SCS-C02 Practice Test 20 — 15 Questions

Question 1

A security engineer is configuring a Network ACL for a public subnet that hosts a web server. The web server must accept HTTPS (TCP 443) traffic from the internet and respond. It must also be able to initiate outbound connections to the internet for software updates (HTTPS). What is the MINIMUM set of rules required for the inbound and outbound Network ACL?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Inbound: allow TCP 443 from 0.0.0.0/0; Outbound: allow TCP 1024-65535 to 0.0.0.0/0 (for return traffic) and allow TCP 443 to 0.0.0.0/0 (for updates).. Network ACLs are stateless, meaning they require explicit rules for both inbound and outbound traffic. For the web server to accept HTTPS requests from the internet, an inbound rule allowing TCP 443 from 0.0.0.0/0 is needed. For the server to respond to those requests, an outbound rule allowing ephemeral ports (TCP 1024-65535) to 0.0.0.0/0 is required to handle return traffic. Additionally, to allow the server to initiate outbound HTTPS connections for software updates, a separate outbound rule allowing TCP 443 to 0.0.0.0/0 is necessary.

Answer

Inbound: allow TCP 443 from 0.0.0.0/0 and TCP 22 from a management IP; Outbound: allow all traffic to 0.0.0.0/0.

Answer

Inbound: allow TCP 443 from 0.0.0.0/0; Outbound: allow TCP 443 to a specific software update server IP.

Answer

Inbound: allow TCP 443 from 0.0.0.0/0; Outbound: allow all traffic to 0.0.0.0/0.

Question 2

Which TWO of the following are valid methods to centrally manage security policies and enforce compliance across multiple AWS accounts? (Choose two.)

Accepted Answer

Deploy AWS Config conformance packs using AWS CloudFormation StackSets across accounts.. AWS Config conformance packs provide a way to deploy a collection of AWS Config rules and remediation actions across multiple accounts and Regions. When combined with AWS CloudFormation StackSets, you can centrally deploy these conformance packs to all accounts in an AWS Organization, ensuring consistent compliance enforcement. This approach allows you to define and manage security policies as code, automatically evaluating resources against desired configurations.

Answer

Attach IAM policies to all IAM users in each account.

Answer

Use AWS Security Hub to automatically enforce compliance rules.

Answer

Enable VPC Flow Logs in each account and send them to a central S3 bucket.

Question 3

A security engineer needs to monitor for unauthorized changes to security group rules in an AWS account. The engineer wants to receive real-time notifications when a security group rule is added, modified, or removed. Which AWS service should the engineer use to capture these API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to the AWS environment, including EC2 APIs such as AuthorizeSecurityGroupIngress, RevokeSecurityGroupIngress, AuthorizeSecurityGroupEgress, RevokeSecurityGroupEgress, CreateSecurityGroup, and DeleteSecurityGroup. By enabling CloudTrail trail with management events and optionally data events for EC2, the security engineer can capture these API calls in near real-time and stream them to Amazon CloudWatch Logs or Amazon EventBridge to trigger notifications for unauthorized changes to security group rules.

Answer

Amazon GuardDuty

Answer

VPC Flow Logs

Answer

AWS Config

Question 4

Refer to the exhibit. A security engineer attaches this bucket policy to an S3 bucket. A user from IP address 203.0.113.10 tries to download an object using HTTP (not HTTPS). What will happen?

Accepted Answer

The request is denied because HTTP is used.. The bucket policy includes a condition that denies access when the request uses HTTP (aws:SecureTransport equals false). Even though the IP address 203.0.113.10 matches the allowed IP range in the policy, the explicit deny for HTTP requests overrides the allow. Since the user is using HTTP, the request is denied.

Answer

The request is allowed because the IP address matches the allow statement.

Answer

The request is denied because the IP is not in the allowed range.

Answer

The request is allowed because the user is using a valid IP.

Question 5

A company uses AWS CloudHSM to store encryption keys for a custom database encryption application. The application runs on Amazon EC2 instances and uses the PKCS#11 library to communicate with the HSM. Recently, the application started failing with 'CKR_SESSION_HANDLE_INVALID' errors. Which of the following is the most likely cause?

