SCS-C02 Practice Exam 1 — 20 Questions

Question 1

The exhibit shows an SCP attached to an organizational unit. What is the effect of this policy?

Accepted Answer

It allows s3:PutBucketPolicy only if the bucket ACL is set to bucket-owner-full-control.. The SCP denies s3:PutBucketPolicy only when the bucket ACL is not set to 'bucket-owner-full-control'. If the ACL is set to that value, the action is allowed. Thus, it ensures that when a bucket policy is created, the ACL must grant full control to the bucket owner. It does not deny all PutBucketPolicy actions.

Answer

It denies all s3:PutBucketPolicy actions on all buckets.

Answer

It denies s3:PutBucketPolicy for any bucket that does not have an ACL.

Answer

It allows s3:PutBucketPolicy for buckets owned by the management account.

Question 2

A security engineer finds this IAM policy attached to a user. The user is able to create CloudTrail trails but cannot start logging. What is the MOST likely reason?

Accepted Answer

The user lacks `iam:PassRole` permission for the CloudTrail service role.. The user can create CloudTrail trails but cannot start logging because starting logging requires the `iam:PassRole` permission to pass the CloudTrail service role to the CloudTrail service. Without this permission, CloudTrail cannot assume the role needed to write logs to the S3 bucket and deliver them to CloudWatch Logs, even though the user has `cloudtrail:CreateTrail` and `cloudtrail:StartLogging` actions in the policy.

Answer

The `StartLogging` action is not listed in the policy.

Answer

The policy does not specify the `cloudtrail:StartLogging` action.

Answer

The user does not have permission to create CloudTrail trails.

Question 3

Which TWO actions should a security engineer take to ensure that Amazon GuardDuty can effectively monitor for suspicious activity in a VPC? (Choose two.)

Accepted Answer

Enable DNS query logging and publish to CloudWatch Logs.. Amazon GuardDuty relies on DNS query logs to detect suspicious domain name resolution patterns, such as DNS tunneling or communication with known malicious domains. By enabling DNS query logging and publishing to CloudWatch Logs, GuardDuty can ingest this data as a source for its threat detection algorithms. Without DNS logs, GuardDuty cannot analyze DNS-based attack vectors within the VPC.

Answer

Enable CloudTrail data events for S3.

Answer

Enable S3 server access logs.

Answer

Enable AWS Config configuration history.

Question 4

A security engineer is reviewing the CloudTrail configuration for a trail named 'management-trail'. The engineer needs to ensure that all S3 object-level operations in the bucket 'my-bucket' are logged. What is the issue with the current configuration?

Accepted Answer

The 'Values' field should end with a '/*' to capture all objects under the prefix.. The 'DataResources' value should include a trailing '/*' to indicate all objects under the prefix. Option A is incorrect because the ReadWriteType is 'All', which covers both read and write. Option C is incorrect because the event selector includes management events. Option D is incorrect because the trail is not necessarily multi-region from this output.

Answer

The ReadWriteType is set to 'All', which does not include write events.

Answer

The IncludeManagementEvents should be set to false to focus on data events.

Answer

The trail should be configured as a multi-region trail to capture all regions.

Question 5

A financial services company uses AWS KMS to encrypt sensitive data in S3 and RDS. The security team requires a centralized audit trail of all KMS key usage, including key creation, deletion, and cryptographic operations. The audit logs must be stored in a separate AWS account for compliance. The team has enabled CloudTrail in the management account and configured a trail that logs to an S3 bucket in the audit account. However, they notice that KMS events such as Decrypt and GenerateDataKey are not appearing in the CloudTrail logs. The KMS key policy includes the following statement: {"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::management-account:root"},"Action":"kms:*","Resource":"*"}. What is the MOST likely reason for the missing KMS events?

