SCS-C02 Practice Test 15 — 15 Questions

Question 1

A security engineer runs the get-account-authorization-details command and sees the exhibit output. The engineer wants to ensure that the 'admin' user does not have administrative access. Which steps should be taken?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Detach the AdministratorAccess policy from the 'admin' user and attach a custom policy with read-only permissions.. The 'admin' user has the AdministratorAccess policy attached, granting full administrative rights. To remove administrative access, the engineer should detach this policy and attach a custom policy with read-only permissions (Option C). Option A is unnecessary because deleting the user is not required; detaching the policy is sufficient. Option B is incorrect because modifying the AdministratorAccess policy to deny all actions would still leave the policy attached, potentially causing confusion or unintended effects; better to detach it. Option D is wrong because attaching a permissions boundary does not remove the existing AdministratorAccess policy; the user would still have administrative access via that policy.

Answer

Delete the 'admin' user and create a new user with limited permissions.

Answer

Modify the AdministratorAccess policy to deny all actions.

Answer

Attach a permissions boundary that denies all actions.

Question 2

A company wants to provide temporary security credentials to users accessing AWS resources from a mobile app. Which AWS service should they use?

Accepted Answer

Amazon Cognito Identity Pools (Federated Identities). Amazon Cognito Identity Pools (Federated Identities) allow you to create unique identities for your users and federate them with identity providers. With an identity pool, you can obtain temporary, limited-privilege AWS credentials to access other AWS services. This is the correct service for providing temporary security credentials to users accessing AWS resources from a mobile app. Option A (AWS Signer) is for code signing, not temporary credentials. Option B (AWS Directory Service) is for managing Microsoft Active Directory, not for generating temporary credentials. Option D (AWS IAM roles for cross-account access) is for granting access between AWS accounts, not for mobile app users.

Answer

AWS Signer

Answer

AWS Directory Service

Answer

AWS IAM roles for cross-account access

Question 3

A security engineer runs the IAM policy simulator with a custom policy. The output shows the above. Which statement is true about the policy?

Accepted Answer

The policy contains a statement that explicitly denies iam:DeleteUser.. The policy simulator shows an explicit deny for iam:DeleteUser, confirming that a deny statement exists in the policy. Option C is correct because the explicit deny means the policy explicitly denies iam:DeleteUser. Option A is incorrect because the simulator does not indicate that iam:CreateUser is denied. Option B is incorrect because the explicit deny overrides any default allow. Option D is incorrect because the simulator returned an explicit deny, not errors.

Answer

The policy allows iam:DeleteUser but denies iam:CreateUser.

Answer

The policy allows all actions by default.

Answer

The policy has no effect because the simulator returned errors.

Question 4

A company's security team wants to detect and block malicious SQL injection attempts against an Application Load Balancer. Which AWS service should be used?

Accepted Answer

AWS WAF. AWS WAF is a web application firewall that can be associated with an Application Load Balancer to inspect HTTP/HTTPS requests for malicious patterns, such as SQL injection attempts. It uses managed rule sets (e.g., AWS Managed Rules for SQL injection) to detect and block these attacks in real time, making it the correct choice for this use case.

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Answer

AWS Shield Advanced

Question 5

A security engineer is designing an automated incident response workflow for an Amazon EC2 instance that is compromised. The workflow must isolate the instance by removing it from the security group that allows SSH access. The engineer wants to use AWS Systems Manager Automation to run a document. What is the most secure way to grant the automation the necessary permissions to modify the security group?

Accepted Answer

Create a Systems Manager Automation service role with a least-privilege policy that includes ec2:ModifySecurityGroupRules and use that role in the automation.. Systems Manager Automation can assume a dedicated service role with a least-privilege IAM policy that includes the specific action `ec2:ModifySecurityGroupRules`. This follows the security best practice of granting only the permissions required for the automation to modify the security group, without exposing broader privileges or relying on user or instance credentials.