Accepted Answer

The application is not closing sessions properly, causing the HSM to reach the maximum number of open sessions. CKR_SESSION_HANDLE_INVALID is a PKCS#11 error indicating that the session handle used by the application is no longer valid. This typically occurs when the application opens sessions but fails to close them, eventually exhausting the HSM's maximum session limit. Once the limit is reached, new session requests fail or existing handles become invalid. Proper session management (closing sessions after use) is required to avoid this error.

Answer

The client certificate used for mutual TLS authentication has expired

Answer

The security group for the HSM does not allow inbound traffic from the EC2 instance

Answer

The HSM's firmware version is incompatible with the PKCS#11 library

Question 6

Refer to the exhibit. A security engineer attaches this S3 bucket policy to an S3 bucket. What is the effect of this policy?

Accepted Answer

Requests over HTTP are denied, but HTTPS requests are allowed.. The policy contains a Deny statement conditioned on 'aws:SecureTransport' being false, which blocks all HTTP requests while allowing HTTPS requests to proceed (subject to other permissions). Because Deny only triggers when the condition matches, HTTPS requests are unaffected by this statement and can be allowed by other policies or ACLs.

Answer

The policy has no effect because there is no Allow statement.

Answer

All requests over HTTPS are allowed.

Answer

All requests to the bucket are denied.

Question 7

A security engineer is configuring a new Amazon RDS for MySQL database. The compliance team requires that all database connections be encrypted in transit. Which configuration ensures this requirement is met?

Accepted Answer

Enable the 'require_secure_transport' parameter in the DB parameter group. Setting the 'require_secure_transport' parameter to '1' in the DB parameter group forces all connections to the RDS for MySQL instance to use TLS/SSL encryption. This ensures that data in transit is encrypted, meeting the compliance requirement. The parameter enforces that only encrypted connections are accepted, rejecting any unencrypted attempts.

Answer

Enable encryption at rest using KMS

Answer

Enable IAM database authentication

Answer

Set the 'ssl' parameter to '1' in the DB parameter group

Question 8

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. Which AWS service provides a managed, highly available, and scalable solution for this requirement?

Accepted Answer

NAT Gateway in a public subnet. A NAT Gateway is a managed AWS service that provides outbound-only internet access for instances in private subnets. It is highly available within an Availability Zone (AZ) and scales automatically up to 45 Gbps, making it the ideal solution for private subnet internet access without the management overhead of a NAT instance.

Answer

NAT instance in a public subnet

Answer

Internet Gateway attached to the VPC

Answer

AWS Site-to-Site VPN connection

Question 9

The above CLI output shows the encryption configuration for an S3 bucket. What type of encryption is enabled by default?

Accepted Answer

SSE-S3. SSE-S3 (AES-256) is the default encryption applied by Amazon S3 when no explicit encryption configuration is set on a bucket. The CLI output showing 'ApplyServerSideEncryptionByDefault' with 'SSEAlgorithm: AES256' indicates SSE-S3, where S3 manages the keys entirely. SSE-KMS would show 'aws:kms' and a KMS key ARN, while SSE-C requires customer-provided keys per request.

Answer

SSE-C

Answer

Client-side encryption

Answer

SSE-KMS

Question 10

Refer to the exhibit. A KMS key policy allows decryption only when the request comes through S3 in us-east-1. An application in account 111122223333 tries to decrypt an S3 object using the KMS key directly via the KMS API (not through S3). What will happen?

Accepted Answer

The decryption fails because the condition on kms:ViaService is not satisfied.. The KMS key policy includes a condition that restricts decryption to requests that come through S3 in us-east-1, using the kms:ViaService condition key. When the application calls the KMS Decrypt API directly (not through S3), the kms:ViaService condition is not satisfied, so the request is denied. This is the intended behavior of the policy.

Answer

The decryption succeeds because the principal is the root user.

Answer

The decryption fails because the policy is invalid.

Answer

The decryption succeeds because the principal is allowed.

