SCS-C02 Practice Test 17 — 15 Questions

Question 1

A company wants to ensure that all traffic to an Amazon S3 bucket is encrypted in transit. Which bucket policy condition should be used?

Accepted Answer

aws:SecureTransport. The `aws:SecureTransport` condition key checks whether the request was sent using SSL/TLS (i.e., HTTPS). Setting it to `false` in a deny statement ensures that any HTTP request to the S3 bucket is rejected, thereby enforcing encryption in transit. This is the correct condition for the stated requirement.

Answer

aws:SourceVpce

Answer

s3:x-amz-server-side-encryption

Answer

aws:SourceIp

Question 2

A security engineer is setting up automated incident response for a compromised EC2 instance. The engineer wants to isolate the instance immediately upon detection of a GuardDuty finding. Which AWS service can be used to automatically trigger a Lambda function that modifies the instance's security group?

Accepted Answer

Amazon CloudWatch Events. Amazon CloudWatch Events (now part of Amazon EventBridge) can be configured with a rule that matches specific GuardDuty finding events. When a finding is detected, the rule triggers a Lambda function that can modify the EC2 instance's security group to isolate it, for example by removing all inbound rules or replacing the group with a restrictive one. This provides the automated, event-driven response required.

Answer

AWS Step Functions

Answer

Amazon Inspector

Answer

AWS Config

Question 3

A security engineer is designing a VPC with public and private subnets. The VPC will host web servers in public subnets and database servers in private subnets. The web servers need to send traffic to the database servers, and the database servers must not have direct internet access. Which TWO configurations should the engineer implement?

Accepted Answer

Configure security group rules to allow inbound traffic from the web server security group to the database security group.. Security group rules are stateful and can reference other security groups as a source, allowing the web server security group to be specified as the source for inbound traffic to the database security group. This ensures that only traffic originating from the web servers is permitted to reach the database servers, providing a logical, application-layer firewall without exposing the databases to the internet. Option C is correct because omitting a route to an internet gateway from the private subnet's route table ensures that the database servers have no direct path to the internet, satisfying the requirement that they must not have direct internet access.

Answer

Use network ACLs to block all inbound traffic to the private subnets.

Answer

Attach an internet gateway to the VPC and route the private subnets to it.

Answer

Add a NAT gateway in the public subnet and route the private subnets to it.

Question 4

A company uses AWS Config to record resources. Which TWO actions can be taken to automatically remediate non-compliant resources detected by AWS Config rules?

Accepted Answer

Configure AWS Config rules to invoke an AWS Lambda function for remediation. AWS Config rules can be configured with remediation actions that invoke an AWS Lambda function. When a resource is evaluated as non-compliant, the rule triggers the Lambda function, which can execute custom logic to modify or fix the resource, such as adjusting security group rules or enabling encryption. This provides automated, programmable remediation directly integrated with AWS Config's evaluation lifecycle.

Answer

Configure AWS Config rules to send notifications to an SNS topic

Answer

Use AWS CloudTrail to log non-compliant events

Answer

Use Amazon CloudWatch Events to trigger an AWS Step Functions state machine

Question 5

A company wants to use AWS CloudFormation to manage infrastructure. The security team requires that all templates are scanned for security vulnerabilities before deployment. Which service should be integrated into the pipeline?

Accepted Answer

AWS CloudFormation Guard. AWS CloudFormation Guard (cfn-guard) is a policy-as-code tool that allows you to define rules to validate CloudFormation templates against security best practices before deployment. It integrates into CI/CD pipelines to enforce compliance with organizational policies, such as ensuring encryption is enabled or public access is restricted, directly addressing the requirement to scan templates for security vulnerabilities.

Answer

Amazon Inspector

Answer

AWS Config

Answer

AWS Shield Advanced

Question 6

A security engineer needs to automate the response to an AWS CloudTrail log event that indicates a potential security threat. Which AWS service would be most appropriate to orchestrate the automated response?

