SCS-C02 Practice Test 2 — 10 Questions

Question 1

A security engineer is reviewing the SQS queue policy shown in the exhibit. The queue is subscribed to an SNS topic in the same account. The security team has a requirement that only the SNS topic should be allowed to send messages to the queue. What is the issue with this policy?

Accepted Answer

The second statement allows any principal in the 10.0.0.0/8 range to receive messages from the queue.. Option A is correct because the second statement in the SQS queue policy allows any principal in the 10.0.0.0/8 IP range to receive messages from the queue, which violates the security requirement that only the SNS topic should be allowed to send messages. The policy should restrict the `sqs:SendMessage` action to the SNS topic using a condition like `aws:SourceArn` and should not include a broad `Effect: Allow` for `sqs:ReceiveMessage` without restricting the principal or source.

Answer

The policy does not specify a principal, so it will not work.

Answer

The aws:SourceArn condition uses ArnLike which is deprecated.

Answer

The aws:SourceIp condition cannot be used with SQS queue policies.

Question 2

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all IAM users in the production account must use multi-factor authentication (MFA) to access the AWS Management Console. Which combination of actions should the security team take to enforce this requirement?

Accepted Answer

Create an IAM policy that denies all console actions unless MFA is present. Attach the policy to the IAM group that contains all production users.. Option D is correct because an IAM policy with a condition that denies all console actions unless MFA is present can be attached to an IAM group containing all production users. This enforces MFA at the user level within the account, directly meeting the requirement to ensure all IAM users in the production account must use MFA to access the AWS Management Console.

Answer

Use an SCP to deny access to the AWS Management Console unless MFA is present. Attach the SCP to the production OU.

Answer

Disable password-based access for all IAM users and require federation with an identity provider that enforces MFA.

Answer

Enable MFA on the root user and apply a password policy that requires MFA.

Question 3

A developer is trying to upload an object to an S3 bucket named 'my-bucket' using the AWS CLI. The developer has an IAM user with a policy that includes 's3:PutObject' for 'arn:aws:s3:::my-bucket/*'. However, the upload fails with an 'Access Denied' error. The bucket policy is set to allow all principals from the same AWS account to perform 's3:PutObject'. What is the most likely cause of this failure?

Accepted Answer

The IAM policy grants 's3:PutObject' only on objects (/*), but the request may also require 's3:PutObject' on the bucket itself for some operations.. Option C is correct because the IAM policy grants 's3:PutObject' only on the bucket's object ARN (arn:aws:s3:::my-bucket/*), but certain S3 operations, such as multipart uploads initiated via the AWS CLI, may require the 's3:PutObject' permission on the bucket resource itself (arn:aws:s3:::my-bucket) to complete the upload. The bucket policy allows 's3:PutObject' for all principals in the same account, but the IAM user's policy is too restrictive, causing the 'Access Denied' error.

Answer

The IAM user is not authorized to perform 's3:PutObject' on the bucket 'my-bucket'.

Answer

The bucket policy denies access because the principal is not explicitly listed.

Answer

The bucket 'my-bucket' does not exist in the same region as the CLI request.

Question 4

A security administrator is designing a cross-account access strategy. The administrator needs to allow users in Account A to assume an IAM role in Account B to access an S3 bucket. Which TWO of the following statements are true regarding this configuration?

Accepted Answer

The IAM users in Account A must have an IAM policy that allows the sts:AssumeRole action for the role ARN in Account B.. Option A is correct because for an IAM user in Account A to assume a role in Account B, the user must be explicitly granted permission to call the sts:AssumeRole API action against the role's Amazon Resource Name (ARN). This is done by attaching an IAM policy to the user (or a group/role the user belongs to) that includes the sts:AssumeRole action and specifies the target role ARN as the resource. Without this permission, the user cannot initiate the cross-account role assumption, even if the role's trust policy allows it.

Answer

The trust policy for the role must be defined in Account A.

Answer

The S3 bucket policy must grant access to the IAM users in Account A.

Answer

The IAM users in Account A must have cross-account permissions on the S3 bucket in Account B.

Question 5

An IAM policy is attached to a user. The user is trying to change their own password in the IAM console but receives an 'Access Denied' error. The user has an MFA device configured and is logged in with MFA. Why is the password change failing?

Accepted Answer

The Deny statement uses 'BoolIfExists' which evaluates to true if the condition key is not present. In the IAM console, the 'aws:MultiFactorAuthPresent' key may not be set, causing the Deny to apply even when the user has MFA.. Option B is correct because the Deny statement uses the `BoolIfExists` condition operator with the `aws:MultiFactorAuthPresent` key. In the IAM console, the `aws:MultiFactorAuthPresent` key may not be present in the request context (e.g., during the initial password change flow before MFA is re-validated), causing `BoolIfExists` to evaluate to true when the key is absent. This triggers the Deny even though the user has an MFA device and is logged in with MFA, blocking the `iam:ChangePassword` action.

