SCS-C02 Practice Test 17 — 15 Questions

Question 1

A company has a security rule that all S3 buckets must have server access logging enabled. A security engineer uses AWS Config to evaluate compliance. The engineer configures a managed rule but notices that the rule does not evaluate all buckets. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The rule only evaluates buckets that have a specific tag.. The AWS Config managed rule `s3-bucket-server-access-logging-enabled` can be configured with a `tag` parameter. When a tag is specified, the rule only evaluates S3 buckets that have that exact tag key-value pair. If the security engineer did not apply the required tag to all buckets, or if the rule was configured with a tag that does not match all buckets, some buckets will be excluded from evaluation, causing the observed behavior.

Answer

The rule only evaluates buckets in the us-east-1 region.

Answer

The rule excludes buckets that have a bucket policy denying access to AWS Config.

Answer

The rule requires the logging target bucket to be in the same account.

Question 2

A security engineer is configuring AWS CloudWatch Logs to monitor for suspicious activity. They want to create a metric filter that detects when an IAM user calls the `iam:CreateAccessKey` API. The engineer writes the following filter pattern: `{ ($.eventName = "CreateAccessKey") }`. After testing, the filter does not trigger. What is the most likely reason?

Accepted Answer

The metric filter is not associated with the correct log group.. The filter pattern `{ ($.eventName = "CreateAccessKey") }` is syntactically correct and will match any CloudTrail event with eventName CreateAccessKey, regardless of service. The most likely reason the filter does not trigger is that the metric filter is not associated with the correct log group, or the log group does not contain CloudTrail events from IAM. A missing eventSource field does not prevent the filter from working; it would simply match events from any service, which could cause false positives, but not a failure to trigger.

Answer

The filter pattern syntax is incorrect; it should use square brackets.

Answer

CloudWatch Logs does not support metric filters for CloudTrail logs.

Answer

The filter pattern does not include the eventSource field, so it might match events from other services.

Question 3

A security engineer is designing a solution to allow an external auditor to access logs in an S3 bucket in the company's AWS account. The auditor does not have an AWS account. The engineer needs to grant read-only access to the specific bucket for a limited time. Which TWO actions should the engineer take? (Choose two.)

Accepted Answer

Use AWS STS to issue temporary credentials that the auditor can use to access the bucket.. AWS Security Token Service (STS) can issue temporary, limited-privilege credentials (access key, secret key, and session token) that the auditor can use to authenticate API requests to the S3 bucket. This approach does not require the auditor to have an AWS account and allows the engineer to control the validity period (via the DurationSeconds parameter) to enforce a limited time window. Option D is correct because a pre-signed URL embeds temporary credentials and a specific expiration time, granting read-only access to a single object without requiring the auditor to have AWS credentials or an AWS account.

Answer

Enable S3 Access Analyzer on the bucket to generate findings for the auditor.

Answer

Create a cross-account IAM role in the company's account and share the role ARN with the auditor.

Answer

Configure the bucket policy to grant access to 'Principal': '*' with a condition that limits access to the auditor's IP address.

Question 4

A security engineer is investigating a potential data exfiltration incident. The engineer notices that an EC2 instance with an attached IAM role has been making API calls to an S3 bucket in another AWS account. The engineer wants to identify the source of the API calls and determine if the calls are malicious. Which AWS service should the engineer use to view the API calls made by the IAM role?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made by IAM roles, including the source IP address, user agent, and the specific actions performed. In this scenario, CloudTrail logs will show the exact API calls made by the EC2 instance's IAM role to the S3 bucket in another account, enabling the security engineer to identify the source and determine if the calls are malicious.

Answer

VPC Flow Logs

Answer

Amazon GuardDuty

Answer

AWS Config

Question 5

A company has a requirement that all IAM users must use multi-factor authentication (MFA) to access the AWS Management Console. Which TWO steps should the company take to enforce this?

Accepted Answer

Enable MFA devices for each IAM user.. To enforce MFA, each IAM user must have an MFA device enabled. Option C is correct because attaching an IAM policy with a condition that denies all actions unless aws:MultiFactorAuthPresent is true ensures that users must authenticate with MFA to perform any action. Option B is incorrect because service control policies (SCPs) are used in AWS Organizations to manage permissions across accounts, not for individual user-level MFA enforcement. Option D is incorrect because enabling MFA for the root user only does not enforce MFA for all IAM users. Option E is incorrect because an IAM password policy controls password complexity and rotation, not MFA requirements.