Accepted Answer

CloudTrail is not configured to log KMS data events.. CloudTrail does log KMS events by default, but they are data events and must be explicitly enabled. Option B is correct because KMS data events (like Decrypt and GenerateDataKey) are not logged unless CloudTrail is configured to capture them. Option C is wrong because the key policy grants full access to the management account, so it is sufficient. Option D is wrong because cross-account access is not the issue; the trail is logging to an S3 bucket in the audit account, but that does not affect which events are logged.

Answer

The S3 bucket in the audit account does not have a bucket policy allowing writes from CloudTrail.

Answer

CloudTrail does not log KMS Decrypt and GenerateDataKey events.

Answer

The KMS key policy does not grant CloudTrail permission to log events.

Question 6

A security engineer needs to capture all network traffic between EC2 instances in a VPC for forensic analysis. Which TWO services should be used together? (Choose TWO.)

Accepted Answer

Amazon VPC Flow Logs. Amazon VPC Flow Logs capture IP traffic information for network interfaces in a VPC, including metadata such as source/destination IPs, ports, protocols, and packet accept/reject decisions. To perform forensic analysis on this raw flow log data, you can use Amazon Athena to query the logs directly from S3 using standard SQL, enabling efficient filtering and pattern detection across large volumes of network traffic.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon GuardDuty

Question 7

Refer to the exhibit. A security engineer runs the 'simulate-custom-policy' command to test a policy. The output shows 'explicitDeny' for ec2:RunInstances. What is the most likely reason?

Accepted Answer

The policy includes an explicit Deny statement for ec2:RunInstances. The 'simulate-custom-policy' output shows 'explicitDeny', which indicates that the policy contains an explicit Deny statement for the action ec2:RunInstances. An explicitDeny is only returned when a Deny statement matches the action, not when the action is simply missing from an Allow list. Therefore, the most likely reason is that the policy includes an explicit Deny statement.

Answer

The policy does not include ec2:RunInstances in the Action list

Answer

The policy allows ec2:Describe* but the action ec2:RunInstances is not a Describe action

Answer

The policy uses a Resource of '*' which does not include the required resources

Question 8

A company uses Amazon S3 to store sensitive documents. They must ensure that all objects are encrypted at rest and that any attempt to upload an unencrypted object is denied. Which S3 bucket policy statement achieves this?

Accepted Answer

Deny s3:PutObject unless the request includes x-amz-server-side-encryption: AES256 AND the encryption is SSE-S3.. Option C is correct because it explicitly denies PutObject unless the request includes both the x-amz-server-side-encryption header with value AES256 (which requests SSE-S3) and the encryption type is SSE-S3. This ensures only objects encrypted with SSE-S3 can be uploaded. Option A is incorrect because it only checks for the header value AES256; while AES256 is specific to SSE-S3 and would also enforce SSE-S3, Option C provides a more explicit condition. Option B is incorrect because it denies all PutObject requests. Option D is incorrect because an Allow statement cannot enforce a denial; a Deny statement is required to block unencrypted uploads.

Answer

Deny s3:PutObject unless the request includes x-amz-server-side-encryption: AES256.

Answer

Deny s3:PutObject for all principals.

Answer

Allow s3:PutObject only when x-amz-server-side-encryption: AES256 is present.

Question 9

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The security team requires that all traffic between the ALB and EC2 instances be encrypted. Which configuration ensures this requirement is met?

Accepted Answer

Use an HTTPS listener on the ALB and configure the target group with HTTPS.. It ensures end-to-end encryption between the ALB and EC2 instances. By configuring an HTTPS listener on the ALB, traffic from clients to the ALB is encrypted. Then, by setting the target group protocol to HTTPS, the ALB re-encrypts the traffic before forwarding it to the EC2 instances, fulfilling the security team's requirement that all traffic between the ALB and EC2 instances be encrypted.

Answer

Use a TCP listener on the ALB and a TCP target group.

Answer

Configure security group inbound rules to allow only HTTPS traffic.

Answer

Use an HTTP listener on the ALB and HTTP on the target group.

