SCS-C02 Practice Test 2 — 10 Questions

Question 1

An organization has a requirement to retain all AWS CloudTrail logs for at least 7 years for compliance. Currently, logs are stored in an S3 bucket with default settings. What is the MOST cost-effective way to meet the retention requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure S3 lifecycle policy to transition objects to S3 Glacier after 30 days and expire after 7 years.. The most cost-effective because it uses an S3 lifecycle policy to transition objects to S3 Glacier after 30 days (reducing storage costs for older logs) and then expires (deletes) them after 7 years to meet the retention requirement. Option A is wrong because storing logs directly in S3 Glacier Deep Archive is not cost-effective for logs that may be accessed occasionally and does not automatically expire after 7 years without additional policy. Option B is wrong because simply deleting after 7 years does not take advantage of cheaper storage tiers. Option C is wrong because CloudTrail trails do not have a retention setting; retention must be managed via S3 lifecycle policies.

Answer

Use S3 Glacier Deep Archive immediately.

Answer

Set an S3 lifecycle policy to delete objects after 7 years.

Answer

Set the CloudTrail trail to store logs in an S3 bucket with 7-year retention.

Question 2

A company stores sensitive data in Amazon S3. The security team needs to ensure that data is encrypted at rest and that access is logged. Which TWO actions meet these requirements?

Accepted Answer

Enable S3 server access logs. (Enable S3 server access logs) and Option D (Enable default encryption on the S3 bucket) are correct. Default encryption ensures data is encrypted at rest. Server access logs record requests to the bucket. Option A is wrong because VPC Flow Logs capture network traffic, not S3 access. Option C is wrong because CloudTrail logs data events only if explicitly enabled. Option E is wrong because IAM Access Analyzer analyzes resource policies, not logging access.

Answer

Enable VPC Flow Logs for the VPC

Answer

Enable AWS CloudTrail to log data events

Answer

Enable AWS IAM Access Analyzer

Question 3

A company uses AWS Organizations to manage multiple accounts. The security team wants to enable CloudTrail for all accounts and centrally store logs. What is the most efficient way to achieve this?

Accepted Answer

Create a CloudTrail trail in the management account and apply it to all accounts in the organization. AWS Organizations allows you to create a single CloudTrail trail in the management account that automatically applies to all member accounts within the organization. This is the most efficient method as it eliminates the need for manual per-account configuration or custom automation, and it ensures consistent logging across the entire organization with centralized log delivery to a single S3 bucket.

Answer

Use an S3 bucket policy to allow cross-account log delivery

Answer

Use AWS Lambda to create trails in each account

Answer

Ask each account admin to create their own CloudTrail trail and deliver to a central S3 bucket

Question 4

A security engineer is troubleshooting an issue where an EC2 instance cannot access an S3 bucket via a VPC endpoint. The bucket policy allows access only from the VPC endpoint. The instance has an IAM role that grants s3:GetObject on the bucket. The EC2 instance receives an AccessDenied error. What is the most likely cause?

Accepted Answer

The bucket policy does not include the aws:SourceVpce condition.. The AccessDenied error occurs because the S3 bucket policy must include the aws:SourceVpce condition to allow access from the specific VPC endpoint. Without this condition, the bucket policy denies all requests that do not originate from the endpoint, regardless of IAM permissions. Option B is correct because the missing condition is the most likely cause.

Answer

The IAM role does not have sufficient permissions.

Answer

The VPC endpoint policy is blocking the request.

Answer

The EC2 instance's security group does not allow outbound traffic to S3.

Question 5

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. Which component should be added to the VPC to enable this?

Accepted Answer

NAT gateway. (NAT gateway). A NAT gateway enables instances in a private subnet to initiate outbound traffic to the internet for tasks like software updates, while preventing inbound traffic from the internet. Option A (Internet gateway) is incorrect because it is used for public subnets to allow direct internet access. Option B (VPN connection) is used for secure connectivity to an on-premises network, not for outbound internet access. Option C (VPC peering connection) is used to connect two VPCs, not to provide internet access.

