SCS-C02 Practice Test 16 — 15 Questions

Question 1

A security engineer applies the above S3 bucket policy. An application tries to upload an object with the header "x-amz-server-side-encryption: AES256". What will happen?

Accepted Answer

The upload fails because the encryption header does not match 'aws:kms'.. The first condition in the S3 bucket policy denies PutObject if the encryption header is not "aws:kms" (using StringNotEquals). Since the application sends "x-amz-server-side-encryption: AES256", which is not "aws:kms", the deny condition is triggered. The second condition denies if the header is missing, but here it is present, so it does not apply. Therefore, the upload is denied.

Answer

The upload succeeds because the policy allows SSE-S3.

Answer

The upload succeeds because the object is encrypted.

Answer

The upload fails because the header is missing.

Question 2

A company is using Amazon S3 to store confidential documents. They want to ensure that all data is encrypted in transit between the S3 bucket and their on-premises application. Which of the following should be enforced?

Accepted Answer

Add a bucket policy that denies access unless 'aws:SecureTransport' is true.. The 'aws:SecureTransport' condition in a bucket policy enforces HTTPS for all requests, ensuring encryption in transit. Option B is incorrect because CloudFront does not enforce HTTPS between CloudFront and the S3 origin by default; it can be configured but is not enforced solely by this option. Option C is incorrect because a VPC endpoint for S3 uses HTTPS by default, but does not enforce it; bucket policies are still needed. Option D is incorrect because SSE-S3 encrypts data at rest, not in transit.

Answer

Use Amazon CloudFront with a custom origin pointing to the S3 bucket.

Answer

Use a VPC endpoint for S3.

Answer

Enable default encryption (SSE-S3) on the bucket.

Question 3

A security engineer is designing IAM policies for a data analytics platform that uses Amazon S3, Amazon Athena, and AWS Glue. The platform must allow data scientists to query data in S3 using Athena, but only from specific VPC subnets. Additionally, the data must be encrypted at rest using AWS KMS. Which TWO actions should the engineer take to meet these requirements? (Choose TWO.)

Accepted Answer

Grant kms:Decrypt permission in the IAM policy and configure the KMS key policy to allow the IAM role to use the key.. A: Correct – Granting kms:Decrypt permission in the IAM policy and ensuring the KMS key policy allows the IAM role enables Athena to decrypt S3 objects encrypted with a customer-managed KMS key. C: Correct – Creating a VPC endpoint for Athena (or S3) and attaching a bucket policy that restricts access to that endpoint ensures queries are only allowed from the specified VPC subnets. B: Incorrect – The s3:SourceIp condition key does not work for requests made via VPC endpoints; use aws:SourceVpce instead. D: Incorrect – The kms:EncryptionContext condition is not used for restricting encryption at rest; it is used for encryption context in KMS operations. E: Incorrect – SSE-S3 does not use KMS, so the KMS key policy would not be relevant.

Answer

Add kms:EncryptionContext condition to the IAM policy to require a specific encryption context.

Answer

Use the s3:SourceIp condition key in the IAM policy to restrict access to the private IP ranges of the VPC subnets.

Answer

Enable default encryption on the S3 bucket using SSE-S3 and configure the KMS key policy to allow the IAM role.

Question 4

A security engineer is designing a data encryption strategy for an S3 bucket that contains sensitive information. Which TWO of the following are valid options for enforcing encryption at rest?

Accepted Answer

Enable S3 default encryption on the bucket.. The correct options are B and E. Option B: Enabling S3 default encryption on the bucket automatically encrypts objects at rest using the specified encryption method (SSE-S3 or SSE-KMS). Option E: A bucket policy can deny PutObject requests that do not include the x-amz-server-side-encryption header, ensuring objects are uploaded with encryption enforced. Option A is incorrect because using an AWS KMS key with automatic key rotation is a method of encryption, not an enforcement mechanism; the question asks for ways to enforce encryption at rest. Option C is incorrect because AWS CloudTrail logs API calls, not encryption enforcement. Option D is incorrect because IAM policies control user permissions but cannot directly enforce encryption at the service level; they can deny actions but encryption enforcement is typically done via bucket policies or default encryption.

Answer

Use an AWS KMS key with automatic key rotation.

Answer

Enable AWS CloudTrail to log all object uploads.

Answer

Attach an IAM policy to users to require encryption.

Question 5

A security team wants to detect unauthorized API calls in real time and automatically block the source IP address using network ACLs. Which AWS service should be used for detection?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is the correct choice because it is a threat detection service that continuously monitors for malicious activity and unauthorized behavior, including API calls from unusual or known-bad IP addresses. It uses machine learning, anomaly detection, and integrated threat intelligence to generate findings that can trigger automated remediation, such as updating network ACLs via AWS Lambda and Amazon EventBridge. This aligns with the requirement for real-time detection and automated blocking of source IPs.

