SCS-C02 Practice Test 18 — 15 Questions

Question 1

The above condition is added to an S3 bucket policy to restrict access to a specific VPC endpoint. An EC2 instance in the same VPC is unable to access the bucket. What is the most likely reason?

Accepted Answer

The resource ARN in the policy is for EC2, not for S3. Option C is correct because the condition uses aws:SourceVpce, which checks the VPC endpoint ID. However, if the EC2 instance is accessing S3 through a gateway endpoint (not interface endpoint), the sourceVpce condition will not match because gateway endpoints do not provide a VPC endpoint ID in the request. Option A is wrong because the resource ARN is for EC2 instances, but the policy is for S3 bucket? Actually, the exhibit shows a condition, not a full policy. The condition is likely part of an S3 bucket policy. The resource ARN for S3 would be different. The exhibit shows a resource ARN for EC2, which is suspicious. Actually, the exhibit shows Resource: "arn:aws:ec2:..." which is incorrect for S3. That might be the problem. Option D: The resource ARN is for EC2, not S3. So the policy is malformed. The most likely reason is that the resource ARN is incorrect. So option D. Let's re-evaluate: The exhibit shows Resource: "arn:aws:ec2:..." but the condition is for S3? The stem says 'added to an S3 bucket policy'. So the resource ARN should be for S3. Therefore the policy is invalid. So answer D.

Answer

The condition should use aws:SourceVpc instead of aws:SourceVpce

Answer

The EC2 instance does not have a public IP address

Answer

The VPC endpoint policy does not allow the s3:GetObject action

Question 2

Which TWO AWS services can be used to detect anomalous behavior in an AWS environment?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty and AWS Security Hub both provide anomaly detection. GuardDuty uses machine learning to detect threats. Security Hub aggregates findings and can detect anomalies through integrated services. AWS Config is for compliance. AWS CloudTrail is logging. Amazon Inspector is for vulnerabilities.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

Amazon Inspector

Question 3

A security engineer is investigating a potential incident where an EC2 instance was compromised. The engineer has access to the following logs: CloudTrail, VPC Flow Logs, and OS-level logs from the instance. Which TWO log sources would be MOST useful to determine the initial attack vector? (Choose TWO.)

Accepted Answer

OS-level authentication and system logs. Option A is correct because CloudTrail logs API calls, which can show who launched the instance and what security groups were used. Option D is correct because OS-level logs show login attempts, processes, and file changes. Option B is wrong because VPC Flow Logs show network traffic but not application-level details. Option C is wrong because CloudWatch Metrics are aggregated and do not provide detailed logs. Option E is wrong because Config records configuration changes, not attack vectors.

Answer

Amazon CloudWatch Metrics for the instance

Answer

AWS Config configuration history

Answer

VPC Flow Logs

Question 4

Refer to the exhibit. A security engineer is reviewing an S3 bucket policy. The policy is intended to allow read access to objects in the bucket only from the corporate network (203.0.113.0/24). However, users outside the network can still access the bucket. What is the most likely reason?

Accepted Answer

The bucket policy does not include an explicit Deny statement for IP addresses outside the allowed range.. The bucket policy alone is not sufficient; the bucket must also block public access. A bucket policy that grants access to a specific IP range still allows access to anyone who can satisfy the condition. However, if the bucket's block public access settings are not configured, anonymous users could bypass the policy? Actually, the policy allows access only from that IP, but if the bucket is not public, only authorized IAM users can access. The issue could be that the policy doesn't deny access from other IPs. The correct answer is that the policy allows access but does not explicitly deny access from other IPs. A more correct policy would include a Deny statement. The other options: Users are using pre-signed URLs would bypass IP restriction. The bucket policy has a typo? The resource is correct. The condition key is correct. The most likely reason is that the policy allows access but does not deny access from other IPs. However, among the options, the best is that the policy does not include an explicit Deny for other IPs.

Answer

The s3:GetObject action is misspelled; it should be s3:GetObjectVersion.

Answer

The condition key should be aws:SourceIp instead of aws:SourceIp.

Answer

The bucket policy must be attached to the bucket's ACL instead.

