SCS-C02 Practice Test 19 — 15 Questions

Question 1

A company uses AWS CloudFormation to deploy infrastructure. The security team wants to ensure that no sensitive data, such as database passwords, is exposed in plaintext in the CloudFormation templates. What is the MOST secure way to handle secrets?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS Systems Manager Parameter Store or AWS Secrets Manager with dynamic references in the template.. AWS Systems Manager Parameter Store and AWS Secrets Manager support dynamic references in CloudFormation templates, allowing you to reference secret values without exposing them in plaintext. CloudFormation resolves these references at deployment time, retrieving the actual secret value from the secure store, and never stores the secret in the template or stack metadata. This approach ensures secrets are managed, rotated, and audited centrally, adhering to security best practices.

Answer

Use AWS KMS to encrypt the secrets and include the ciphertext in the template.

Answer

Store the secrets in an encrypted S3 bucket and include the S3 URL in the template.

Answer

Pass the secrets as plaintext parameters to the stack at launch time.

Question 2

During an incident response, a security engineer needs to collect volatile memory from a compromised EC2 instance without affecting the running system. The instance is critical and cannot be stopped. Which approach is most appropriate?

Accepted Answer

Use AWS Systems Manager Run Command to execute a memory capture utility.. AWS Systems Manager Run Command allows you to execute a memory capture utility (such as WinPmem or LiME) on the EC2 instance without stopping it, preserving volatile memory for forensic analysis. This approach uses the SSM Agent to run commands remotely, minimizing impact on the running system while collecting critical evidence like running processes, network connections, and kernel data.

Answer

Stop the instance, detach the root volume, and attach it to a forensics instance for analysis.

Answer

Use AWS License Manager to create a snapshot of the instance memory.

Answer

Use Amazon EC2 Rescue to collect memory dump.

Question 3

A security engineer is investigating a potential compromise of an S3 bucket. The engineer needs to determine if any objects were accessed by an unauthorized user. Which AWS service can provide detailed access logs for S3 objects?

Accepted Answer

S3 server access logs. S3 server access logs provide detailed records of requests made to an S3 bucket, including the requester, bucket name, request time, action, and response status. This granularity is essential for identifying unauthorized access to specific objects, as it logs every GET, PUT, DELETE, and HEAD request at the object level. AWS CloudTrail, while useful for management events, does not log data-level operations like object reads by default unless data events are explicitly enabled, and even then, it may not capture all object-level access details as comprehensively as server access logs.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon Inspector

Question 4

A security engineer needs to ensure that an Amazon S3 bucket blocks all public access. Which S3 block public access settings should be enabled?

Accepted Answer

Block all public access. The 'Block all public access' setting in Amazon S3 is a single toggle that simultaneously enables all four individual block public access settings, ensuring that no public access is allowed through any mechanism—bucket policies, ACLs, or otherwise. This is the only setting that comprehensively blocks all public access to the S3 bucket and its objects, as required by the security engineer's goal.

Answer

Block public access to buckets and objects granted through new public bucket policies

Answer

Block public access to buckets and objects granted through new access control lists (ACLs)

Answer

Block public access to buckets and objects granted through any access control lists (ACLs)

Question 5

A security engineer needs to detect and respond to malware on an EC2 instance. Which TWO AWS services can be used together to achieve this? (Choose TWO.)

Accepted Answer

AWS Lambda. AWS Lambda is correct because it can be used as a serverless compute target to automate incident response actions when malware is detected. For example, a Lambda function can be triggered by a GuardDuty finding to isolate the compromised EC2 instance by modifying security group rules or detaching the instance from an Auto Scaling group, enabling rapid, automated remediation without manual intervention.

Answer

Amazon Inspector

Answer

Amazon CloudWatch

Answer

AWS WAF

Question 6

Refer to the exhibit. A security engineer runs the command above and sees that the flow log status is ACTIVE. However, the engineer notices that no logs are appearing in the CloudWatch log group. What is the most likely cause?

Accepted Answer

The IAM role specified in DeliverLogsPermissionArn does not have permissions to PutLogEvents.. The most likely cause is that the IAM role specified in the DeliverLogsPermissionArn does not have the necessary permissions to call PutLogEvents on the CloudWatch Logs log group. Even if the flow log status is ACTIVE, the delivery of log records will silently fail if the role lacks the required logs:PutLogEvents, logs:CreateLogStream, and logs:DescribeLogStreams actions. The ACTIVE status only indicates that the flow log configuration is valid and the service is attempting to deliver logs, not that delivery is succeeding.