Answer

Create an AWS Lambda function with permissions to modify the security group and call it from the automation.

Answer

Use the IAM user's permissions that trigger the automation.

Answer

Attach an IAM policy to the EC2 instance's instance profile that allows ec2:ModifySecurityGroupRules.

Question 6

A security engineer is designing a multi-tier web application. The application uses an Application Load Balancer (ALB) to distribute traffic to EC2 instances in private subnets. The engineer needs to ensure that the EC2 instances only accept traffic from the ALB and not from any other source. Which security group configuration should the engineer use?

Accepted Answer

Allow inbound HTTP traffic from the ALB's security group on the EC2 instances' security group.. It uses a security group reference to allow inbound HTTP traffic from the ALB's security group. This ensures that only traffic originating from the ALB (which has that security group attached) can reach the EC2 instances, regardless of the ALB's IP addresses or changes in the VPC CIDR. This is the recommended AWS best practice for securing traffic between an ALB and backend instances.

Answer

Allow inbound HTTP traffic from the ALB's public IP address on the EC2 instances' security group.

Answer

Allow inbound HTTP traffic from the VPC CIDR range on the EC2 instances' security group.

Answer

Allow inbound HTTP traffic from 0.0.0.0/0 on the EC2 instances' security group.

Question 7

A security engineer needs to ensure that all API calls in an AWS account are logged for incident response. Which AWS service should be enabled?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made in an AWS account, including the identity of the caller, the time of the call, the source IP address, and the request parameters. This logging is essential for incident response to reconstruct events and identify unauthorized or malicious activity.

Answer

Amazon GuardDuty

Answer

VPC Flow Logs

Answer

AWS Config

Question 8

A company uses AWS CloudTrail to log all API calls. The security team wants to be alerted when an IAM user creates a new access key for another IAM user (an action that could indicate privilege escalation). What is the most effective way to detect this specific API call?

Accepted Answer

Create an Amazon CloudWatch Events rule that matches the 'iam:CreateAccessKey' API call and sends a notification to an SNS topic.. Amazon CloudWatch Events (now Amazon EventBridge) can be configured with a rule that matches the specific 'iam:CreateAccessKey' API call as it occurs. When this API call is made, CloudTrail delivers the event in near real-time to CloudWatch Events, which can then trigger an SNS topic to send an alert. This provides immediate, event-driven detection without the latency of scheduled queries or the overhead of custom rules.

Answer

Query AWS CloudTrail logs using Amazon Athena on a schedule.

Answer

Use AWS Config to create a custom rule that checks for changes to IAM users.

Answer

Enable Amazon GuardDuty and look for the 'UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration' finding.

Question 9

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that no IAM user in any account can create or modify IAM roles. What is the MOST effective way to enforce this?

Accepted Answer

Create an SCP that denies iam:CreateRole and iam:UpdateAssumeRolePolicy and attach it to the root organizational unit.. The most effective way to enforce a deny across all accounts in AWS Organizations is a Service Control Policy (SCP) attached to the root organizational unit, denying iam:CreateRole and iam:UpdateAssumeRolePolicy. SCPs set the maximum permissions boundary for all principals in member accounts, so attaching a deny SCP at the root OU ensures no IAM user in any account can create or modify roles, regardless of their IAM policies. This is centralized, preventive, and cannot be bypassed by account-level admins.

Answer

Use AWS Config rules to detect role creation and automatically delete the roles.

Answer

Set up a Lambda function that monitors CloudTrail and revokes role creation permissions.

Answer

Create an IAM policy that denies role creation and attach it to each user in every account.

Question 10

A company is using AWS CloudTrail to monitor API activity. The security team wants to be alerted when an IAM user creates a new access key. Which CloudTrail event should be used to create a CloudWatch Events rule?

