SCS-C02 Practice Test 18 — 15 Questions

Question 1

A company uses AWS Organizations and wants to ensure that no member account can disable AWS CloudTrail or delete CloudTrail log files from S3. Which TWO actions should the security team take? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail.. Option A is correct because an AWS Organizations service control policy (SCP) attached to member accounts can explicitly deny the CloudTrail control-plane actions cloudtrail:StopLogging and cloudtrail:DeleteTrail, which are exactly the API calls used to disable a trail, and SCPs are the standard guardrail mechanism for enforcing such restrictions across all accounts in the organization. Option D is correct because a bucket policy on the CloudTrail log bucket that denies s3:DeleteObject (and ideally s3:DeleteObjectVersion) prevents any principal, including account administrators, from deleting the log objects, directly satisfying the requirement to protect the log files. Option B is not correct because MFA Delete only requires additional authentication for deleting object versions; it does not by itself prevent deletion and is not the SCP/bucket-policy guardrail the scenario requires. Option C is not correct because SCPs do not apply to the management account, so applying one there would not prevent disabling CloudTrail in member accounts. Option E is not correct because an IAM role granting write-only permissions to CloudTrail does not stop member accounts from calling StopLogging/DeleteTrail or deleting S3 log objects.

Answer

Enable MFA delete on the S3 bucket that stores CloudTrail logs.

Answer

Apply an SCP to the management account to prevent disabling CloudTrail.

Answer

Create an IAM role for CloudTrail with permissions to write logs only.

Question 2

A company wants to use AWS services to detect and respond to a potential DDoS attack on their web application hosted on EC2 instances behind an Application Load Balancer (ALB). Which TWO AWS services should the company use for detection and mitigation?

Accepted Answer

AWS WAF. AWS WAF is correct because it allows you to create web access control lists (web ACLs) to filter and monitor HTTP/HTTPS requests to your Application Load Balancer. By defining rate-based rules, you can automatically block IP addresses that exceed a threshold of requests per 5-minute window, mitigating layer 7 DDoS attacks such as HTTP floods or SQL injection attempts.

Answer

Amazon Route 53

Answer

Amazon CloudFront

Answer

Amazon GuardDuty

Question 3

A company is using Amazon GuardDuty to monitor for malicious activity. The security team wants to automatically isolate an EC2 instance that is flagged for outbound communication with a known malicious IP address. Which approach is the most efficient and scalable?

Accepted Answer

Use Amazon EventBridge to invoke an AWS Lambda function that modifies the instance's security group.. Amazon EventBridge can directly capture GuardDuty findings as events and trigger an AWS Lambda function to modify the instance's security group, revoking outbound access to the malicious IP. This approach is event-driven, serverless, and scales automatically without polling or manual intervention, making it the most efficient and scalable solution.

Answer

Use a CloudWatch Alarm to directly invoke a Lambda function to isolate the instance.

Answer

Use AWS Config to automatically terminate the instance when a GuardDuty finding is reported.

Answer

Create a CloudWatch alarm on GuardDuty findings and modify the subnet's network ACL to block the traffic.

Question 4

A security engineer is investigating a potential security incident involving an EC2 instance. The engineer needs to capture network traffic to and from the instance for analysis. Which method should be used to capture this traffic without installing any software on the instance?

Accepted Answer

Use VPC Traffic Mirroring.. VPC Traffic Mirroring captures and inspects network traffic at the Elastic Network Interface (ENI) level without requiring any software installation on the EC2 instance. It copies traffic from a source ENI to a target, such as a Network Load Balancer or another ENI, for analysis by security appliances. This meets the requirement of capturing traffic without installing software on the instance.

Answer

Enable VPC Flow Logs for the subnet.

Answer

Configure AWS Network Firewall in the VPC.

Answer

Install the Amazon CloudWatch agent on the instance.

Question 5

A company wants to centrally manage and enforce backup policies for all EC2 instances across multiple AWS accounts. Which AWS service should be used?

Accepted Answer

AWS Backup. AWS Backup is the correct service because it provides a centralized, policy-based solution to define and enforce backup policies across multiple AWS accounts and regions. It integrates with AWS Organizations to manage backups for EC2 instances and other supported resources, ensuring compliance with governance requirements without needing custom scripts or manual processes.