Answer

The TrafficType is set to ALL, which captures too much data and causes throttling.

Answer

The flow log is attached to an ENI instead of a subnet.

Answer

The flow log destination is set to CloudWatch Logs but the log group is encrypted with KMS.

Question 7

A security team wants to implement a centralized logging solution for multiple AWS accounts. The team needs to collect VPC Flow Logs, CloudTrail logs, and DNS query logs from all accounts. Which THREE services should the team use to aggregate these logs? (Choose THREE.)

Accepted Answer

Amazon Route 53 Resolver query logging. Amazon Route 53 Resolver query logging (C) is correct because it captures DNS queries made by resources within a VPC, including queries to the Resolver, and can publish those logs to CloudWatch Logs, S3, or Kinesis Data Firehose for centralization. AWS CloudTrail (D) is correct because it records API activity and account events across accounts, and with an organization trail you can aggregate CloudTrail logs from all accounts into a single S3 bucket. VPC Flow Logs (E) is correct because it captures IP traffic metadata for network interfaces in a VPC and can deliver logs to CloudWatch Logs or S3, enabling centralized collection across accounts. AWS CloudHSM (A) is not a logging service; it provides dedicated hardware security modules for cryptographic key operations. AWS Config (B) tracks resource configuration changes and compliance, not VPC Flow Logs, CloudTrail events, or DNS query logs, so it does not fulfill the aggregation requirement.

Answer

AWS CloudHSM

Answer

AWS Config

Question 8

A company wants to allow users from an external AWS account to assume a role in the company's account. What must be configured in the company's account?

Accepted Answer

A trust policy that allows the external account to assume the role.. Cross-account IAM role access requires the role in the company's account to have a trust policy that explicitly grants the external AWS account's root user or specific IAM entities permission to assume the role. The trust policy uses the `sts:AssumeRole` action and specifies the external account ID as the `Principal`, which establishes the trust relationship necessary for the external account to request temporary security credentials via AWS STS.

Answer

An IAM user in the company's account with cross-account access.

Answer

A permissions policy that allows the external account to list roles.

Answer

An IAM identity provider for the external account.

Question 9

A company has a requirement to retain CloudTrail logs for 7 years to meet regulatory compliance. They want to minimize storage costs while ensuring logs are immutable and cannot be deleted by anyone, including the root user. What should they do?

Accepted Answer

Enable S3 Object Lock in Compliance mode on the destination bucket.. S3 Object Lock in Compliance mode prevents any user, including the root user, from deleting or overwriting objects for the specified retention period. This meets the immutability and retention requirements for CloudTrail logs, and by using S3 lifecycle policies to transition logs to lower-cost storage classes (e.g., S3 Glacier Deep Archive) after the initial retention period, storage costs can be minimized while maintaining compliance.

Answer

Configure the S3 bucket with MFA Delete enabled.

Answer

Use CloudTrail log file validation and enable AWS CloudTrail Insights.

Answer

Store the logs in Amazon S3 Glacier Deep Archive with a vault lock policy.

Question 10

A company wants to allow its users to assume an IAM role in a different AWS account. What must the company configure to enable cross-account access?

Accepted Answer

In the target account, create an IAM role with a trust policy that allows the source account, and attach a permissions policy to that role. In the source account, allow users to call sts:AssumeRole.. Cross-account access requires creating an IAM role in the target account with a trust policy that specifies the source account as a trusted entity, and attaching a permissions policy that defines what actions the role can perform. The source account must then have a policy that allows its users to call sts:AssumeRole for that role. Option A is incorrect because S3 bucket policies are used for resource-based access, not for role assumption. Option C is incorrect because sharing access keys violates security best practices and does not provide the controlled, temporary access that IAM roles offer. Option D is incorrect because trust policies are attached to roles, not IAM groups.

Answer

In the source account, create an S3 bucket policy that allows access from the target account.

Answer

In the target account, create an IAM user and share the access keys securely with the source account users.