Accepted Answer

AWS Step Functions. AWS Step Functions is a serverless orchestration service that models workflows as state machines, making it ideal for coordinating multi-step, multi-service incident response (e.g., isolate instance → snapshot → notify → create ticket) with retries, branching, and human-approval steps. While Lambda executes individual functions, Step Functions provides the durable orchestration, state tracking, and error handling needed for a reliable automated response. It integrates natively with EventBridge, Lambda, SNS, and security services.

Answer

AWS Lambda

Answer

Amazon Simple Queue Service (SQS)

Answer

Amazon EventBridge

Question 7

Match each AWS security-related acronym to its definition.

Accepted Answer

SOC: Report on controls at a service organization relevant to security, availability, processing integrity, confidentiality, or privacy.. The correct matches are: SOC with service organization controls, PCI DSS with credit card security, HIPAA with healthcare privacy, and FedRAMP with cloud authorization. Common confusions include mixing HIPAA with SOC and PCI DSS with FedRAMP.

Answer

SOC: US law designed to provide privacy standards to protect patients' medical records and other health information.

Answer

PCI DSS: US government program that standardizes security assessment, authorization, and continuous monitoring for cloud products and services.

Question 8

A company has a requirement that all IAM users must use strong passwords. The security engineer needs to enforce a password policy that requires minimum 12 characters, at least one uppercase letter, and at least one number. The engineer sets the password policy in IAM. However, existing users with weak passwords are not forced to change them. What should the engineer do to enforce the policy for existing users?

Accepted Answer

Set the password expiration period to 0 to force immediate password change.. Setting the password policy to expire existing passwords will force users to change them on next login. Option A is wrong because the policy is already set; users are not forced to change. Option B is wrong because allowing users to change passwords does not enforce the policy. Option C is wrong because resetting passwords manually is not scalable and not required.

Answer

Manually reset each user's password to a strong password.

Answer

Enable 'Allow users to change their own password' in the policy.

Answer

Re-apply the password policy to each user.

Question 9

A security engineer is designing a centralized logging solution for multiple AWS accounts. Which TWO services should be used to aggregate logs from all accounts into a single account? (Choose TWO.)

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs can receive log data from multiple AWS accounts via cross-account subscription filters, allowing a centralized logging account to aggregate logs from all source accounts. AWS CloudTrail can be configured to deliver trail logs from multiple accounts to a single S3 bucket in a central account, enabling consolidated audit logging. Together, these two services provide a comprehensive centralized logging solution for multi-account environments.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

Amazon S3

Question 10

Drag and drop the steps to configure a VPC with private subnets and NAT gateway for outbound internet access in the correct order.

Accepted Answer

Create VPC, then create subnets, then create and attach Internet Gateway, then create NAT Gateway, then update route tables.. VPC creation, subnets, internet gateway, NAT gateway, and route table update are required for private subnet internet access.

Answer

Create VPC, then create subnets, then create NAT Gateway, then create and attach Internet Gateway, then update route tables.

Answer

Create VPC, then create subnets, then create and attach Internet Gateway, then update route tables, then create NAT Gateway.

Answer

Create VPC, then create NAT Gateway, then create subnets, then create and attach Internet Gateway, then update route tables.

Question 11

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all API calls in the organization are logged and retained for at least one year. Which AWS services or features should be used to meet these requirements? (Choose TWO.)

Accepted Answer

Amazon S3 lifecycle policy to transition logs to S3 Glacier after one year.. An Amazon S3 lifecycle policy can automatically transition CloudTrail log objects from S3 Standard to S3 Glacier after one year, meeting the retention requirement cost-effectively. Option E is correct because AWS CloudTrail with an organization trail logs all API calls across all accounts in the AWS Organization, ensuring comprehensive logging.

Answer

Amazon GuardDuty with threat detection enabled.

Answer

AWS Config with recording enabled for all resources.

Answer

VPC Flow Logs for all VPCs.

Question 12

A company's security team is designing an incident response plan for AWS resources. They want to ensure that when a security incident is detected in a production account, a pre-defined runbook is executed automatically. The runbook includes steps to isolate the compromised resource and collect forensic evidence. Which combination of services should the team use to implement this automation?

