SCS-C02 Practice Test 18 — 15 Questions

Question 1

Which THREE practices are recommended for managing encryption keys in AWS KMS? (Choose 3.)

Accepted Answer

Enable automatic rotation of the KMS key annually.. Options B, D, and E are correct. B: Enabling automatic key rotation annually is a best practice to ensure keys are rotated regularly without manual intervention. D: Using key policies to restrict which IAM roles can use the key follows the principle of least privilege. E: Enabling AWS CloudTrail logging to record KMS key usage provides an audit trail for security monitoring. Option A is incorrect because deleting a KMS key immediately can cause permanent data loss; instead, you should schedule key deletion. Option C is incorrect because exporting KMS key material and storing it in an S3 bucket would expose the key material and defeat the purpose of using a managed service like KMS.

Answer

Delete the KMS key immediately when it is no longer needed.

Answer

Export the KMS key material and store it in a secure S3 bucket.

Question 2

A security engineer notices that an S3 bucket containing sensitive data has been accessed from an IP address outside the allowed range. CloudTrail logs show the access was made using temporary credentials from an assumed role. What additional logging is needed to trace the access back to the original IAM user who assumed the role?

Accepted Answer

Enable AWS Config to record S3 bucket policies.. The information needed to trace the access back to the original IAM user who assumed the role is already available in CloudTrail management events, which are enabled by default. The AssumeRole API call is logged as a management event and includes the ARN of the IAM user or role that performed the assumption. Therefore, no additional logging is required to identify the original user. Options A, B, C, D, and E do not provide this specific information: A and D log the S3 access but show only the assumed role; B and C are unrelated; E records configuration changes but not the specific AssumeRole call.

Answer

Enable CloudTrail to log data events for the S3 bucket.

Answer

Enable VPC Flow Logs for the VPC where the request originated.

Answer

Configure CloudWatch Logs to capture the EC2 instance's system logs.

Answer

Enable S3 server access logging for the bucket.

Question 3

Refer to the exhibit. An IAM policy allows running EC2 instances. A developer tries to launch a t2.micro instance but receives an 'AccessDenied' error. What is the most likely reason?

Accepted Answer

The policy does not grant permissions for other required resources such as images or security groups.. Even though the policy allows the ec2:RunInstances action on the instance resource, the RunInstances API call requires permissions for other resources such as Amazon Machine Images (AMI), security groups, and key pairs. Without explicit permissions for these resources, the API call fails with an AccessDenied error. Option B is incorrect because the condition specifies t2.micro, matching the developer's request. Option C is incorrect because the policy does not restrict by region. Option D is incorrect because there is no explicit deny; the denial is due to missing resource permissions.

Answer

The developer is trying to launch a different instance type.

Answer

The region in the policy does not match the developer's region.

Answer

The policy has an explicit deny elsewhere.

Question 4

A security engineer wants to detect and alert on AWS account root user activity. Which THREE services can be used together to achieve this? (Select THREE.)

Accepted Answer

Amazon CloudWatch Events (EventBridge). Amazon CloudWatch Events (EventBridge) is correct because it can be used to create a rule that matches specific API calls recorded by AWS CloudTrail. When the root user performs an action, CloudTrail logs the event, and EventBridge can trigger a notification (e.g., via SNS or Lambda) based on that event. This combination allows real-time detection and alerting of root user activity.

Answer

AWS Config

Answer

Amazon GuardDuty

Question 5

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that no IAM user in any account can create new IAM users. Which approach should be used?

Accepted Answer

Apply a service control policy (SCP) at the root organizational unit that denies IAM:CreateUser.. Service control policies (SCPs) are the correct mechanism because they allow you to centrally restrict permissions across all accounts in an AWS Organization. By attaching an SCP at the root organizational unit that denies the `iam:CreateUser` action, you ensure that no IAM user in any member account can create new IAM users, regardless of any IAM policies applied within those accounts. SCPs act as a guardrail that overrides any allow permissions granted by IAM policies.

Answer

Apply an IAM policy to the root user of each account.

Answer

Use an SCP attached to each IAM user.

Answer

Use an IAM permissions boundary on each IAM user.

Question 6

A company is using Amazon CloudWatch Logs to store application logs. The security team needs to ensure that logs are encrypted at rest using a customer-managed KMS key (CMK). What configuration is required?