Answer

AWS Config

Answer

AWS CloudFormation StackSets

Answer

AWS Systems Manager

Question 6

Which THREE are best practices for securing IAM in an AWS environment? (Choose THREE.)

Accepted Answer

Use IAM roles for applications running on EC2.. Using IAM roles for EC2 instances eliminates the need to store long-term AWS credentials (access keys) on the instance. Instead, the instance assumes the role via the EC2 metadata service, which automatically rotates temporary security credentials (via AWS STS). This follows the principle of least privilege and reduces the risk of credential leakage.

Answer

Use the AWS account root user for daily administrative tasks.

Answer

Grant broad permissions to simplify management.

Question 7

A security engineer discovers that an IAM policy allows 'iam:CreateUser' and 'iam:CreateAccessKey' for all users in the account. Which risk does this pose?

Accepted Answer

Users can create new IAM users and programmatic access keys. The IAM policy allows 'iam:CreateUser' and 'iam:CreateAccessKey', which enables users to create new IAM users and programmatic access keys, leading to unauthorized access and privilege escalation. Option B is incorrect because the policy does not grant permissions to disable CloudTrail logging. Option C is incorrect because creating users/keys does not allow decrypting data in S3. Option D is incorrect because it does not allow modifying VPC security groups.

Answer

Users can disable CloudTrail logging

Answer

Users can decrypt data in S3

Answer

Users can modify VPC security groups

Question 8

A company uses Amazon CloudFront to distribute content from an S3 bucket. The security team wants to ensure that only CloudFront can access the S3 bucket. Which configuration should be used?

Accepted Answer

Create an Origin Access Identity (OAI) and grant it read access to the S3 bucket.. An Origin Access Identity (OAI) is a special CloudFront user that you can associate with a distribution, and then the S3 bucket policy can grant read access to that OAI, ensuring that only CloudFront can access the bucket. Option A is incorrect because allowing all principals is too permissive. Option B is incorrect because CloudFront IP addresses can change, so this is not a reliable method. Option D is incorrect because trusted signers are used for signed URLs/cookies to control who can access content, not to restrict origin access.

Answer

Set the bucket policy to allow all principals and rely on CloudFront to restrict access.

Answer

Configure the bucket policy to allow access only from CloudFront's IP addresses.

Answer

Use CloudFront trusted signers to restrict access to the S3 bucket.

Question 9

A company stores sensitive customer data in Amazon S3. They want to ensure that all objects are encrypted at rest using server-side encryption with AWS KMS. Which S3 bucket policy statement should be added to deny uploads that do not request SSE-KMS?

Accepted Answer

Deny PutObject unless 's3:x-amz-server-side-encryption' is 'aws:kms'. The condition 's3:x-amz-server-side-encryption' with value 'aws:kms' enforces that objects are uploaded with SSE-KMS. Option A is incorrect because 'AES256' enforces SSE-S3, not SSE-KMS. Option C is incorrect because 'aws:SourceArn' is used for cross-account access, not encryption enforcement. Option D is incorrect because requiring the specific KMS key ID is too restrictive; the policy should only require the encryption type, not a particular key.

Answer

Deny PutObject unless 's3:x-amz-server-side-encryption' is 'AES256'

Answer

Deny PutObject unless 'aws:SourceArn' equals the bucket ARN

Answer

Deny PutObject unless 's3:x-amz-server-side-encryption-aws-kms-key-id' is present

Question 10

A company stores sensitive customer data in Amazon S3. The security team has enabled default encryption with SSE-S3 on the bucket. The compliance team requires that all access to the bucket be logged and that any unauthorized access attempts be detected in real time. The company has AWS CloudTrail enabled. Which additional steps should the security team take to meet the compliance requirements?

Accepted Answer

Enable S3 server access logs and enable Amazon GuardDuty with S3 protection. Enabling S3 server access logs captures all requests to the bucket, satisfying the logging requirement, and Amazon GuardDuty with S3 protection can detect suspicious activity in real time, meeting the requirement for real-time detection of unauthorized access. Option B is incorrect because AWS Config rules monitor configuration changes, not real-time threat detection. Option C is incorrect because CloudTrail data events can log S3 operations, but Amazon Detective is for post-incident analysis, not real-time detection. Option D is incorrect because VPC Flow Logs log network traffic, not S3 access, and Amazon Athena is a query service, not a real-time detection tool.