Answer

AWS CloudTrail

Answer

AWS WAF

Answer

AWS Config

Question 6

Which TWO actions can help protect data at rest in Amazon EBS volumes? (Choose 2.)

Accepted Answer

Enable EBS encryption by default in the AWS Account settings.. Options D and E are correct. D: Enabling EBS encryption by default in AWS Account settings ensures that all new EBS volumes are encrypted at rest. E: Using encrypted EBS volumes with AWS KMS customer-managed keys provides granular control over encryption keys. Option A is incorrect because EBS snapshots are not automatically encrypted by default; they can be encrypted during copy or by enabling encryption by default for volumes. Option B is incorrect because encryption at rest is independent of instance type; any instance type can use encrypted EBS volumes. Option C is incorrect because configuring the OS to use encrypted file systems is not the primary method for protecting data at rest on EBS; EBS encryption at the volume level is more appropriate.

Answer

Enable automatic encryption of EBS snapshots by default.

Answer

Use an instance type that supports encryption at rest.

Answer

Configure the operating system to use encrypted file systems.

Question 7

A company needs to audit all changes to IAM policies in their AWS account. Which AWS service should they use to record these changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls, including IAM policy changes. Option D is correct because CloudTrail logs all IAM policy modifications. Option A (Amazon S3) is wrong because S3 is a storage service and does not record API calls. Option B (Amazon CloudWatch Logs) is wrong because CloudWatch Logs stores logs but does not directly record API calls for audit purposes. Option C (AWS Config) is wrong because AWS Config records resource state changes but not the API calls that caused those changes.

Answer

Amazon S3

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Question 8

A company has a requirement to retain CloudTrail logs for 7 years to meet regulatory compliance. They want to minimize storage costs while ensuring logs are immutable and cannot be deleted by anyone, including the root user. What should they do?

Accepted Answer

Enable S3 Object Lock in Compliance mode on the destination bucket.. S3 Object Lock in Compliance mode prevents any user, including the root user, from deleting or overwriting objects for the specified retention period. This meets the immutability and retention requirements for CloudTrail logs, and by using S3 lifecycle policies to transition logs to lower-cost storage classes (e.g., S3 Glacier Deep Archive) after the initial retention period, storage costs can be minimized while maintaining compliance.

Answer

Configure the S3 bucket with MFA Delete enabled.

Answer

Use CloudTrail log file validation and enable AWS CloudTrail Insights.

Answer

Store the logs in Amazon S3 Glacier Deep Archive with a vault lock policy.

Question 9

Which TWO AWS services can be used to monitor network traffic for malicious activity? (Select TWO.)

Accepted Answer

AWS Network Firewall. AWS Network Firewall is a managed service that provides network layer filtering and intrusion prevention. It can inspect traffic at layers 3–7 using stateful rules, domain lists, and Suricata-compatible IPS signatures to detect and block malicious activity such as exploits or malware command-and-control traffic. Amazon GuardDuty is a threat detection service that uses machine learning, anomaly detection, and integrated threat intelligence (e.g., known malicious IPs, domain reputation) to monitor VPC Flow Logs, DNS logs, and CloudTrail events for suspicious network behavior like port scanning or crypto-mining traffic.

Answer

AWS Shield

Answer

AWS WAF

Answer

Amazon Inspector

Question 10

A company has an S3 bucket that contains sensitive data. The security team wants to ensure that all objects uploaded to the bucket are encrypted at rest using server-side encryption with AWS KMS (SSE-KMS). What should the security team do to enforce this requirement?

Accepted Answer

Use an S3 bucket policy with a condition that denies PutObject if the x-amz-server-side-encryption header is not set to 'aws:kms'.. An S3 bucket policy with a condition that denies PutObject requests unless the x-amz-server-side-encryption header is set to 'aws:kms' ensures that only objects encrypted with SSE-KMS can be uploaded. Option A is incorrect because requiring a specific KMS key ID is not necessary; the policy should enforce the use of SSE-KMS, not a specific key. Option B is incorrect because requiring the header to be present does not enforce SSE-KMS; it could be 'AES256' for SSE-S3. Option C is incorrect because default encryption only encrypts objects that lack encryption headers; it does not prevent uploads that specify SSE-S3 or no encryption.

Answer

Use an S3 bucket policy that requires the x-amz-server-side-encryption-aws-kms-key-id header to match a specific KMS key.

Answer

Use an S3 bucket policy with a condition that requires the x-amz-server-side-encryption header to be present.

Answer

Configure the bucket's default encryption to use SSE-KMS.