Question 11

Refer to the exhibit. A security engineer applies this S3 bucket policy to an S3 bucket. The bucket contains sensitive data. What is the effect of this policy?

Accepted Answer

It denies PutObject requests that are not using HTTPS.. The bucket policy uses a Deny effect with a condition on 'aws:SecureTransport' set to false, which blocks any PutObject request made over plain HTTP. Requests over HTTPS satisfy the condition (SecureTransport = true), so they are not denied by this statement. This is the standard pattern for enforcing encryption in transit for S3 uploads.

Answer

It allows anonymous users to upload objects.

Answer

It denies all PutObject requests to the bucket.

Answer

It enforces that all objects must be encrypted at rest.

Question 12

A security engineer reviews the CloudTrail log entry in the exhibit. The engineer notices that an EC2 instance was launched using an AdminRole. Which additional information would help determine if this is a legitimate action or a potential compromise?

Accepted Answer

The source IP address 203.0.113.50 is from an unexpected geographic location not associated with the company.. The source IP address 203.0.113.50 is from an unexpected geographic location not associated with the company. In CloudTrail, the `sourceIPAddress` field records the originating IP of the API call. If an AdminRole is used from an IP outside the company's known CIDR ranges or geographic regions, it strongly indicates a potential compromise—such as stolen credentials or an attacker using the role from an unauthorized network. This is a key indicator of anomalous behavior in threat detection.

Answer

The AMI ID ami-0abcdef1234567890 is not a standard Amazon-provided AMI.

Answer

The instance type m5.xlarge is unusually large compared to previous launches.

Answer

The security group sg-0123456789abcdef0 allows inbound SSH from 0.0.0.0/0.

Question 13

A security engineer needs to audit all changes to AWS resources in an account. Which AWS service should be enabled?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API activity and changes to AWS resources as events, providing an audit log of who made what change, when, and from where. This directly meets the requirement to audit all changes, as every AWS API call (e.g., CreateInstance, ModifySecurityGroup) is captured in a CloudTrail event history or delivered to an S3 bucket for long-term analysis.

Answer

Amazon Inspector

Answer

AWS Config

Answer

Amazon GuardDuty

Question 14

A company uses AWS Config to evaluate resource compliance. The security team notices that the AWS::IAM::Group resource type is not supported by AWS Config managed rules. What is the best way to detect IAM groups that have an inline policy allowing 'iam:CreateUser'?

Accepted Answer

Create a custom AWS Config rule using a Lambda function that evaluates IAM groups. AWS Config managed rules do not support the AWS::IAM::Group resource type, so you cannot use a managed rule to evaluate inline policies on IAM groups. The best approach is to create a custom AWS Config rule backed by a Lambda function that can evaluate the IAM group's inline policies and trigger a compliance check when the group configuration changes. This allows you to detect any inline policy that contains the 'iam:CreateUser' action.

Answer

Use IAM Access Analyzer to identify policies that grant broad access

Answer

Use AWS CloudTrail Insights to detect CreateUser events

Answer

Enable AWS Config advanced query and run a query on IAM groups

Question 15

A company uses AWS CloudFormation to deploy infrastructure. A security engineer needs to ensure that all CloudFormation stacks use a specific AWS KMS key for encrypting resources that support encryption. Which approach should be used?

Accepted Answer

Use AWS CloudFormation StackSets with a service-managed permission model to deploy stacks from a centrally managed template that includes the KMS key.. AWS CloudFormation StackSets with a service-managed permission model allow you to deploy a centrally managed template across multiple accounts and regions from a single administrator account. By hardcoding the KMS key ID directly in the template (or referencing a stack-set parameter that is locked down), you enforce that all stack instances use the specified KMS key for encryption-enabled resources, ensuring consistent compliance without relying on individual user input.

Answer

Use a CloudFormation template that includes the KMS key ID as a hardcoded value.

Answer

Use a CloudFormation parameter to accept the KMS key ID and validate it with a rule.

Answer

Use an AWS Organizations service control policy (SCP) to deny all CloudFormation actions unless a specific KMS key is used.