Answer

Use a service control policy (SCP) to require MFA for all users.

Answer

Enable MFA for the root user only.

Answer

Configure an IAM password policy that requires MFA.

Question 6

A company wants to encrypt data at rest in an Amazon S3 bucket. Which AWS service can centrally manage the encryption keys?

Accepted Answer

AWS Key Management Service (AWS KMS). AWS Key Management Service (AWS KMS) is the correct service because it is a fully managed, centralized service that allows you to create, manage, and control the encryption keys used to encrypt data at rest in Amazon S3. S3 integrates directly with KMS via Server-Side Encryption with AWS KMS (SSE-KMS), enabling you to use customer managed keys (CMKs) or AWS managed keys to enforce granular access control and audit key usage through AWS CloudTrail.

Answer

AWS CloudHSM

Answer

AWS Certificate Manager (ACM)

Answer

AWS Secrets Manager

Question 7

A security engineer is analyzing an IAM policy that is attached to a group. The policy is intended to allow users to manage their own credentials. However, users are reporting that they cannot change their password. The policy is: 
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["iam:ChangePassword", "iam:GetAccountPasswordPolicy"],
      "Resource": "*"
    }
  ]
}
What is the issue?

Accepted Answer

The policy resource is set to "*", but ChangePassword requires the resource to be the specific user ARN.. The ChangePassword action requires the resource ARN to be the specific user's ARN (e.g., arn:aws:iam::account-id:user/${aws:username}). Using a wildcard '*' causes the policy to fail because IAM validates the resource ARN against the user's own ARN. Options A and C are incorrect because the required action is iam:ChangePassword, not UpdateLoginProfile or CreateLoginProfile. Option B is incorrect because the policy attachment to the group is not the issue; the resource restriction is the problem.

Answer

The policy does not include the iam:UpdateLoginProfile action.

Answer

The policy should be attached to the user instead of the group.

Answer

The policy is missing the iam:CreateLoginProfile action.

Question 8

A company is designing a centralized logging solution for multiple AWS accounts. The logs must be encrypted at rest and in transit, and access must be audited. Which TWO actions should be taken? (Choose TWO.)

Accepted Answer

Configure the S3 bucket policy to restrict PutObject to the CloudTrail service principal with a condition on aws:SourceArn.. To centrally aggregate logs from multiple AWS accounts while ensuring encryption at rest and in transit, and auditing access, two key actions are required. First, configure the central S3 bucket with a bucket policy that restricts PutObject to the CloudTrail service principal with a condition on aws:SourceArn (Option C). This ensures only the intended CloudTrail trails from designated accounts can write logs, providing security and auditability. Second, use AWS KMS customer managed keys (CMK) to encrypt the central S3 bucket (Option D). This gives you control over the encryption keys and enables auditing of key usage via CloudTrail. Option A is incorrect because cross-account CloudWatch Logs subscription requires additional configuration and does not inherently provide encryption at rest with KMS control. Option B is wrong because enabling S3 server access logs does not encrypt the logs nor restrict write access; it logs access to the bucket itself. Option E is incorrect because VPC endpoints ensure traffic stays within the AWS network but do not provide encryption at rest or the granular write restrictions needed.

Answer

Configure cross-account CloudWatch Logs subscription to aggregate logs centrally.

Answer

Enable S3 server access logs on the central bucket for auditing.

Answer

Use VPC endpoints to ensure logs are transmitted over the AWS network.

Question 9

Which THREE are AWS best practices for securing an Amazon EC2 instance? (Choose three.)

Accepted Answer

Use security groups to control inbound and outbound traffic.. Security groups act as a virtual firewall for an EC2 instance, controlling inbound and outbound traffic at the instance level. By default, security groups are stateful and allow only explicitly permitted traffic, which is a fundamental AWS best practice for network security. Using security groups helps implement the principle of least privilege by restricting access to only necessary ports and protocols.

Answer

Store database credentials in instance metadata for easy retrieval.

Answer

Launch instances in the default VPC for easier network configuration.

Question 10

A security engineer is analyzing the VPC Flow Logs entry in the exhibit. The log shows traffic from an internal IP to an external IP. Which potential security concern should the engineer investigate?

Accepted Answer

An EC2 instance is attempting to connect to an external host on port 3389 (RDP).. The VPC Flow Logs entry shows outbound traffic from an internal IP to an external IP on destination port 3389, which is the default port for Remote Desktop Protocol (RDP). RDP outbound from an EC2 instance to an external host is a security concern because it could indicate an attacker using the instance as a pivot point to connect to an external command-and-control server or to exfiltrate data via an RDP tunnel. The log direction (src internal, dst external) and port 3389 specifically point to an outbound RDP attempt, not inbound scanning or DDoS.