Question 10

A company uses Amazon RDS for PostgreSQL with encryption at rest enabled using AWS KMS. The security team wants to ensure that database backups (automated snapshots) are also encrypted and that the encryption key can be rotated on demand without re-encrypting the data. Which approach should be taken?

Accepted Answer

Create a new KMS key and modify the RDS instance to use the new key. The existing backup will be re-encrypted with the new key when the instance is modified.. You can create a new KMS key and modify the RDS instance to use the new key. This action re-encrypts the database and its automated snapshots with the new key, providing on-demand key rotation. The re-encryption is performed automatically during the modification. Option A is incorrect because RDS does not allow specifying a separate KMS key for backups; backups use the same key as the instance. Option B is incorrect because disabling the old KMS key would break access to existing backups that are still encrypted with that key. Option C is incorrect because automatic key rotation in KMS does not trigger re-encryption of existing data; it only generates new key material for future encryption operations.

Answer

Use a separate KMS key for backups by enabling 'Copy tags to snapshots' and specifying a different key.

Answer

Disable the old KMS key and enable a new KMS key for the RDS instance. The old backup will remain encrypted with the old key.

Answer

Enable automatic key rotation in KMS and import new key material every 90 days.

Question 11

Refer to the exhibit. A security engineer deploys this CloudFormation template. An IAM role 'DataAccessRole' in the same account needs to read objects from the bucket. After deployment, users assume the role but get AccessDenied errors when trying to read objects. What is the MOST likely cause?

Accepted Answer

The PublicAccessBlockConfiguration is blocking the bucket policy.. The PublicAccessBlockConfiguration at the account or bucket level overrides any bucket policy that grants public or cross-account access. Even though the bucket policy may allow the DataAccessRole to read objects, the PublicAccessBlockConfiguration blocks all public or cross-account access, causing AccessDenied errors. This is the most likely cause because the bucket policy is effectively ignored when public access blocks are enabled.

Answer

The IAM role is not attached to the EC2 instance profile.

Answer

The bucket is encrypted with SSE-KMS and the role lacks KMS permissions.

Answer

The role does not have s3:ListBucket permission.

Question 12

A company has a requirement to grant cross-account access to an S3 bucket named 'shared-data' in Account A (111111111111) to users in Account B (222222222222). The security team has set up a bucket policy in Account A that grants read-only access to the IAM role 'DataReader' in Account B. The bucket policy is as follows: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::222222222222:role/DataReader"},"Action":["s3:GetObject"],"Resource":"arn:aws:s3:::shared-data/*"}]}. A user in Account B assumes the 'DataReader' role, but when trying to read an object from the bucket, they receive an 'Access Denied' error. What is the MOST likely reason for this error?

Accepted Answer

The IAM role 'DataReader' does not have an IAM policy that allows s3:GetObject on the bucket.. For cross-account S3 access, both the resource-based policy (bucket policy) in the owning account and the identity-based policy (IAM policy) attached to the IAM role in the accessing account must grant the necessary permissions. The bucket policy in Account A allows the 'DataReader' role to perform s3:GetObject, but the IAM role itself in Account B must also have an IAM policy that allows s3:GetObject on the bucket. Without this identity-based policy, the role lacks permission to perform the action, resulting in 'Access Denied'. Option A is incorrect because the bucket policy can specify an IAM role ARN as principal. Option B is incorrect because s3:ListBucket is not required to read objects; s3:GetObject is sufficient. Option D is incorrect because there is no mention of KMS encryption in the scenario, and even if there were, the issue is the missing IAM policy on the role.

Answer

The bucket policy principal must be the IAM user ARN, not the role ARN.

Answer

The bucket policy is missing the 's3:ListBucket' action, which is required to read objects.

Answer

The bucket objects are encrypted with a KMS key, and the role does not have permission to decrypt.