Accepted Answer

CreateAccessKey. The correct event is CreateAccessKey because this is the specific CloudTrail event that is logged when an IAM user creates a new access key. CloudTrail captures this API call as a management event, and a CloudWatch Events rule can be configured to match this event name to trigger an alert. The security team's requirement is to detect the creation of access keys, which is directly represented by the CreateAccessKey event.

Answer

EnableMFADevice

Answer

UpdateAccessKey

Answer

UploadSigningCertificate

Question 11

A security team needs to centralize audit logs from multiple AWS accounts into a single S3 bucket. The solution must be scalable and support future account additions. Which approach meets these requirements?

Accepted Answer

Use AWS Organizations to create a CloudTrail trail that applies to all accounts in the organization.. AWS Organizations allows you to create an organization-wide CloudTrail trail that automatically applies to all existing and future accounts in the organization. This is the most scalable approach because new accounts added to the organization are automatically covered without manual configuration per account. The trail delivers logs to a central S3 bucket, meeting the requirement to centralize audit logs.

Answer

Use Amazon CloudWatch Logs to stream logs from each account to a central account.

Answer

Use AWS Trusted Advisor to collect logs from all accounts.

Answer

Configure CloudTrail in each account to deliver logs to the same S3 bucket.

Question 12

A company uses AWS Secrets Manager to store database credentials. The security team needs to ensure that secrets are automatically rotated every 30 days. Which configuration should be used?

Accepted Answer

Enable automatic rotation using an AWS Lambda function.. AWS Secrets Manager provides a built-in mechanism to automatically rotate secrets using an AWS Lambda function. By configuring a rotation schedule (e.g., every 30 days), Secrets Manager invokes the Lambda function to create a new version of the secret and update the database credentials, ensuring compliance without manual intervention.

Answer

Manually update the secret in Secrets Manager every 30 days.

Answer

Use Amazon Macie to detect when secrets are stale.

Answer

Set an expiration date on the secret and recreate it.

Question 13

A security engineer is investigating a potential security incident involving an Amazon RDS database. The engineer needs to determine if someone attempted to access the database with incorrect credentials. Which AWS service should the engineer use to view authentication failures?

Accepted Answer

Amazon RDS database logs (error logs). Amazon RDS database error logs capture authentication failures, including attempts with incorrect credentials, because the database engine itself logs these events. For example, MySQL's error log records 'Access denied for user' messages, and PostgreSQL's log records 'FATAL: password authentication failed' entries. This makes RDS database logs the direct source for viewing authentication failures at the database level.

Answer

Amazon CloudWatch Logs

Answer

VPC Flow Logs

Answer

AWS CloudTrail

Question 14

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all CloudTrail trails are enabled in all accounts and log to a central S3 bucket. What is the MOST efficient way to enforce this?

Accepted Answer

Use AWS CloudFormation StackSets to deploy a CloudTrail template to all accounts.. AWS CloudFormation StackSets allows you to deploy a CloudTrail template across multiple accounts and Regions from a single management account, ensuring all accounts have a trail configured to log to the central S3 bucket. This approach is the most efficient as it automates deployment, enforces consistent configuration, and scales across the entire organization without requiring per-account manual intervention or custom scripting.

Answer

Use AWS Lambda to check each account and enable CloudTrail if missing.

Answer

Use AWS Config aggregator to verify compliance and send alerts.

Answer

Create a service control policy (SCP) that requires CloudTrail.

Question 15

A company uses AWS WAF to protect a web application. The security team wants to block requests that contain SQL injection patterns. Which WAF rule type should be used?

Accepted Answer

SQL injection match rule. AWS WAF provides a dedicated SQL injection match rule that inspects incoming requests for SQL injection patterns in the URI, query string, or body. This rule uses a set of predefined SQL-like patterns (e.g., 'OR 1=1', 'UNION SELECT') to detect and block malicious input, directly addressing the security team's requirement.

Answer

IP set rule

Answer

Geographic match rule

Answer

Rate-based rule