SCS-C02 Practice Test 16 — 15 Questions

Question 1

A security engineer is investigating a security incident where an EC2 instance was used to launch an outbound denial-of-service (DoS) attack. The engineer needs to collect forensic evidence. Which THREE actions should the engineer take? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an Amazon EBS snapshot of the instance's root volume.. Creating an Amazon EBS snapshot preserves persistent data for offline analysis. Option D is correct because capturing memory preserves volatile evidence. Option E is correct because after collecting forensic evidence, terminating the instance stops the attack immediately and prevents further damage. Options A and B are incorrect because they destroy evidence (reboot clears memory, deletion removes logs).

Answer

Reboot the instance to clear any malicious processes.

Answer

Delete the CloudTrail logs that show the instance's API calls.

Question 2

A security administrator is designing a cross-account access strategy. The administrator needs to allow users in Account A to assume an IAM role in Account B to access an S3 bucket. Which TWO of the following statements are true regarding this configuration?

Accepted Answer

The IAM users in Account A must have an IAM policy that allows the sts:AssumeRole action for the role ARN in Account B.. For an IAM user in Account A to assume a role in Account B, the user must be explicitly granted permission to call the sts:AssumeRole API action against the role's Amazon Resource Name (ARN). This is done by attaching an IAM policy to the user (or a group/role the user belongs to) that includes the sts:AssumeRole action and specifies the target role ARN as the resource. Without this permission, the user cannot initiate the cross-account role assumption, even if the role's trust policy allows it.

Answer

The trust policy for the role must be defined in Account A.

Answer

The S3 bucket policy must grant access to the IAM users in Account A.

Answer

The IAM users in Account A must have cross-account permissions on the S3 bucket in Account B.

Question 3

A security engineer is investigating a potential data breach. The engineer needs to identify which IAM user accessed a specific S3 object and when. Which AWS service should the engineer use?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API activity for all AWS services, including S3 object-level operations such as GetObject, PutObject, and DeleteObject. By enabling data events on the specific S3 bucket, CloudTrail logs the IAM user, source IP, timestamp, and the exact object key accessed, providing the precise identity and time needed for breach investigation.

Answer

AWS Config

Answer

Amazon S3 server access logs

Answer

Amazon CloudWatch Logs

Question 4

A security engineer wants to receive real-time notifications when an AWS API call is made to delete an S3 bucket. Which service should be used to capture and forward these events to an Amazon SNS topic?

Accepted Answer

AWS CloudTrail with CloudWatch Events. AWS CloudTrail captures all API calls made to S3, including DeleteBucket. By sending these CloudTrail events to Amazon CloudWatch Events (now part of Amazon EventBridge), you can create a rule that matches the specific API call and forwards it to an SNS topic for real-time notification. This combination provides the exact event-driven pipeline needed for immediate alerting on S3 bucket deletions.

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Answer

AWS Config

Question 5

A security team needs to audit all changes to IAM policies in their AWS account. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made in the AWS account, including IAM policy changes such as CreatePolicy, PutRolePolicy, and AttachUserPolicy. These events are captured as CloudTrail log entries, which can be audited to track who made the change, when it was made, and from which source IP. CloudTrail is the primary service for auditing and logging all management events across AWS services.

Answer

AWS Config

Answer

Amazon CloudWatch

Answer

IAM Access Analyzer

Question 6

A company wants to automatically isolate an EC2 instance that is suspected to be compromised. What is the MOST effective AWS-native approach?

Accepted Answer

Use Amazon GuardDuty to detect the compromise and automatically modify the instance's security group to deny all traffic. Amazon GuardDuty can detect suspicious activity on an EC2 instance (e.g., cryptocurrency mining, unusual outbound traffic) and, when integrated with Amazon EventBridge and AWS Lambda, automatically modify the instance's security group to deny all traffic. This approach isolates the instance without terminating it, preserving forensic evidence and allowing further investigation. It is the most effective AWS-native approach because it combines threat detection with automated, least-privilege response actions.

Answer

Terminate the instance immediately

Answer

Use AWS Config to change the instance's IAM role

Answer

Use AWS Systems Manager to run a script that stops the instance

Question 7

A company wants to centrally manage access keys for all IAM users across multiple accounts. Which AWS service should be used to rotate access keys automatically?

Accepted Answer

AWS IAM. AWS IAM is the service that manages IAM users and access keys. While there is no built-in automatic rotation feature in IAM, you can automate access key rotation using IAM APIs or the AWS CLI. Among the given options, AWS IAM is the correct choice because it directly handles access keys. AWS STS provides temporary credentials, not access key management. AWS Secrets Manager can store secrets but cannot automatically rotate IAM access keys. AWS CloudHSM is for hardware-based cryptographic key storage.

Answer

AWS STS

Answer

AWS Secrets Manager

Answer

AWS CloudHSM

Question 8

A company is using AWS Key Management Service (KMS) to encrypt data at rest in Amazon S3. The security team wants to ensure that only a specific IAM role can decrypt the data. Which KMS policy element should be used?

Accepted Answer

Principal. (Principal) is correct because in a KMS key policy, the Principal element specifies which IAM users, roles, or AWS services are allowed to perform actions on the key. By setting the Principal to the specific IAM role's ARN, only that role can decrypt the data, enforcing the security team's requirement.

Answer

Resource

Answer

Action

Answer

Effect

Question 9

A company is using an Application Load Balancer (ALB) to distribute traffic to a set of EC2 instances in private subnets. The security team wants to ensure that only traffic from the ALB can reach the EC2 instances. Which security group configuration should be applied to the EC2 instances?

