SCS-C02 Practice Test 19 — 15 Questions

Question 1

During an incident response, a security engineer needs to capture a memory image of a compromised Amazon EC2 instance running Linux. The instance is in a production Auto Scaling group. Which approach is BEST?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Detach the instance from the Auto Scaling group, isolate it by changing security groups, and use AWS Systems Manager Run Command to execute a memory acquisition tool.. It preserves the volatile memory evidence by detaching the instance from the Auto Scaling group (preventing replacement) and isolating it via security group changes, then using AWS Systems Manager Run Command to execute a memory acquisition tool like LiME or AVML. This approach captures the memory image without shutting down the instance, which would destroy the evidence, and avoids the risk of the Auto Scaling group automatically terminating or replacing the instance during the investigation.

Answer

Use AWS CloudFormation to create a new stack with a forensic instance and copy the compromised instance's data.

Answer

Terminate the instance immediately to prevent further damage and launch a replacement.

Answer

Take a snapshot of the EBS volumes and attach them to a forensic instance to analyze memory.

Question 2

During incident response, a security engineer needs to preserve the state of a running EC2 instance for forensic analysis without losing volatile data. The instance is in an Auto Scaling group. Which action should the engineer take FIRST?

Accepted Answer

Suspend the `HealthCheck` and `ReplaceUnhealthy` processes on the Auto Scaling group.. Suspending the `HealthCheck` and `ReplaceUnhealthy` processes on the Auto Scaling group prevents the group from detecting the instance as unhealthy and terminating it while the engineer preserves volatile data. This is the first step to ensure the instance remains running and accessible for forensic collection (e.g., memory dump) before any other actions that could alter its state.

Answer

Detach the instance from the Auto Scaling group.

Answer

Stop the instance to preserve its EBS volumes.

Answer

Take an AMI of the instance immediately.

Question 3

A company needs to ensure that data in transit between an EC2 instance and an RDS database is encrypted. Which solution meets this requirement?

Accepted Answer

Enable SSL/TLS on the database connection. SSL/TLS is the appropriate solution to encrypt data in transit between the EC2 instance and the RDS database. It ensures that data is encrypted during transmission, preventing eavesdropping or tampering. Option A is incorrect because a VPN connection encrypts traffic between networks but is unnecessary for direct connectivity within the same VPC; SSL/TLS is more straightforward. Option B is incorrect because encryption at rest protects data stored on disk, not data in motion. Option D is incorrect because client-side encryption would require modifying the application to encrypt data before sending, which does not guarantee encryption of the entire communication channel.

Answer

Use a VPN connection between the VPC and the database

Answer

Enable encryption at rest on the RDS instance

Answer

Use client-side encryption on the application

Question 4

A company wants to restrict access to an S3 bucket so that only traffic from a specific VPC can read objects. Which security mechanism should be used?

Accepted Answer

Use an S3 bucket policy with a condition that restricts access to the VPC endpoint ID.. An S3 bucket policy can include a condition that restricts access to traffic originating from a specific VPC endpoint. By using the `aws:SourceVpce` condition key, the policy ensures that only requests coming through the specified VPC endpoint (interface or gateway) are allowed to read objects, effectively locking down access to the VPC.

Answer

Assign an IAM role to the S3 bucket.

Answer

Attach a security group to the S3 bucket.

Answer

Configure a network ACL on the VPC subnet to allow traffic to S3.

Question 5

Drag and drop the steps to implement a secure CI/CD pipeline with AWS CodePipeline and IAM in the correct order.

Accepted Answer

First, create IAM roles with least privilege for CodePipeline and CodeBuild. Then, create an encrypted S3 bucket for storing artifacts. Next, create a source repository (e.g., AWS CodeCommit). After that, create a build project configured with security scanning tools. Finally, create the CodePipeline that integrates the source, build, and deployment stages.. Secure pipeline requires encrypted artifact bucket, IAM roles, source repo, build project with security scanning, and pipeline.

Answer

First, create an encrypted S3 bucket. Then, create a source repository. Next, create IAM roles. After that, create a build project with security scanning. Finally, create the pipeline.

Answer

First, create the pipeline. Then, create a source repository. Next, create a build project with security scanning. After that, create IAM roles. Finally, create an encrypted S3 bucket.

Answer

First, create a source repository. Then, create a build project with security scanning. Next, create IAM roles. After that, create the pipeline. Finally, create an encrypted S3 bucket.