Question 5

A financial services company uses a multi-account AWS organization with a centralized security account. The security team has enabled Amazon GuardDuty in all accounts and configured it to send findings to the security account via AWS Organizations. The team also uses AWS Security Hub in the security account to aggregate findings. They have set up automated response using AWS Systems Manager Automation documents to isolate compromised EC2 instances by applying a security group that denies all traffic. However, during a recent incident, the automation failed because the Systems Automation document did not have permission to modify the security group in the member account. The security team needs to design a solution that allows the security account to automatically isolate instances in any member account. What should they do?

Accepted Answer

Use AWS CloudFormation StackSets to deploy an IAM role in each member account with permissions to modify security groups. Then, in the security account, configure the Systems Manager Automation document to assume that role when running the isolation step.. Option A is correct because using a CloudFormation StackSet to deploy the necessary IAM roles in each member account with the appropriate permissions, and then having the automation in the security account assume that role via cross-account access, is a scalable and secure approach. Option B is wrong because modifying the IAM role in the security account does not grant permissions in member accounts. Option C is wrong because using a Lambda function in each member account is less scalable than using StackSet. Option D is wrong because creating a single role in the security account does not grant access to member accounts.

Answer

Create a Lambda function in each member account that is triggered by GuardDuty findings and modifies the security group.

Answer

Create a single IAM role in the security account that has permissions to modify security groups in all member accounts.

Answer

Modify the IAM role used by Systems Manager Automation in the security account to include permissions to modify security groups in all member accounts.

Question 6

A company uses Amazon GuardDuty to monitor its AWS environment. The security team has received a GuardDuty finding of type 'Recon:EC2/PortProbeUnprotectedPort'. The finding indicates that an EC2 instance has an open SSH port that is being probed from the internet. The team wants to reduce the attack surface and prevent future probes. Which THREE actions should the team take? (Choose THREE.)

Accepted Answer

Modify the security group to allow SSH only from specific IP addresses.. Options A, C, and D are correct: changing the security group to restrict SSH access to known IPs, placing the instance in a private subnet with a NAT gateway, and using Systems Manager Session Manager instead of SSH. Option B is wrong because terminating the instance is not necessary if it can be secured. Option E is wrong because GuardDuty suppression is for false positives, not for fixing actual vulnerabilities.

Answer

Suppress the GuardDuty finding to reduce noise.

Answer

Terminate the EC2 instance and launch a new one.

Question 7

A company runs a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application processes sensitive customer data. The Security team has enabled VPC Flow Logs, CloudTrail, and GuardDuty. Recently, the team received a GuardDuty finding indicating a potential SSH brute force attack originating from an external IP address 203.0.113.50 targeting one of the EC2 instances. The Security Engineer needs to automatically isolate the affected instance and capture forensic evidence for analysis. The company has strict requirements: the instance must be isolated immediately, and a snapshot of the EBS volume must be taken before any remediation actions are taken. The instance is part of an Auto Scaling group, and the Security Engineer wants to minimize manual intervention. The Security Engineer has access to AWS Systems Manager and AWS Lambda. Which combination of steps should the Security Engineer implement to meet the requirements?

Accepted Answer

Configure Amazon EventBridge to detect the GuardDuty finding and invoke an AWS Lambda function. The Lambda function first calls the EC2 CreateSnapshot API to capture a forensic snapshot of the instance's EBS volume. Then, it uses AWS Systems Manager Automation to run a pre-defined automation document that isolates the instance by modifying the instance's security group to only allow traffic from a trusted management IP, and then stops the instance.. Option D is correct because EventBridge can trigger a Lambda function on GuardDuty findings. The Lambda function takes an EBS snapshot for forensic analysis, then uses Systems Manager Automation to isolate the instance by modifying the security group and stopping the instance. This ensures isolation and evidence capture in an automated manner. Option A is wrong because terminating the instance before taking a snapshot loses forensic data. Option B is wrong because EC2 Instance Connect is for direct access, not for automated isolation. Option C is wrong because CloudWatch Logs does not trigger on GuardDuty findings; EventBridge is the appropriate service.

Answer

Use AWS Systems Manager to automatically connect to the instance via EC2 Instance Connect, run commands to capture forensic data, and then modify the security group to deny all inbound traffic.

Answer

Create a CloudWatch Logs metric filter on the VPC Flow Logs for the attacker IP. When the metric breaches a threshold, trigger an SNS topic that runs an AWS Systems Manager Automation document to isolate the instance and take an EBS snapshot.

