SCS-C02 Practice Test 20 — 15 Questions

Question 1

A company has a multi-account AWS organization with centralized logging in a Security account. The Security account contains an S3 bucket that stores CloudTrail logs from all member accounts. The bucket policy allows CloudTrail from member accounts to deliver logs. Recently, a security audit revealed that the bucket is publicly accessible. The security engineer must ensure that only authorized accounts can access the logs. The engineer updates the bucket policy to include a condition that restricts access to specific AWS accounts. However, after the change, member accounts report that CloudTrail is failing to deliver logs to the bucket. The bucket policy currently includes the following statement: { "Effect": "Allow", "Principal": "*", "Action": "s3:PutObject", "Resource": "arn:aws:s3:::central-logs/*", "Condition": { "StringEquals": { "aws:SourceAccount": "111111111111" } } } The Security account ID is 222222222222. What is the MOST likely cause of the delivery failure, and what should the engineer do to fix it?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Change the Principal from "*" to the CloudTrail service principal to restrict access more tightly.. The bucket policy's condition using `aws:SourceAccount` is not appropriate for CloudTrail. CloudTrail uses the service principal (`cloudtrail.amazonaws.com`) and the `aws:SourceAccount` key is not evaluated for service principals. The condition does not match, causing log delivery failures. Changing the Principal from `*` to the CloudTrail service principal is a necessary step to properly scope the policy. However, the condition should also be changed to use `aws:SourceArn` or removed entirely. Among the options, option C is the most direct fix, while option B is incorrect because CloudTrail does not require bucket ACLs. Options A and D are irrelevant to the issue.

Answer

Modify the KMS key policy to allow CloudTrail to decrypt and re-encrypt logs if SSE-KMS is enabled.

Answer

Update the bucket ACL to grant the CloudTrail service write access, as CloudTrail requires both bucket policy and ACL permissions.

Answer

Create an IAM role in the Security account and configure member accounts to use that role for log delivery.

Question 2

A company wants to centrally collect and analyze logs from multiple AWS accounts. Which AWS service should be used to aggregate logs from various sources for monitoring and alerting?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is the correct service because it provides a centralized platform for collecting, monitoring, and analyzing log data from multiple AWS accounts and on-premises sources. It supports cross-account log aggregation via subscription filters and cross-account destinations, enabling real-time monitoring and alerting through CloudWatch Logs Insights and metric filters. This makes it the appropriate choice for the stated requirement of central log aggregation for monitoring and alerting.

Answer

Amazon S3

Answer

AWS Config

Answer

AWS CloudTrail

Question 3

The exhibit shows an S3 bucket policy. The security team wants to ensure that only users from account 123456789012 can access objects in the bucket. What is a potential security issue with this policy?

Accepted Answer

The policy grants access to all IAM users in the account, not just specific ones.. The policy uses a Principal of "123456789012" which effectively grants access to all IAM users and roles within that AWS account. This means any user in the account who has permission to call s3:GetObject can access the bucket objects, making it overly permissive. The correct answer is A because this is the security issue—no restriction to specific users or roles.

Answer

The policy does not restrict access to a specific VPC.

Answer

The policy uses a wildcard in the resource ARN.

Answer

The policy does not require MFA.

Question 4

A company is using AWS CloudFormation to deploy infrastructure. The security team wants to ensure that all Amazon S3 buckets created by CloudFormation are encrypted by default. Which approach should be taken?

Accepted Answer

Use a bucket policy with a condition that denies s3:PutObject if the x-amz-server-side-encryption header is not present.. A bucket policy with a condition that denies s3:PutObject unless the x-amz-server-side-encryption header is present ensures that any object uploaded to the bucket must include encryption headers. This enforces server-side encryption at the object level, which is the most direct way to guarantee encryption for all objects placed into S3 buckets created by CloudFormation.

Answer

Configure an IAM policy that requires all S3 operations to use encryption.

Answer

Set a bucket policy in the CloudFormation template that denies all actions unless encryption is enabled.

Answer

Enable AWS Config rule s3-bucket-server-side-encryption-enabled to enforce encryption.

Question 5

A company has a multi-account AWS environment using AWS Organizations. The security team wants to ensure that all API activity across all accounts is logged and immutable. CloudTrail is enabled in all accounts, but the logs are stored in individual account buckets. The team wants to centralize logs and prevent any account from disabling logging. What should they do?

Accepted Answer

Apply an SCP to deny cloudtrail:StopLogging and cloudtrail:DeleteTrail, and create an organization trail that delivers logs to a central S3 bucket with a bucket policy that prevents deletion.. It uses an SCP to prevent disabling CloudTrail (denying cloudtrail:StopLogging and cloudtrail:DeleteTrail) and creates an organization trail that delivers logs to a central S3 bucket. The central bucket policy prevents deletion of logs, ensuring immutability and centralized logging across all accounts in the AWS Organization.