Answer

The instance is participating in a DDoS attack against the external IP.

Answer

An external host is scanning the internal network on port 443.

Answer

The security group allows inbound RDP from 0.0.0.0/0.

Question 11

A security engineer is configuring an AWS environment to detect and respond to potential security threats. Which AWS service can be used to automate the remediation of unwanted access to Amazon S3 buckets by invoking AWS Lambda functions?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior across AWS accounts and workloads. It can integrate with AWS Lambda functions via CloudWatch Events to automate remediation actions, such as blocking unwanted access to S3 buckets by updating bucket policies or removing public access. This makes GuardDuty the correct choice for detecting and automatically responding to security threats against S3 resources.

Answer

AWS Config

Answer

Amazon Inspector

Answer

AWS WAF

Question 12

Refer to the exhibit. A security engineer runs the IAM Policy Simulator with the provided policy input. The result shows 'explicitDeny' for ec2:RunInstances even though the policy only contains an Allow. What is the most likely reason?

Accepted Answer

The user has an attached policy or SCP that explicitly denies ec2:RunInstances.. The most likely reason is that the user has another policy attached (such as an identity-based policy or a service control policy) that explicitly denies ec2:RunInstances. The IAM Policy Simulator evaluates all applicable policies, so even if the provided policy only contains an Allow, an explicit deny from another policy overrides and results in an explicitDeny. Option B (syntax error) is not likely because a syntax error typically causes an error or implicit deny, not an explicit deny. Option C is incorrect because the simulate-custom-policy command does support ec2:RunInstances. Option D is incorrect because an incorrect resource ARN would result in an implicit deny, not an explicit deny.

Answer

The policy input has a syntax error.

Answer

The simulate-custom-policy command does not support ec2:RunInstances.

Answer

The resource ARN is incorrect for ec2:RunInstances.

Question 13

A company wants to allow users from an external AWS account to assume an IAM role in its account. What must be configured in both accounts?

Accepted Answer

Both the trusting account's role trust policy and the external account's IAM policy to allow sts:AssumeRole.. Cross-account role access requires configuration on both sides: the trusting account (where the role resides) must have a trust policy that allows the external account to assume the role, and the external account must have an IAM policy that grants its users permission to call sts:AssumeRole targeting that role. Option A is incorrect because an IAM password policy is unrelated to cross-account role access. Option B is incorrect because while the trusting account's trust policy is necessary, the external account also needs to grant sts:AssumeRole permission to its users. Option C is incorrect because the external account's policy alone is insufficient without the trusting account's trust policy.

Answer

An IAM password policy in both accounts.

Answer

Only the trusting account's role trust policy.

Answer

Only the external account's IAM policy to allow sts:AssumeRole.

Question 14

A security team needs to audit all changes to IAM resources in their AWS account. Which AWS service should they use?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls made in the AWS account, including changes to IAM resources. Therefore, option B is correct. Option A is wrong because VPC Flow Logs capture network traffic, not IAM changes. Option C is wrong because AWS Config records resource configuration changes but does not capture all API calls; it can be used to track IAM changes but CloudTrail is the primary service for API audit. Option D is wrong because CloudWatch Logs stores logs from various sources but does not capture API calls by default; it can be integrated with CloudTrail but is not the service that directly records IAM changes.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 15

A company uses an IAM role to allow an EC2 instance to access an S3 bucket. The role has an attached policy that grants s3:GetObject on the bucket. However, the application on the EC2 instance is unable to read objects. What is the MOST likely cause?

Accepted Answer

The EC2 instance does not have an IAM instance profile configured.. For an IAM role to be used by an EC2 instance, the role must be associated with an instance profile, and that profile must be attached to the instance. Without the instance profile, the instance cannot assume the role, so the application lacks the necessary permissions to read from S3. Option A is incorrect because the bucket policy denying access would be a possible cause, but it is not the most likely given that the role already has the s3:GetObject permission. Option C is incorrect because policies are attached to roles, not instances directly. Option D is incorrect because the user data script does not affect IAM permissions.

Answer

The S3 bucket policy denies access to the IAM role.

Answer

The policy is attached to the EC2 instance instead of the role.

Answer

The EC2 instance is not running the latest user data script.