Accepted Answer

Associate the CMK with the CloudWatch Logs log group by specifying the key ARN in the log group's encryption configuration.. CloudWatch Logs supports server-side encryption with a customer-managed KMS key (CMK) by associating the key ARN with the log group. This is done via the CloudWatch Logs console, AWS CLI, or SDK using the `associate-kms-key` operation, which encrypts all log data at rest within that log group. The KMS key policy must also grant the CloudWatch Logs service principal (`logs.region.amazonaws.com`) permission to use the key, but the core configuration step is associating the key with the log group.

Answer

Add a KMS key policy that allows CloudWatch Logs to use the key.

Answer

Enable default encryption on the S3 bucket used for log export with a CMK.

Answer

Configure the S3 bucket policy to require SSE-KMS for log delivery.

Question 7

A company is using Amazon Route 53 and wants to log DNS queries for investigative purposes. The logs must be stored in a centralized S3 bucket in the security account. What is the MOST efficient way to achieve this?

Accepted Answer

Configure Route 53 Resolver query logging to deliver to the central S3 bucket.. Route 53 Resolver query logging natively supports delivering DNS query logs directly to an S3 bucket, including cross-account S3 buckets, without requiring any intermediate services. This is the most efficient method because it eliminates the need for additional compute resources or manual polling, and it directly satisfies the requirement for centralized logging in the security account.

Answer

Enable VPC Flow Logs and analyze DNS traffic.

Answer

Enable CloudWatch Logs for Route 53 and stream to a Lambda function that writes to S3.

Answer

Use a custom Lambda function to poll Route 53 logs and write to S3.

Question 8

Refer to the exhibit. A security engineer configured the above bucket policy for CloudTrail log delivery. However, logs are not being delivered. What is the most likely cause?

Accepted Answer

The condition requires 'bucket-owner-full-control' ACL, but CloudTrail does not set this ACL when delivering to the same account.. When CloudTrail delivers logs to an S3 bucket in the same AWS account, it does not set the 'bucket-owner-full-control' canned ACL on the objects. The bucket policy condition requiring 's3:x-amz-acl': 'bucket-owner-full-control' will fail, as CloudTrail uses the default ACL (bucket-owner-full-control is only set for cross-account deliveries). This mismatch prevents log delivery.

Answer

The Action should be 's3:PutObjectAcl' instead of 's3:PutObject'.

Answer

The Principal is incorrect; it should be the CloudTrail service principal for the region.

Answer

The Resource ARN is missing the account ID in the path.

Question 9

A company uses AWS Organizations with multiple accounts. The security team needs to enforce that all S3 buckets in the organization block public access. Which policy should be attached to the root organizational unit to achieve this?

Accepted Answer

Attach a service control policy (SCP) that denies s3:PutBucketPublicAccessBlock.. Attach a service control policy (SCP) that denies s3:PutBucketPublicAccessBlock. SCPs can be applied at the root organizational unit to centrally restrict permissions across all accounts, preventing any account from allowing public access to S3 buckets. Option A (CloudTrail) only logs events, not block access. Option B (AWS Config) can detect non-compliance but requires additional automation to enforce; the question asks for enforcement directly. Option D (IAM role) is account-specific and cannot enforce globally.

Answer

Enable AWS CloudTrail to log public access attempts and alert the security team.

Answer

Use AWS Config rules to remediate non-compliant buckets automatically.

Answer

Create an IAM role with a bucket policy that blocks public access.

Question 10

A company has a requirement that all Amazon EC2 instances must be launched with an IAM role that grants least-privilege permissions. The security team wants to prevent users from launching instances without a role, and also want to ensure that the role used is one of a set of approved roles. How can this be enforced?

Accepted Answer

Attach an IAM policy to users that denies ec2:RunInstances unless the ec2:InstanceProfile condition matches an approved profile ARN.. Option B uses an IAM policy with a condition on the ec2:InstanceProfile key to ensure that only approved instance profiles are used. This satisfies both requirements: a role must be attached, and it must be one of the approved roles.

Option A is incorrect because an SCP that requires an IAM role cannot restrict the role to a specific set of approved roles; it would allow any role.

Option C is incorrect because SCPs require AWS Organizations and apply to all principals in the account. While SCPs can technically use the ec2:InstanceProfile condition key, they are typically used for broad guardrails and not for user-specific restrictions. An IAM policy with a condition is the recommended method for this use case.

Option D is incorrect because AWS Config is a detective service; it cannot prevent unauthorized launches, only detect them after the fact.

Answer

Use an SCP to require that all EC2 instances have an IAM role attached.

Answer

Use an SCP to deny ec2:RunInstances unless the instance profile is in a specific list of ARNs.

Answer

Use AWS Config to detect instances without a role and automatically terminate them.