Question 6

A security engineer is troubleshooting why CloudTrail logs are not being delivered to an S3 bucket. The bucket policy allows CloudTrail to write objects, and the trail is configured to log management events. However, no log files appear in the bucket. What is the MOST likely cause?

Accepted Answer

The S3 bucket uses SSE-KMS encryption and the trail does not have permission to use the KMS key.. When an S3 bucket uses SSE-KMS encryption, CloudTrail requires explicit permission to use the KMS key for encrypting log files. Even if the bucket policy allows CloudTrail to write objects, the trail will fail to deliver logs if the KMS key policy does not grant the `kms:GenerateDataKey` and `kms:Decrypt` actions to the CloudTrail service principal. This is the most likely cause because the bucket policy appears correct, but the KMS key permissions are missing.

Answer

The trail is not logging data events.

Answer

The S3 bucket is in a different AWS account.

Answer

The bucket policy is missing a Deny statement.

Question 7

A security engineer needs to ensure that all API calls in an AWS account are logged and that the logs are encrypted at rest and retained for at least 7 years. Which THREE steps should the engineer take? (Choose THREE.)

Accepted Answer

Set an S3 lifecycle policy to transition logs to Glacier after 7 years.. To ensure all API calls are logged, encrypted at rest, and retained for at least 7 years, the correct steps are: E. Enable CloudTrail in the account to capture API calls; D. Enable S3 default encryption on the log bucket to encrypt logs at rest; and B. Set an S3 lifecycle policy to transition logs to Glacier after 7 years for long-term retention. Option A is incorrect because CloudTrail cannot deliver logs directly to Glacier; it delivers to an S3 bucket first. Option C is incorrect because Cross-Region Replication helps with geographic redundancy but does not address retention or encryption.

Answer

Configure CloudTrail to deliver logs to Amazon S3 Glacier.

Answer

Enable S3 Cross-Region Replication to a bucket in another region.

Question 8

A company wants to restrict access to an S3 bucket so that only traffic from a specific VPC can read objects. The VPC has a VPC endpoint for S3 configured. Which policy should be attached to the bucket?

Accepted Answer

{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringEquals":{"aws:SourceVpce":"vpce-11111111"}}}. It uses the `aws:SourceVpce` condition key to restrict access to the S3 bucket exclusively to requests originating from the specified VPC endpoint (vpce-11111111). This ensures that only traffic routed through that VPC endpoint, which is attached to the specific VPC, can perform `s3:GetObject` actions, effectively limiting access to the VPC's private network.

Answer

{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringEquals":{"aws:VpcSourceIp":"10.0.0.0/16"}}}

Answer

{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringEquals":{"aws:SourceVpc":"vpc-12345678"}}}

Answer

{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"IpAddress":{"aws:SourceIp":"10.0.0.0/16"}}}

Question 9

An IAM user receives an 'AccessDenied' error when trying to list objects in an S3 bucket. The user has the following policy attached: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::example-bucket"}]}. What is the most likely reason?

Accepted Answer

The bucket policy explicitly denies the action. The IAM policy grants the s3:ListBucket action on the bucket, which should allow listing objects. However, an explicit deny in a bucket policy overrides any allow, including those from IAM policies. Since the user receives an 'AccessDenied' error, the most likely cause is that the bucket policy explicitly denies the s3:ListBucket action for this user, as explicit denies take precedence over all allows.

Answer

The policy is missing a condition

Answer

The policy does not include s3:GetObject

Answer

The policy has a syntax error

Question 10

A company is using AWS CloudTrail to monitor API activity in its AWS account. The security team needs to be alerted when unauthorized API calls are made to delete Amazon S3 buckets. Which TWO steps should the security team take to meet this requirement? (Choose TWO.)

Accepted Answer

Configure CloudTrail to deliver logs to Amazon CloudWatch Logs and create a metric filter for the DeleteBucket API call.. CloudTrail can be configured to deliver logs to Amazon CloudWatch Logs, and a metric filter can be created to match the `DeleteBucket` API call. This metric can then trigger an alarm that sends an SNS notification, alerting the security team to unauthorized API calls. Option E is correct because Amazon CloudWatch Events (now Amazon EventBridge) can directly match the `DeleteBucket` API call from CloudTrail and trigger an SNS notification without needing a metric filter or alarm.

Answer

Enable Amazon VPC Flow Logs to capture API calls and use Amazon Athena to query for DeleteBucket events.