Answer

Configure a CloudWatch Events rule to detect the GuardDuty finding and invoke an AWS Lambda function. The Lambda function terminates the EC2 instance and then takes a snapshot of the EBS volume for forensic analysis.

Question 8

A company uses Amazon Detective to investigate security findings. The security team is analyzing a GuardDuty finding of type 'Backdoor:EC2/C&CActivity.B!DNS' for an EC2 instance. The team wants to use Detective to understand the full scope of the incident, including which other resources the instance communicated with and any IAM roles used. However, when the team opens the finding in Detective, they see no network activity data for the instance. The instance is in a VPC with VPC Flow Logs enabled, and Flow Logs are being published to CloudWatch Logs. What should the team do to enable Detective to display the network activity?

Accepted Answer

Ensure that VPC Flow Logs are enabled for the VPC and are being published to Amazon CloudWatch Logs in the same account and Region as Detective.. Option A is correct because Detective ingests VPC Flow Logs from CloudWatch Logs to analyze network traffic. The VPC Flow Logs must be in the correct format and delivered to CloudWatch Logs for Detective to consume. Option B is wrong because Detective does not need direct access to the instance. Option C is wrong because the GuardDuty finding is already in Detective; the issue is network data. Option D is wrong because enabling more GuardDuty findings does not add network data.

Answer

Re-enable the GuardDuty finding in Amazon Detective.

Answer

Enable GuardDuty EKS Audit Logs monitoring.

Answer

Install the Amazon Detective agent on the EC2 instance.

Question 9

A company uses AWS CloudTrail to log all API activity. The security team wants to ensure that any changes to CloudTrail configuration (e.g., disabling the trail, deleting the trail, modifying the log delivery) are detected immediately. They have created a CloudWatch Events rule to capture the event 'StopLogging' and send an SNS notification. During testing, the team stops the trail and does not receive the notification. The CloudWatch Events rule is configured with the correct event pattern. What should the team check?

Accepted Answer

Check the IAM role associated with the CloudWatch Events rule to ensure it has permissions to publish to the SNS topic.. Option B is correct because CloudWatch Events rules require an IAM role to invoke the SNS topic. The role must have sns:Publish permissions. Option A is wrong because the trail is logging management events by default. Option C is wrong because the event pattern is correct, but the target action fails. Option D is wrong because SNS topic subscriptions are for subscribers, not for publishing.

Answer

Verify that the CloudTrail trail is logging management events.

Answer

Ensure that the event pattern includes the correct source and detail-type.

Answer

Confirm that the SNS topic subscription is confirmed.

Question 10

A company is using Amazon CloudWatch Logs to collect application logs. The security team wants to detect patterns that indicate security threats, such as multiple failed login attempts. Which TWO services can be used together to perform real-time log analysis and alerting?

Accepted Answer

Amazon OpenSearch Service. Options A and C are correct because CloudWatch Logs can stream logs to Amazon OpenSearch Service for analysis, and CloudWatch Logs can also be used with subscription filters to invoke a Lambda function for real-time processing. Option B is wrong because Amazon Athena is for querying data in S3, not real-time streaming. Option D is wrong because Kinesis Data Analytics is for streaming data but requires a Kinesis stream; it is not directly integrated with CloudWatch Logs as a destination. Option E is wrong because AWS Glue is a batch ETL service, not for real-time.

Answer

Amazon Kinesis Data Analytics

Answer

AWS Glue

Answer

Amazon Athena

Question 11

A security engineer needs to monitor for suspicious API calls in near real-time and trigger an automated response. Which AWS service should be used to capture and analyze these API calls?

Accepted Answer

AWS CloudTrail. Option B is correct because AWS CloudTrail records API calls and can deliver events to CloudWatch Logs for near real-time analysis. Option A is wrong because AWS Config monitors resource configurations, not API calls. Option C is wrong because Amazon GuardDuty is a threat detection service that uses various data sources, but it does not directly capture API calls for custom analysis. Option D is wrong because AWS CloudHSM is a hardware security module, not a logging service.