Question 11

A security engineer is investigating a potential data exfiltration from an S3 bucket that is configured to allow public access. The engineer wants to determine who accessed the bucket and from which IP addresses. Which AWS capability should be used?

Accepted Answer

AWS CloudTrail data events for S3. AWS CloudTrail data events for S3 capture detailed API activity at the object level, including GetObject, PutObject, and DeleteObject calls. This allows the security engineer to identify exactly who accessed the bucket (via the user identity) and from which IP address (via the sourceIPAddress field in the CloudTrail event). Unlike management events, data events must be explicitly enabled and provide the granularity needed for this investigation.

Answer

Amazon S3 server access logs

Answer

AWS IAM Access Analyzer

Answer

Amazon VPC Flow Logs

Question 12

Refer to the exhibit. A security engineer applies the bucket policy shown to an S3 bucket. The engineer attempts to upload a file using the AWS CLI without specifying any encryption. What is the outcome?

Accepted Answer

The upload succeeds because default encryption on the bucket will encrypt the object with SSE-S3.. The bucket policy includes a Deny effect with a condition 'StringNotEquals': {'s3:x-amz-server-side-encryption': 'aws:kms'}. This condition denies requests only when the x-amz-server-side-encryption header is present in the request and its value is not 'aws:kms'. If the header is absent (as when the user does not specify encryption), the condition evaluates to false, meaning the Deny rule does not apply. Therefore, the upload is not denied by this policy. Since new S3 buckets have default encryption enabled with SSE-S3, the object will be encrypted with SSE-S3, and the upload succeeds. Option A is incorrect because the policy does not deny all requests; it only denies those that include a supported but non-matching encryption header. Option C is incorrect because it assumes the Deny applies when the header is absent, which is not the case for 'StringNotEquals' (without 'IfExists'). Option D is similar to B but B is the more precise statement.

Answer

The upload fails because the policy denies all PutObject requests.

Answer

The upload fails because the policy denies PutObject when encryption is not SSE-KMS.

Answer

The upload succeeds because the object is encrypted with SSE-S3 by default.

Question 13

A security engineer is designing a VPC with public and private subnets. The application must be able to send outbound traffic to the internet, but inbound traffic from the internet must be blocked except for a single HTTP load balancer. The application also needs to access an S3 bucket in the same AWS region. Which combination of VPC components meets these requirements? (Choose two.)

Accepted Answer

NAT Gateway in a public subnet. A NAT Gateway in a public subnet allows instances in private subnets to initiate outbound traffic to the internet (e.g., for software updates or API calls) while blocking unsolicited inbound connections. This satisfies the requirement for outbound internet access without exposing private instances directly.

Answer

S3 Interface Endpoint in the VPC

Answer

VPC Peering to a shared services VPC

Answer

Internet Gateway attached to the VPC

Question 14

A security engineer notices that an IAM user has been inactive for 90 days. What is the best way to identify and disable such users?

Accepted Answer

Use IAM Credential Report and disable users with no activity in 90 days. The IAM Credential Report provides a comprehensive CSV export of all IAM users in the account, including the `password_last_used` and `access_key_last_used_date` columns. This allows a security engineer to directly identify users who have had no activity for 90 days and then disable them by applying an IAM policy with a `Deny` effect or removing their credentials. It is the most straightforward, native, and accurate method for this specific task.

Answer

Use CloudTrail to identify users with no recent events

Answer

Use AWS Config rule to detect inactive users

Answer

Use AWS Organizations to disable users

Question 15

A company has a VPC with a single public subnet and a single private subnet. The private subnet contains an RDS MySQL database that should not be accessible from the internet. The public subnet contains a bastion host that is used for SSH access to the database instance. The security team wants to ensure that the database can only be accessed from the bastion host. Which two security group rules should be configured? (Choose TWO.)

Accepted Answer

Database security group: Allow inbound MySQL from the bastion security group.. Options B and C are correct. The database security group should allow inbound MySQL from the bastion security group (option B), ensuring only the bastion can access the database. The bastion security group should allow inbound SSH only from a limited corporate IP range (option C) to restrict administrative access. Option A is incorrect because allowing inbound MySQL from the public subnet CIDR would permit any instance in that subnet, not just the bastion. Option D is incorrect as it allows MySQL from the entire internet. Option E is incorrect because it allows SSH from any IP, which is insecure.

Answer

Database security group: Allow inbound MySQL from the public subnet CIDR.

Answer

Database security group: Allow inbound MySQL from 0.0.0.0/0.

Answer

Bastion security group: Allow inbound SSH from 0.0.0.0/0.