Answer

In the target account, attach a trust policy to an IAM group that allows the source account.

Question 11

Which TWO steps are part of the forensic acquisition process for an EC2 instance suspected of being compromised?

Accepted Answer

Capture the instance's memory using a forensic tool.. Capturing the instance's memory using a forensic tool (such as LiME or F-Response) preserves volatile data—including running processes, network connections, and encryption keys—that would be lost if the instance were stopped or terminated. This is a critical step in the forensic acquisition process to gather evidence of compromise without altering the system state.

Answer

Stop the instance immediately to prevent further damage.

Answer

Enable termination protection on the instance.

Answer

Terminate the instance to ensure the threat is contained.

Question 12

A company uses AWS Organizations with multiple accounts. The security team wants to centrally monitor and analyze all CloudTrail logs from all accounts. The logs must be stored in a centralized S3 bucket with encryption and access logging enabled. Additionally, the team needs to detect anomalous API activity across accounts using machine learning. Which combination of services meets these requirements?

Accepted Answer

AWS CloudTrail to deliver logs to a centralized S3 bucket with default encryption and S3 server access logs; Amazon GuardDuty enabled in all accounts.. It combines AWS CloudTrail for centralized log delivery to an S3 bucket with default encryption and server access logs, and Amazon GuardDuty, which uses machine learning to detect anomalous API activity across accounts. GuardDuty analyzes CloudTrail management events, VPC flow logs, and DNS logs to identify suspicious behavior, meeting the requirement for ML-based anomaly detection.

Answer

AWS CloudTrail to deliver logs to a centralized S3 bucket with default encryption; AWS Config to monitor API activity; S3 server access logs enabled.

Answer

AWS CloudTrail to deliver logs to a centralized S3 bucket with default encryption; Amazon Macie to detect anomalous API activity; S3 server access logs enabled.

Answer

AWS CloudTrail to deliver logs to a centralized S3 bucket with default encryption; Amazon Detective to analyze API activity; S3 server access logs enabled.

Question 13

A company uses AWS KMS to encrypt data at rest in Amazon S3. The security team requires that all encryption keys be automatically rotated every year. Which solution meets this requirement?

Accepted Answer

Use a customer managed key and enable automatic rotation with a yearly rotation period.. Customer managed keys (CMKs) in AWS KMS support automatic rotation with a customizable rotation period, which can be set to 365 days (one year) to meet the security team's requirement. AWS managed keys, on the other hand, have a fixed automatic rotation period of every three years (1095 days) and cannot be adjusted, making them unsuitable for a yearly rotation mandate. By using a CMK with automatic rotation enabled and specifying a rotation period of one year, the company ensures that the encryption key material is rotated annually without manual intervention.

Answer

Use an AWS managed key and enable automatic rotation.

Answer

Use a customer managed key with imported key material and enable automatic rotation.

Answer

Use an AWS managed key and manually rotate it every year.

Question 14

A company is using AWS CloudTrail and wants to detect when an IAM user performs a specific action, such as stopping an EC2 instance. The security engineer needs to set up a real-time notification. Which THREE steps should the engineer take? (Choose THREE.)

Accepted Answer

Create a metric filter in CloudWatch Logs to match the StopInstances event. A metric filter in CloudWatch Logs can parse CloudTrail log events for the 'StopInstances' API call and convert it into a CloudWatch metric. This metric can then trigger an alarm for real-time notification, enabling the security engineer to detect the specific action as required.

Answer

Use Amazon QuickSight to visualize CloudTrail logs

Answer

Use Amazon Athena to query CloudTrail logs in S3

Question 15

A company uses AWS Organizations with many accounts. The security team wants to ensure that no account can disable AWS CloudTrail or stop logging. Which configuration should be used?

Accepted Answer

Apply an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail.. Service Control Policies (SCPs) in AWS Organizations are the only mechanism that can enforce a hard deny across all accounts in an organization, preventing even account root users from performing specified actions. By applying an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail, the security team ensures no account can disable or delete CloudTrail trails, regardless of IAM permissions within the account. SCPs define the maximum available permissions for accounts in the organization.

Answer

Enable CloudTrail log file validation.

Answer

Attach an IAM policy to the root user in each account.

Answer

Use AWS Config rules to detect and alert when CloudTrail is modified.