Answer

AWS CloudHSM

Answer

Amazon GuardDuty

Answer

AWS Config

Question 12

A company uses AWS Organizations with multiple accounts. The security team wants to centralize security logs (CloudTrail, VPC Flow Logs, AWS Config) from all accounts into a single S3 bucket for analysis. What is the MOST secure way to set up this centralized logging?

Accepted Answer

Create a dedicated S3 bucket in the security account with a bucket policy that grants write access to the logging services of all accounts and enforces encryption in transit and at rest.. Option D is correct because using a centralized S3 bucket with a bucket policy that grants cross-account access and enforces encryption is secure and auditable. Option A is wrong because using the same bucket used for other purposes may break the principle of least privilege and increase risk. Option B is wrong because creating individual buckets for each account defeats centralization. Option C is wrong because enabling S3 default encryption on a bucket that already receives logs via cross-account policies is not sufficient; the bucket policy must explicitly grant permissions.

Answer

Create a dedicated S3 bucket in the management account, enable S3 default encryption, and configure service delivery for each account.

Answer

Configure each account to deliver logs to the same S3 bucket used for other data.

Answer

Create an S3 bucket in each account and use S3 replication to copy logs to a central bucket.

Question 13

A company is using Amazon CloudWatch Logs to store application logs. The security team needs to retain logs for 7 years to comply with regulatory requirements. The logs are accessed infrequently after the first 90 days. What is the MOST cost-effective way to meet these retention and access requirements?

Accepted Answer

Export logs from CloudWatch Logs to an S3 bucket, then use S3 Lifecycle policies to transition logs to S3 Glacier Deep Archive after 90 days.. Option A is correct because exporting logs to S3 and using S3 Lifecycle policies to transition to Glacier Deep Archive provides long-term retention at low cost. Option B is wrong because CloudWatch Logs does not support lifecycle policies to Glacier, only to S3. Option C is wrong because CloudWatch Logs Insights is not designed for long-term archival storage. Option D is wrong because S3 Standard-IA is not cost-effective for 7 years of infrequently accessed data; Glacier Deep Archive is cheaper.

Answer

Stream logs to an S3 bucket using Kinesis, then use S3 Lifecycle policies to transition logs to S3 Standard-IA after 90 days.

Answer

Set a retention policy on the CloudWatch Logs log group to 7 years and use CloudWatch Logs Insights for queries.

Answer

Set a retention policy on the CloudWatch Logs log group to 7 years and use CloudWatch Logs lifecycle policies to transition to Amazon S3 Glacier.

Question 14

A security engineer is troubleshooting an issue where Amazon GuardDuty is not generating findings for a specific EC2 instance that is known to be compromised. The instance is in a VPC with VPC Flow Logs enabled. What could be the reason for the lack of findings?

Accepted Answer

VPC Flow Logs are not being delivered to CloudWatch Logs.. Option C is correct because GuardDuty requires VPC Flow Logs to be enabled and delivered to CloudWatch Logs to analyze network traffic. Option A is wrong because CloudTrail logs management events, not network traffic. Option B is wrong because subnet flow logs are not a concept; flow logs are at the VPC, subnet, or ENI level. Option D is wrong because GuardDuty does not require AWS Config to be enabled.

Answer

CloudTrail is not enabled in the account.

Answer

AWS Config is not enabled for the EC2 instance.

Answer

VPC Flow Logs are only enabled for the subnet, not the instance's ENI.

Question 15

A company uses Amazon S3 to store sensitive data. The security team needs to be alerted when an S3 bucket policy is changed to allow public access. Which combination of services should be used to meet this requirement?

Accepted Answer

AWS Config with AWS Lambda and Amazon Simple Notification Service (SNS). Option B is correct because AWS Config records S3 bucket policy changes and can trigger a Lambda function via Amazon EventBridge to send alerts. Option A is wrong because CloudTrail alone does not trigger alerts; it logs events but requires further processing. Option C is wrong because AWS Trusted Advisor provides security checks but does not monitor for real-time changes. Option D is wrong because S3 server access logs do not include bucket policy changes.

Answer

AWS CloudTrail and Amazon Simple Notification Service (SNS)

Answer

S3 server access logs and Amazon Athena

Answer

AWS Trusted Advisor and Amazon Simple Notification Service (SNS)

SCS-C02 Practice Test 18 — 15 Questions

Exhibit

SCS-C02 Practice Test 18 — 15 Questions

Exhibit