Answer

Create an AWS CloudTrail trail that monitors Amazon CloudWatch Logs for DeleteBucket API calls.

Answer

Create an AWS Config rule to detect DeleteBucket API calls and send an SNS notification.

Question 11

A security team is reviewing IAM roles and policies. They want to ensure that any new IAM role created in the account must include a specific managed policy (e.g., SecurityAudit). What AWS service can enforce this requirement?

Accepted Answer

Service control policy (SCP) in AWS Organizations. AWS CloudTrail logs API calls but does not enforce policies. Option B is incorrect because AWS Config rules can detect noncompliant roles after creation but cannot prevent their creation. Option C is correct because Service Control Policies (SCPs) in AWS Organizations can deny the creation of IAM roles that do not have a specific managed policy attached, using a condition like `aws:RequestedManagedPolicy`. Option D is incorrect because IAM permissions boundaries limit the maximum permissions a role can have but do not enforce attachment of a specific managed policy.

Answer

AWS CloudTrail

Answer

AWS Config rules

Answer

IAM permissions boundary

Question 12

A security engineer is investigating an IAM role that was used to access AWS resources from an external account. The role has a trust policy that allows the external account to assume it. Which of the following is a required step for the external account to use the role?

Accepted Answer

Attach an IAM policy to an IAM user in the external account that allows sts:AssumeRole for the role ARN.. To assume a role in another AWS account, the external account must have an IAM user or role with permissions to call the sts:AssumeRole API for the target role ARN. Option D correctly describes this requirement. Option A is incorrect because MFA is not a required step unless specified in the role's trust policy. Option B is incorrect because the external account does not need to create a new role; it only needs a principal (user or role) with the appropriate permissions. Option C is incorrect because the trust policy is attached to the role in the target account, not the external account.

Answer

Configure the role to require MFA for the external account.

Answer

Create a new IAM role in the external account with a trust policy allowing the role's ARN.

Answer

Add the external account's root user ARN to the role's trust policy.

Question 13

Match each AWS VPC flow log type to its description.

Accepted Answer

VPC flow logs: Captures network traffic to and from all network interfaces in a VPC. AWS VPC flow logs can be created at three levels: VPC (captures traffic for all interfaces in the VPC), subnet (captures traffic for interfaces in a specific subnet), and ENI (captures traffic for a single elastic network interface). Common confusions include mistaking the scope of each log type.

Answer

VPC flow logs: Captures network traffic for a specific subnet only

Answer

Subnet flow logs: Captures network traffic for a specific ENI only

Question 14

A company wants to ensure that all API calls made to their AWS account are logged and immutable. They have enabled AWS CloudTrail and are delivering logs to an S3 bucket. The security team requires that logs cannot be deleted or modified by anyone, including the root user. What should they do?

Accepted Answer

Enable S3 Object Lock with Compliance retention mode on the bucket.. S3 Object Lock with retention mode Compliance prevents any user, including root, from deleting or overwriting objects. Option B is wrong because MFA Delete prevents deletion but requires additional authentication and can be disabled by root if they have MFA. Option C is wrong because versioning alone does not prevent deletion of versions; objects can still be deleted, though old versions are retained. Option D is wrong because bucket policies can be changed by root, so a deny policy is not immutable.

Answer

Enable MFA Delete on the S3 bucket.

Answer

Enable S3 Versioning on the bucket.

Answer

Add a bucket policy that denies s3:DeleteObject for all principals.

Question 15

A company is implementing a data protection strategy for its Amazon S3 bucket that contains sensitive data. The company requires that all objects be encrypted at rest using server-side encryption with a customer managed key (SSE-KMS). Additionally, the company wants to ensure that only a specific IAM role can decrypt objects. Which THREE actions should the company take?

Accepted Answer

Attach an IAM policy to the specific role that grants kms:Decrypt on the customer managed key. To enforce SSE-KMS, use a bucket policy that denies s3:PutObject unless the request includes the x-amz-server-side-encryption header with value aws:kms (option B). To control decryption, grant kms:Decrypt to the specific role via an IAM policy (option A) and modify the KMS key policy to allow that role (option D). Option C is incorrect because SSE-S3 does not use a customer managed key. Option E is incorrect because client-side encryption is not S3 server-side encryption.

Answer

Use the default S3-managed key (SSE-S3) for encryption

Answer

Use client-side encryption with a customer managed key