Answer

Internet gateway

Answer

VPN connection

Answer

VPC peering connection

Question 6

A security engineer is investigating a potential data exfiltration incident. The engineer notices large volumes of data being transferred from an Amazon S3 bucket to an external IP address. Which AWS services can be used to detect and alert on such behavior? (Choose THREE.)

Accepted Answer

Amazon CloudWatch Logs with S3 access log analysis.. Amazon CloudWatch Logs can ingest and analyze S3 access logs, which record detailed information about requests made to an S3 bucket, including the source IP address, request type, and bytes transferred. By analyzing these logs with CloudWatch Logs Insights or metric filters, you can detect large data transfers to external IPs and trigger alerts via CloudWatch Alarms, making it a valid detection and alerting mechanism for data exfiltration.

Answer

AWS Config with compliance rules.

Answer

VPC Flow Logs.

Question 7

A security engineer is designing a VPC with a public subnet and a private subnet. The private subnet will host a database instance that should only be accessible from the application instances in the public subnet. The application instances use an Auto Scaling group. Which configuration ensures that only the application instances can access the database?

Accepted Answer

Allow inbound database port from the security group attached to the application instances in the public subnet.. Security group rules can reference other security groups, allowing dynamic scaling of the application instances without needing to update CIDR blocks. Auto Scaling group instances are automatically assigned the application security group, so only they can access the database. Option B is incorrect because allowing 0.0.0.0/0 would expose the database to the internet. Option C is incorrect because network ACLs are stateless and cannot reference security groups; they would require explicit rules for return traffic. Option D is incorrect because referencing the public subnet CIDR would allow any instance in that subnet, not just the application instances, and would not handle changes in the application instances' IPs.

Answer

Allow inbound database port from 0.0.0.0/0 in the database security group.

Answer

Configure a network ACL on the private subnet to allow the database port from the public subnet CIDR.

Answer

Allow inbound database port from the public subnet CIDR block in the database security group.

Question 8

A Security Engineer is configuring a VPC with a public subnet for a web server and a private subnet for a database. The web server needs to download patches from the internet. Which TWO actions should the Engineer take to allow the web server internet access without exposing the database to the internet?

Accepted Answer

Create a NAT Gateway in the public subnet.. A NAT Gateway in the public subnet allows instances in the private subnet to initiate outbound IPv4 traffic to the internet (e.g., to download patches) while preventing unsolicited inbound connections from the internet. By adding a route in the private subnet's route table that points 0.0.0.0/0 to the NAT Gateway, the web server's outbound traffic is forwarded to the NAT Gateway, which then uses the Internet Gateway to reach the internet. The database remains isolated because it has no direct route to the Internet Gateway and no public IP address.

Answer

Create a bastion host in the public subnet and configure the web server to use it as a proxy.

Answer

Create a VPC endpoint for Amazon S3.

Answer

Attach an Internet Gateway to the VPC and add a route to the Internet Gateway in the private subnet's route table.

Question 9

A security engineer is designing a web application that will run on EC2 instances behind an Application Load Balancer (ALB). The application must be protected from common web exploits like SQL injection and cross-site scripting. Which AWS service should be used to provide this protection?

Accepted Answer

AWS WAF. AWS WAF is a web application firewall that helps protect web applications from common web exploits like SQL injection and cross-site scripting. Network ACLs are stateless firewalls at the subnet level and do not inspect application-layer traffic. Security Groups are stateful firewalls at the instance level and do not provide application-layer filtering. AWS Shield Advanced provides DDoS protection, not application-layer attack prevention.

Answer

Network ACLs

Answer

Security Groups

Answer

AWS Shield Advanced

Question 10

A company requires that all access to its S3 buckets be logged for compliance. Which AWS service should be used to record API calls to S3?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls for auditing purposes, making it the correct service for logging access to S3 buckets. Option A is incorrect because Amazon GuardDuty is a threat detection service, not a logging service. Option B is incorrect because Amazon Inspector assesses vulnerabilities. Option C is incorrect because AWS Config tracks resource configuration changes, not API calls.

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Answer

AWS Config