Answer

Create a new CloudTrail trail for each account and configure S3 bucket policies to allow cross-account access.

Answer

Enable S3 MFA Delete on each account's log bucket and require MFA for IAM users.

Answer

Use CloudWatch Logs to aggregate logs and set a retention policy of 10 years.

Question 6

A security engineer is designing a centralized logging solution for 10 AWS accounts. Which THREE AWS services should be used to aggregate, store, and analyze logs?

Accepted Answer

AWS Organizations. AWS Organizations is correct because it provides a centralized management structure for multiple AWS accounts, enabling you to automatically enforce policies and aggregate logs from all member accounts into a central S3 bucket. Amazon S3 is the recommended service for storing large volumes of logs durably and cost-effectively. Amazon Athena enables you to run ad-hoc SQL queries directly on the logs stored in S3, providing a serverless analytics solution for log analysis without the need for complex ETL or infrastructure management. Together, these three services form a complete solution: Organizations for aggregation, S3 for storage, and Athena for analysis.

Answer

Amazon Kinesis Data Streams

Answer

Amazon CloudWatch Logs

Question 7

A security team uses Amazon Macie to discover sensitive data in S3. They have configured Macie to run automated sensitive data discovery jobs. After reviewing the findings, they notice that some S3 objects containing personally identifiable information (PII) are not being flagged. What is the most likely cause?

Accepted Answer

The PII is in a format that Macie's managed data identifiers do not recognize, and no custom data identifier is configured.. Macie uses managed data identifiers to detect PII based on predefined patterns. If the PII in the S3 objects is in a format that does not match any of these managed identifiers (e.g., a non-standard date format or a custom ID number), and no custom data identifier has been configured to recognize that specific pattern, Macie will not flag the objects. This is the most likely cause given that the security team has already configured automated discovery jobs and other common issues like permissions or encryption are not preventing scanning.

Answer

The Macie service-linked role does not have permissions to read the objects.

Answer

The S3 bucket is in a different AWS Region than the Macie job.

Answer

The S3 objects are encrypted with SSE-S3.

Question 8

A company has a security requirement to automatically isolate an Amazon EC2 instance that is generating high network traffic to a known malicious IP address. The company uses Amazon GuardDuty and AWS Lambda. Which combination of services and configurations should be used to achieve the isolation?

Accepted Answer

Use Amazon GuardDuty to send findings to Amazon CloudWatch Events, which triggers an AWS Lambda function that modifies the security group to remove the instance.. Amazon GuardDuty generates findings for threats like communication with known malicious IPs, and these findings can be sent to Amazon CloudWatch Events (now Amazon EventBridge). CloudWatch Events can then trigger an AWS Lambda function that modifies the security group associated with the EC2 instance to remove its inbound/outbound rules, effectively isolating the instance. This automated workflow meets the security requirement without manual intervention.

Answer

Use VPC Flow Logs to send logs to CloudWatch Logs, then create a metric filter that triggers a Lambda function.

Answer

Use Amazon GuardDuty to send findings to AWS Systems Manager Automation to run a document that isolates the instance.

Answer

Use AWS Config rules to detect the traffic and invoke a Lambda function to change the security group.

Question 9

Which TWO of the following are valid ways to grant an IAM user permissions to access an S3 bucket? (Choose 2.)

Accepted Answer

Attach an IAM policy to the user.. An IAM policy attached directly to a user explicitly grants that user permissions to perform specific actions on an S3 bucket. This is a fundamental method of identity-based access control in AWS, where the policy document defines allowed or denied actions (e.g., s3:GetObject) and resources (e.g., arn:aws:s3:::example-bucket/*).

Answer

Assign an instance profile to the user.

Answer

Create a VPC endpoint policy.

Answer

Use an SCP to allow access.

Question 10

A security team notices that an S3 bucket containing sensitive data is publicly accessible. The bucket policy is as follows:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*"
    }
  ]
}

Which step should be taken to secure the bucket while maintaining access for authorized users?

Accepted Answer

Delete the public bucket policy and attach a new policy that allows access only through a VPC Endpoint.. Deleting the public bucket policy and attaching a new policy that allows access only through a VPC Endpoint ensures that the bucket is not publicly accessible and only authorized users within the VPC can access it. Option A is incorrect because using AWS Config to block public access does not by itself grant authorized users access; additional configuration is needed. Option B is incorrect because creating an IAM role and assigning it to the bucket does not override the existing public bucket policy; the bucket remains publicly accessible. Option C is incorrect because adding a Deny statement for IP addresses outside the corporate network does not remove the existing Allow statement for all principals, and the Allow would still grant public access unless an explicit Deny overrides it, which is not guaranteed with this approach.

Answer

Use AWS Config to automatically block all public access.