Accepted Answer

Allow inbound HTTP/HTTPS from the security group attached to the ALB.. Referencing the security group of the Application Load Balancer as the source in the inbound rule ensures that only traffic coming from the ALB can reach the EC2 instances. Option B is incorrect because network ACLs are stateless and cannot reference security groups; they also operate at the subnet level, not at the instance level. Option C is incorrect because allowing traffic from 0.0.0.0/0 would expose the instances to the internet. Option D is incorrect because allowing traffic from the VPC CIDR would permit any instance in the VPC to access the EC2 instances, not just the ALB.

Answer

Configure the network ACL to allow traffic from the ALB's private IP addresses.

Answer

Allow inbound HTTP/HTTPS from 0.0.0.0/0.

Answer

Allow inbound HTTP/HTTPS from the VPC CIDR block.

Question 10

A security engineer is designing a network architecture for a web application that must be highly available and secure. The application uses an Application Load Balancer (ALB) in front of EC2 instances. Which architecture meets these requirements?

Accepted Answer

Place the ALB in public subnets and EC2 instances in private subnets across two Availability Zones.. The correct architecture places the ALB in public subnets so it can receive internet traffic, while EC2 instances reside in private subnets for enhanced security. The ALB acts as a reverse proxy, terminating client connections and forwarding requests to the instances over private IPs, which prevents direct internet access to the instances. Deploying across two Availability Zones ensures high availability by surviving an AZ failure.

Answer

Place both the ALB and EC2 instances in private subnets across two Availability Zones.

Answer

Place the ALB in private subnets and EC2 instances in public subnets across two Availability Zones.

Answer

Place both the ALB and EC2 instances in public subnets across two Availability Zones.

Question 11

A company has an S3 bucket with a bucket policy that grants access to an IAM role used by an application running on EC2. The application is unable to read objects from the bucket, even though the IAM role has the necessary permissions. What is the most likely cause?

Accepted Answer

The bucket policy denies access to the IAM role.. The most likely cause is that the bucket policy explicitly denies access to the IAM role. Even though the IAM role has the necessary permissions via its attached policies, an explicit deny in the bucket policy overrides any allow, resulting in denied access. Option A is incorrect because cross-account access can be granted with proper permissions. Option C is incorrect because while a missing explicit allow would also deny access by default, the question says the IAM role has the necessary permissions, implying the issue is an explicit deny. Option D is incorrect because if the IAM role had an explicit deny, it would also deny access, but the role is stated to have the necessary permissions.

Answer

The bucket is in a different AWS account.

Answer

The bucket policy does not explicitly allow the IAM role.

Answer

The IAM role has an explicit deny statement.

Question 12

A company needs to monitor for unauthorized changes to security group rules. Which TWO AWS services can be used together to achieve this?

Accepted Answer

AWS Config. Options B and E are correct. AWS Config can track changes to security group rules, and Amazon CloudWatch Events can trigger a notification when a Config rule detects a change. Option A (GuardDuty) is for threat detection. Option C (Inspector) is for vulnerability scanning. Option D (CloudTrail) logs API calls but is not the best for direct rule-level monitoring.

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Answer

AWS CloudTrail

Question 13

Your company has a single AWS account with a production VPC that contains several EC2 instances running a web application. The security team has enabled Amazon GuardDuty and AWS CloudTrail. Recently, GuardDuty reported a finding 'UnauthorizedAccess:EC2/TorClient' for one of the instances. The finding indicates that the instance is making connections to Tor exit nodes. You need to investigate and contain the incident. The instance is critical to the application and cannot be terminated. You have a forensic analysis instance in a separate security group. What should you do FIRST?

Accepted Answer

Isolate the instance by modifying its security group to remove all inbound and outbound rules except for the forensic analysis instance.. The first step in incident response for a compromised instance that cannot be terminated is to contain the threat by isolating it from the network. Modifying the security group to remove all inbound and outbound rules except for a specific forensic analysis instance prevents the compromised EC2 instance from communicating with Tor exit nodes or other external hosts, while still allowing controlled forensic access. This containment is immediate and reversible, aligning with the AWS incident response best practice of 'isolate first, investigate later'.

Answer

Terminate the instance immediately and launch a replacement.

Answer

Take an EBS snapshot of the instance's root volume for analysis.

Answer

Use AWS Systems Manager Run Command to install a forensic agent on the instance.

Question 14

A security engineer needs to capture all DNS queries made by EC2 instances in a VPC and send them to a security analytics tool. Which AWS service should be used to capture this traffic?

Accepted Answer

AWS Network Firewall. AWS Network Firewall can be configured with stateful rule groups that inspect and log DNS traffic. By enabling DNS logging on the firewall, it captures all DNS queries and responses passing through the VPC, which can then be sent to a security analytics tool via Amazon S3, CloudWatch Logs, or Kinesis Data Firehose. This makes it the correct service for capturing DNS queries from EC2 instances.

Answer

VPC Flow Logs

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Question 15

A company needs to securely store database credentials for a legacy application running on Amazon EC2. The credentials are currently hardcoded in the application code. Which service should be used to rotate and retrieve secrets automatically?

Accepted Answer

AWS Secrets Manager.. AWS Secrets Manager is purpose-built for storing, rotating, and retrieving secrets such as database credentials. It natively supports automatic rotation via Lambda functions and provides fine-grained access control using IAM and KMS. The legacy application can retrieve credentials programmatically using the Secrets Manager API or SDK, eliminating hardcoded credentials.

Answer

AWS Systems Manager Parameter Store with a SecureString parameter.

Answer

AWS Key Management Service (KMS).

Answer

AWS CloudHSM.