Question 11

A company is using AWS KMS to encrypt data in Amazon S3. They need to ensure that the KMS key can only be used from within a specific VPC. Which TWO actions should be taken?

Accepted Answer

Create a VPC endpoint for AWS KMS.. A VPC endpoint for AWS KMS allows KMS API calls to be routed through the VPC, ensuring traffic does not traverse the public internet. Option E is correct because you can modify the KMS key policy to include a condition using the kms:SourceVpc key, which restricts use of the KMS key to requests originating from the specified VPC. Option B is incorrect because IAM policies cannot directly restrict based on VPC for KMS; such restrictions must be in the key policy. Option C is incorrect because a VPC endpoint for Amazon S3 does not restrict KMS calls. Option D is incorrect because S3 bucket policies control access to S3 objects, not KMS key usage.

Answer

Attach an IAM policy to the role that denies kms:Decrypt unless the request comes from the VPC.

Answer

Create a VPC endpoint for Amazon S3.

Answer

Add a bucket policy condition to restrict access to the VPC.

Question 12

A security engineer is designing a permissions boundary for an IAM user. Which TWO statements about permissions boundaries are correct?

Accepted Answer

The effective permissions are the intersection of the identity-based policy and the permissions boundary.. The correct answers are C and E. Permissions boundaries set the maximum permissions that an identity-based policy can grant. The effective permissions are the intersection of the identity-based policy and the permissions boundary (C). A permissions boundary alone does not grant permissions; you must also attach an identity-based policy (E). Option A is incorrect because permissions boundaries cannot be applied to service-linked roles. Option B is incorrect because permissions boundaries can be applied to both IAM users and roles. Option D is incorrect because permissions boundaries do not affect resource-based policies; they only limit identity-based policies.

Answer

Permissions boundaries can be applied to service-linked roles.

Answer

Permissions boundaries can only be applied to IAM users, not roles.

Answer

Permissions boundaries can override resource-based policies.

Question 13

Refer to the exhibit. A security engineer wants to monitor a Lambda function for errors and create a CloudWatch alarm when errors exceed a threshold. The engineer notices the log group exists but has no metric filters. What should the engineer do to set up the alarm?

Accepted Answer

Create a metric filter on the log group to count occurrences of 'ERROR' in log streams, then create an alarm based on that metric.. CloudWatch Logs metric filters allow you to extract and count specific patterns (like 'ERROR') from log streams, and then create a CloudWatch alarm based on that metric. This directly addresses the requirement to monitor the Lambda function for errors without needing to modify the function code or rely on external tools.

Answer

Enable CloudWatch Contributor Insights for the Lambda function to automatically detect errors.

Answer

Configure the Lambda function to publish custom metrics for errors instead of relying on logs.

Answer

Use CloudWatch Logs Insights to query logs for errors and create an alarm directly from the query results.

Question 14

A security engineer examines the above output. The company requires automatic yearly key rotation. What should the engineer do?

Accepted Answer

Run 'aws kms enable-key-rotation --key-id 1234abcd-12ab-34cd-56ef-1234567890ab'. The key is a customer managed CMK (KeyRotationEnabled: false indicates it's not an AWS managed key, as AWS managed keys have rotation enabled automatically and cannot be disabled). Enabling automatic rotation on a customer managed CMK is done via the 'aws kms enable-key-rotation' CLI command. Option B is incorrect because AWS CloudHSM is not required for key rotation; automatic rotation can be enabled directly on the CMK without manual intervention. Option C is incorrect because replacing the key with an AWS managed key would remove control over rotation and is not a necessary action; the current key can have rotation enabled. Option D is incorrect because if key material is imported, automatic rotation is not supported; the key must be rotated manually.

Answer

Use AWS CloudHSM to generate a new key and rotate manually.

Answer

Replace the key with an AWS managed key.

Answer

Import a key material and enable automatic rotation.

Question 15

A company uses AWS Organizations with multiple accounts. The security team needs to ensure that all accounts have CloudTrail enabled and that logs are delivered to a centralized S3 bucket in the management account. Which solution meets these requirements?

Accepted Answer

Use AWS CloudTrail with Organizations to create an organization trail that logs all accounts to the central bucket.. AWS CloudTrail supports integration with AWS Organizations, allowing you to create an organization trail that automatically logs events for all accounts in the organization. This trail delivers log files to a single centralized S3 bucket in the management account without requiring per-account configuration, ensuring compliance with the security team's requirement.

Answer

Write a script that runs in each account using AWS Lambda to enable CloudTrail and point to the central bucket.

Answer

Use AWS Config rules in each account to check CloudTrail status and remediate via Lambda.

Answer

Create an IAM role that each account assumes to enable CloudTrail and log to the central bucket.