Answer

Create an IAM role with S3 access and assign it to the bucket.

Answer

Add a Deny statement for any IP address outside the corporate network.

Question 11

A security engineer is designing a secure VPC architecture. Which THREE components should be used to implement defense in depth? (Choose three.)

Accepted Answer

Security groups. Security groups (C) are stateful virtual firewalls that control inbound and outbound traffic at the instance level. They operate at the network interface (ENI) level, allowing only explicitly permitted traffic and automatically allowing return traffic for permitted sessions. This provides a critical layer of host-level defense within the VPC.

Answer

VPN connection

Answer

Internet gateway

Question 12

Which TWO actions can be taken to improve the security of an Amazon RDS for MySQL database instance? (Choose TWO.)

Accepted Answer

Place the RDS instance in a private subnet and restrict inbound traffic to the application security group.. Placing the RDS instance in a private subnet ensures it is not directly accessible from the internet, which reduces the attack surface. Restricting inbound traffic to only the application security group (using security group rules) ensures that only the specific application servers can connect to the database, following the principle of least privilege. This is a fundamental network security best practice for database instances.

Answer

Disable automated backups to reduce storage costs.

Answer

Enable Multi-AZ deployment for fault tolerance.

Answer

Assign a public IP address to the RDS instance for easier access from the internet.

Question 13

Refer to the exhibit. A security engineer is reviewing the bucket encryption configuration. The bucket is used to store sensitive data. The company policy requires that all objects be encrypted using AWS KMS with a customer managed key. What should the engineer do to meet the policy?

Accepted Answer

Update the bucket encryption configuration to use SSEAlgorithm: aws:kms and specify a KMS key ID. The current bucket encryption configuration uses SSE-S3 (AES256). To meet the policy requiring KMS with a customer managed key, the engineer must update the bucket's default encryption settings to use SSE-KMS (aws:kms) and specify the KMS key ID. Option C correctly describes this. Option A is incorrect because enabling the bucket key with SSE-S3 does not change the encryption algorithm to KMS. Option B is incorrect because client-side encryption with a KMS key is not a bucket-level configuration; it is applied by the client before upload and does not modify the default server-side encryption setting. Option D is incorrect because adding a bucket policy that requires kms:Encrypt permission for PutObject requests does not enforce server-side encryption with KMS; it only authorizes KMS encryption if used, but objects could still be uploaded without specifying KMS encryption.

Answer

Enable the bucket key and set SSEAlgorithm to AES256

Answer

Use client-side encryption with a KMS key

Answer

Add a bucket policy that requires kms:Encrypt permission for all PutObject requests

Question 14

A global e-commerce company operates in three AWS Regions: us-east-1, eu-west-1, and ap-southeast-1. The company uses AWS Organizations with 50 member accounts grouped by business unit. The security team recently discovered that several S3 buckets containing customer data were accidentally made public due to misconfigured bucket policies. The team wants to implement a preventive control that blocks any S3 bucket from becoming public across all accounts, while still allowing authorized cross-account access. The solution must be centrally managed and not require changes to existing IAM policies. Additionally, the team needs to be notified immediately when a public bucket is attempted. Which solution meets all requirements?

Accepted Answer

Create an SCP that denies s3:PutBucketPolicy and s3:PutBucketAcl when the condition includes making the bucket public, and use CloudTrail and CloudWatch Events to send notifications on denied API calls.. It uses an SCP to centrally deny the s3:PutBucketPolicy and s3:PutBucketAcl actions when the request would make a bucket public, which is a preventive control that blocks the operation before it happens. The requirement for immediate notification is met by using CloudTrail to log the denied API calls and CloudWatch Events to trigger alerts, all without modifying existing IAM policies or requiring per-account changes.

Answer

Use Amazon Macie to discover public buckets and alert the security team.

Answer

Create an SCP that denies s3:PutBucketPolicy only for policies that specify 'Principal': '*' or 'Principal': {'AWS': '*'}

Answer

Deploy an AWS Config rule in each account that triggers a Lambda function to make non-compliant buckets private.

Question 15

A security engineer is investigating a potential security incident. CloudTrail logs show that an IAM user 'admin' deleted an S3 bucket at 2023-01-15T10:30:00Z. The engineer needs to find the source IP address and user agent of the request. Which CloudTrail log field contains this information?

Accepted Answer

userAgent and sourceIPAddress. CloudTrail logs capture the `userAgent` and `sourceIPAddress` fields directly in the log event record. These fields are part of the CloudTrail `Event` record structure, specifically under the `userIdentity` and `sourceIPAddress` top-level attributes, and they provide the exact source IP address and user agent string (e.g., AWS CLI, SDK, console browser) for the API call that deleted the S3 bucket.

Answer

eventID

Answer

requestParameters

Answer

resources