Answer

Enable AWS Config rules to detect unauthorized access

Answer

Enable CloudTrail data events for the S3 bucket and use Amazon Detective

Answer

Enable VPC Flow Logs and use Amazon Athena to analyze logs

Question 11

Refer to the exhibit. A security engineer runs the 'simulate-custom-policy' command to test a policy. The output shows 'explicitDeny' for ec2:RunInstances. What is the most likely reason?

Accepted Answer

The policy includes an explicit Deny statement for ec2:RunInstances. In AWS IAM policy evaluation, an explicit Deny statement always overrides any Allow. The simulate-custom-policy command returns 'explicitDeny' when the action is explicitly denied by a Deny statement in the policy. Therefore, the most likely reason is that the policy includes an explicit Deny for ec2:RunInstances.

Answer

The policy does not include ec2:RunInstances in the Action list

Answer

The policy allows ec2:Describe* but the action ec2:RunInstances is not a Describe action

Answer

The policy uses a Resource of '*' which does not include the required resources

Question 12

A company wants to use AWS CloudTrail to log all API activity across multiple accounts in AWS Organizations. Which configuration meets the requirement of centralized logging with minimal operational overhead?

Accepted Answer

Create an organization trail in the management account that applies to all accounts. Creating an organization trail in the management account automatically applies to all accounts in AWS Organizations, centralizing CloudTrail logs into a single S3 bucket without requiring per-account configuration. This approach minimizes operational overhead by leveraging the Organizations integration, which handles log delivery from member accounts transparently.

Answer

Create a CloudTrail trail in each account and aggregate logs to a common S3 bucket

Answer

Enable CloudTrail in each account and use cross-account roles to centralize logs

Answer

Use AWS Config to record API calls and send to CloudWatch Logs

Question 13

A security engineer needs to monitor for failed SSH login attempts to EC2 instances and send alerts. Which combination of AWS services should be used?

Accepted Answer

CloudWatch Logs agent on EC2, CloudWatch Logs metric filter, and CloudWatch Alarm.. The CloudWatch Logs agent on EC2 can stream SSH auth logs (e.g., /var/log/secure or /var/log/auth.log) to CloudWatch Logs. A metric filter can then parse these logs for failed SSH login patterns (e.g., 'Failed password'), and a CloudWatch Alarm can trigger an SNS notification or other action when the metric exceeds a threshold. This combination directly monitors OS-level authentication events, which is required for detecting failed SSH attempts.

Answer

VPC Flow Logs and Amazon Athena.

Answer

AWS CloudTrail and Amazon SNS.

Answer

Amazon S3 event notifications and AWS Lambda.

Question 14

Which TWO actions should a security engineer take to protect an Amazon EC2 instance from unauthorized access? (Choose two.)

Accepted Answer

Configure security groups to allow only necessary inbound traffic.. Security groups act as a virtual firewall for EC2 instances, controlling inbound and outbound traffic at the instance level. By configuring security groups to allow only necessary inbound traffic (Option C), you follow the principle of least privilege, reducing the attack surface. This is a fundamental security best practice for protecting EC2 instances from unauthorized access.

Answer

Place the instance in a public subnet and rely solely on security groups.

Answer

Disable termination protection so the instance can be easily terminated if compromised.

Answer

Enable detailed billing to monitor instance usage.

Question 15

A security engineer is configuring Amazon GuardDuty in a multi-account environment using AWS Organizations. The engineer wants to designate a delegated administrator account to manage GuardDuty for all member accounts. Which AWS service must be used to enable GuardDuty for all accounts?

Accepted Answer

AWS Organizations. AWS Organizations is the foundational service required to designate a delegated administrator for Amazon GuardDuty in a multi-account environment. GuardDuty integrates directly with Organizations to allow a management account to enable GuardDuty for all member accounts and delegate administration to a specified account, which then manages threat detection across the organization without needing additional services.

Answer

AWS CloudFormation StackSets

Answer

AWS Control Tower

Answer

AWS Config