specific and do not cover all accounts in the organization. Option D is incorrect because AWS Config rules are detective, not preventive; they can trigger remediation but do not prevent creation.

Answer

Use a bucket policy on each bucket to enforce encryption

Answer

Use an IAM policy to require encryption on all bucket creation actions

Answer

Use AWS Config rules to automatically enable encryption on new buckets

Question 12

A company uses AWS Organizations with a management account and several member accounts. The security team wants to restrict the use of specific AWS services (e.g., EC2, Lambda) in certain accounts based on the account's environment (dev, test, prod). Which approach should be used to implement this requirement?

Accepted Answer

Use AWS Organizations to tag accounts (e.g., Environment=Dev) and use SCPs with conditions to deny access to services based on tags.. By tagging accounts in AWS Organizations (e.g., Environment=Dev) and using Service Control Policies (SCPs) with conditions based on those tags, the security team can restrict usage of specific AWS services per account environment. SCPs are applied at the organization level and affect all users and roles in the account, providing preventive controls. Option A is incorrect because CloudTrail only logs API calls and does not prevent usage; revoking access after the fact is not a preventive measure. Option B is incorrect because IAM roles are identity-based and do not restrict services at the account level; also, managing roles per account would be cumbersome. Option D is incorrect because AWS Config rules detect non-compliant resource configurations but do not prevent the use of services; they are detective controls.

Answer

Use AWS CloudTrail to monitor API calls and revoke access after the fact.

Answer

Create IAM roles in each account with policies that deny access to services.

Answer

Use AWS Config rules to detect and alert when restricted services are used.

Question 13

A company wants to allow an IAM user to manage only their own password in the AWS Management Console. Which IAM policy action should be used?

Accepted Answer

iam:ChangePassword. The correct IAM policy action to allow a user to manage only their own password is iam:ChangePassword. This action enables the user to change their password in the AWS Management Console. Option A is correct. Option B (iam:ListUsers) is used to list IAM users, not relevant to password management. Option C (iam:CreateAccessKey) creates access keys, which is unrelated. Option D (iam:DeactivateMFADevice) deactivates MFA devices, also not relevant. Therefore, only iam:ChangePassword is appropriate.

Answer

iam:ListUsers

Answer

iam:CreateAccessKey

Answer

iam:DeactivateMFADevice

Question 14

A company uses AWS Key Management Service (KMS) to encrypt data. The security team needs to ensure that KMS keys cannot be deleted accidentally. Which action should be taken?

Accepted Answer

Create an IAM policy that denies kms:ScheduleKeyDeletion for the key.. To prevent accidental deletion of KMS keys, you must deny the kms:ScheduleKeyDeletion permission. An IAM policy attached to the key (key policy) or to the user/role can explicitly deny this action. Option B is correct because it directly denies the permission needed to schedule deletion. Option A (SCP denying kms:ScheduleKeyDeletion) can be used at the organizational level but is not the most direct per-key control. Option C (automatic key rotation) does not prevent deletion. Option D is invalid because KMS does not have a deletion protection toggle; protection is achieved through IAM/key policies.

Answer

Apply an SCP that denies kms:ScheduleKeyDeletion for all accounts.

Answer

Enable automatic key rotation.

Answer

Enable deletion protection on the key.

Question 15

A company wants to enforce that all IAM users in its AWS account use multi-factor authentication (MFA) for console login. Which action should be taken to ensure compliance?

Accepted Answer

Create an IAM policy that denies access unless MFA is present and attach it to all IAM users.. The correct action is to create an IAM policy that denies access unless MFA is present and attach it to all IAM users. This policy uses a condition key like 'aws:MultiFactorAuthPresent' to block API calls when MFA is not used, effectively enforcing MFA for console login. Option A is incorrect because service control policies (SCPs) apply at the AWS Organizations level, not to individual IAM users, and cannot enforce MFA on console login. Option C is wrong because sharing root user credentials violates security best practices and does not enforce MFA for each user. Option D is incorrect because AWS account password policies do not include an MFA requirement; they only manage password complexity and rotation.

Answer

Apply an SCP to the AWS account that mandates MFA for all users.

Answer

Enable MFA on the root user and share credentials with all users.

Answer

Configure the account password policy to require MFA.