Accepted Answer

AWS Systems Manager Incident Manager and AWS Systems Manager Automation. AWS Systems Manager Incident Manager provides the incident management lifecycle, including automated response plans that trigger runbooks when an incident is detected. AWS Systems Manager Automation runbooks contain predefined steps (e.g., isolating EC2 instances, capturing memory dumps, and collecting logs) that can be executed automatically. This combination directly meets the requirement for a pre-defined runbook that isolates the compromised resource and collects forensic evidence.

Answer

Amazon EventBridge and AWS Lambda

Answer

AWS Config and Amazon EC2 Auto Scaling

Answer

AWS Step Functions and AWS Lambda

Question 13

A company has a multi-account AWS environment with hundreds of accounts. The security team needs to ensure that all security findings from GuardDuty, Security Hub, and Detective are centrally collected and correlated. Which architecture is the MOST scalable and cost-effective?

Accepted Answer

Enable AWS Security Hub as the central aggregator, with GuardDuty and Detective integrated. Use Security Hub cross-account aggregation.. AWS Security Hub natively supports cross-account aggregation via a delegated administrator, allowing findings from GuardDuty, Security Hub, and Detective to be centrally collected without custom code. This architecture is both scalable (handles hundreds of accounts without polling or custom infrastructure) and cost-effective (no additional Lambda, DynamoDB, or S3 query costs), leveraging built-in integrations and consolidated findings views.

Answer

Deploy a central Lambda function that polls each account's GuardDuty, Security Hub, and Detective APIs and stores findings in DynamoDB.

Answer

Configure each account to send findings to a central CloudWatch Logs log group and use CloudWatch Logs Insights to correlate.

Answer

Stream all findings from all services to a central Amazon S3 bucket and use Amazon Athena to query them.

Question 14

An IAM policy includes the following statement: 'Effect': 'Allow', 'Action': 's3:GetObject', 'Resource': 'arn:aws:s3:::example-bucket/*', 'Condition': {'IpAddress': {'aws:SourceIp': '192.0.2.0/24'}}. Which TWO statements about this policy are correct?

Accepted Answer

Requests from outside 192.0.2.0/24 will be implicitly denied.. Option E is correct because the statement's Action is s3:GetObject and its Condition restricts aws:SourceIp to 192.0.2.0/24, so the allow applies exactly to GetObject requests originating from that CIDR range. Option B is correct because IAM policies are deny-by-default: any request that does not satisfy the IpAddress condition (i.e., comes from outside 192.0.2.0/24) is not matched by this Allow and is therefore implicitly denied, absent another applicable allow. Option A is wrong because s3:PutObject is not listed in the Action, so the policy never grants write access. Option C is wrong because there is no condition on bucket ownership; the only condition is the source IP. Option D is wrong because the policy grants no anonymous/public access by itself—it only allows GetObject when the request's source IP falls in the specified range, and it does not remove authentication requirements.

Answer

The policy allows s3:PutObject from the IP range 192.0.2.0/24.

Answer

The policy allows s3:GetObject only if the bucket owner matches.

Answer

The policy allows anonymous access.

Question 15

A company is designing a disaster recovery plan for its Amazon RDS for MySQL database. The database must be encrypted at rest. Which approach ensures that the database is encrypted and can be restored in another AWS Region?

Accepted Answer

Create a cross-Region read replica with encryption enabled. (Create a cross-Region read replica with encryption enabled) is correct because it continuously replicates data to another AWS Region and encryption at rest can be enabled, ensuring both disaster recovery and encryption. Option A is wrong because encryption cannot be enabled on an existing unencrypted DB instance; a new encrypted instance must be created. Option B is wrong because exporting to S3 and using cross-Region replication does not provide a real-time database replica and complicates recovery. Option C is wrong because while a manual snapshot can be copied to another Region with encryption, it does not provide continuous replication; it is a point-in-time backup, not a disaster recovery solution that minimizes data loss.

Answer

Enable encryption on the existing DB instance

Answer

Export the database to Amazon S3 and use S3 cross-Region replication

Answer

Create a manual snapshot and copy it to another Region with encryption