Answer

The Allow statement for iam:ChangePassword is not sufficient because the Deny statement explicitly denies all actions.

Answer

The Deny statement denies all actions unconditionally, so the Allow statement cannot override it.

Answer

The user does not have permission to change their own password because the Allow statement is not specific enough.

Question 6

A security engineer is reviewing a CloudTrail log entry (exhibit). What is the most immediate security concern indicated by this event?

Accepted Answer

A security group rule was added allowing SSH access from any IP address.. The CloudTrail log shows an AuthorizeSecurityGroupIngress API call that added a security group rule with the CIDR 0.0.0.0/0 for port 22 (SSH). This effectively opens SSH access to the entire internet, creating a severe exposure that could allow any attacker to attempt brute-force or credential-stuffing attacks against any EC2 instance associated with that security group. This is the most immediate security concern because it directly introduces a wide-open attack surface.

Answer

The source IP address 203.0.113.5 is from a known malicious IP range.

Answer

The API call was made from the AWS CLI, which may indicate a compromised access key.

Answer

The user JohnDoe did not use multi-factor authentication (MFA) for this API call.

Question 7

A startup is building a web application on AWS and needs to protect sensitive customer data at rest in an Amazon RDS for MySQL database. The compliance team requires that the encryption keys be managed by the company's on-premises hardware security module (HSM) and be rotated every 6 months. Which solution should the startup use?

Accepted Answer

Use AWS CloudHSM to store the encryption keys and enable RDS encryption with CloudHSM.. AWS CloudHSM provides a dedicated hardware security module (HSM) that allows you to manage encryption keys on-premises-style, meeting the requirement for key management on the company's own HSM. When you enable Amazon RDS for MySQL encryption with CloudHSM, the database encryption keys are stored and managed in the CloudHSM cluster, and you can rotate them every 6 months as required. This solution directly satisfies the compliance team's mandate for on-premises HSM key management and periodic rotation.

Answer

Use AWS KMS with a customer master key (CMK) and import key material from the on-premises HSM.

Answer

Store the encryption keys in AWS Secrets Manager and use them to encrypt the database.

Answer

Use AWS KMS with a custom key store backed by AWS CloudHSM.

Question 8

Which TWO of the following are valid methods to centrally manage security policies and enforce compliance across multiple AWS accounts? (Choose two.)

Accepted Answer

Deploy AWS Config conformance packs using AWS CloudFormation StackSets across accounts.. AWS Config conformance packs provide a way to deploy a collection of AWS Config rules and remediation actions across multiple accounts and Regions. When combined with AWS CloudFormation StackSets, you can centrally deploy these conformance packs to all accounts in an AWS Organization, ensuring consistent compliance enforcement. This approach allows you to define and manage security policies as code, automatically evaluating resources against desired configurations.

Answer

Attach IAM policies to all IAM users in each account.

Answer

Use AWS Security Hub to automatically enforce compliance rules.

Answer

Enable VPC Flow Logs in each account and send them to a central S3 bucket.

Question 9

Refer to the exhibit. An organization applies this SCP to an OU containing a developer account. A developer in that account tries to launch an m5.large instance using the AWS Management Console. What is the outcome?

Accepted Answer

The launch fails because the SCP denies RunInstances for instance types other than t2.micro and t2.small.. The SCP explicitly denies the ec2:RunInstances action when the condition key ec2:InstanceType does not match t2.micro or t2.small. Since m5.large is not in the allowed list, the deny effect applies, and the launch fails regardless of any IAM policy that might allow it. SCPs act as a guardrail that overrides IAM permissions, so even if the developer has full IAM access, the SCP blocks the operation.

Answer

The instance launches successfully because the SCP only applies to StartInstances, not RunInstances.

Answer

The instance launches successfully because the SCP does not explicitly allow any actions.

Answer

The launch fails only if the developer's IAM policy also denies the action.

Question 10

A company is designing a data protection strategy for its Amazon S3 bucket that stores sensitive documents. The security team requires that all data be encrypted in transit and at rest, and that any accidental deletion of objects can be reversed within 30 days. Additionally, the company must be able to audit all access attempts to the bucket, including failed attempts. Which TWO actions should the company take to meet these requirements? (Choose two.)

Accepted Answer

Enable AWS CloudTrail with data events for S3.. AWS CloudTrail with data events for S3 is correct because it captures all S3 API calls, including GetObject, PutObject, and DeleteObject, and records both successful and failed access attempts. This meets the auditing requirement for all access attempts, including failed ones, as CloudTrail logs the request details, error codes, and source IP addresses.

Answer

Enable default encryption on the bucket using SSE-S3.

Answer

Enable S3 server access logs and send them to a separate bucket.

Answer

Enable MFA Delete on the bucket.

SCS-C02 Practice Test 2 — 10 Questions

Exhibit

SCS-C02 Practice Test 2 — 10 Questions

Exhibit