Question 13

Refer to the exhibit. A user from IP 10.1.2.3 attempts to download an object from my-secret-bucket using HTTP (not HTTPS). What will be the outcome?

Accepted Answer

Failure, because the Deny statement blocks HTTP requests.. The Deny statement with condition aws:SecureTransport=false will block HTTP requests. Even though the IP matches the allow rule, the explicit Deny overrides the Allow.

Answer

Success, because the Allow statement is evaluated first.

Answer

Failure, because the user's IP is not in the allowed range.

Answer

Success, because the user's IP is within the allowed range.

Question 14

A startup is building a serverless application using AWS Lambda to process user-uploaded images. The images are stored in an S3 bucket with server-side encryption (SSE-S3) enabled. The Lambda function reads the images, performs transformations, and writes the results to a different S3 bucket. The security engineer wants to ensure that data is encrypted at rest and in transit throughout the pipeline. The Lambda function is configured with an IAM role that has permissions to read from the source bucket and write to the destination bucket. Which additional configuration is REQUIRED to ensure end-to-end encryption?

Accepted Answer

No additional configuration is required; Lambda uses HTTPS by default to call S3.. Lambda uses HTTPS by default when calling S3 API operations, ensuring encryption in transit. SSE-S3 provides encryption at rest on S3, so no additional configuration is needed for end-to-end encryption. Option A is incorrect because while a bucket policy can enforce HTTPS, it is not required; Lambda's default HTTPS connection already provides encryption in transit. Option C is incorrect because SSE-S3 does not use KMS; Lambda can read SSE-S3 encrypted objects without additional KMS permissions. Option D is incorrect because VPC endpoints are not required for encryption in transit; Lambda's default HTTPS calls to S3 are already encrypted.

Answer

Add a bucket policy to the source bucket that denies requests not using aws:SecureTransport.

Answer

Grant the Lambda function's IAM role permission to call KMS Decrypt and Encrypt.

Answer

Enable VPC endpoints for S3 and configure Lambda to use them.

Question 15

A company stores data in Amazon S3 and uses AWS KMS with Customer Master Keys (CMKs) for encryption. The security team wants to audit when the CMK is used to decrypt data. Which of the following will provide this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail logs all KMS Decrypt API calls, which is exactly what is needed to audit CMK decryption. Option A (AWS Config) records configuration changes, not API calls. Option B (Amazon CloudWatch Logs) can store logs but does not generate the KMS decrypt logs itself; CloudTrail generates them. Option D (S3 server access logs) record requests to S3 objects, not the KMS decryption calls that happen when accessing encrypted objects.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

S3 server access logs

Question 16

A company has enabled Amazon GuardDuty in multiple AWS accounts. The security team wants to centralize GuardDuty findings into a single account for analysis. Which THREE steps are required to achieve this? (Choose THREE.)

Accepted Answer

Invite member accounts to join the GuardDuty master account.. In Amazon GuardDuty, to centralize findings from multiple accounts, you must designate a master account and then invite member accounts to join. The invitation process establishes a trusted relationship where the master account can aggregate and analyze findings from all member accounts. Without this step, the master account cannot receive findings from other accounts.

Answer

Configure CloudWatch Logs cross-account subscription to aggregate findings.

Answer

Create an EventBridge rule to forward findings to the master account.

Question 17

A security engineer is configuring an S3 bucket policy to restrict access to only requests that originate from a specific VPC endpoint. Which condition key should be used?

Accepted Answer

aws:SourceVpce. The correct condition key is 'aws:SourceVpce' because it allows you to restrict access to an S3 bucket based on the VPC endpoint ID. Option A ('aws:VpcSourceIp') is not a valid AWS condition key. Option B ('aws:SourceVpc') restricts access by VPC ID, not the specific VPC endpoint. Option C ('aws:SourceIp') restricts by client IP address, which is not specific to VPC endpoints. Option D ('aws:SourceVpce') is the correct key to use for restricting access to a specific VPC endpoint.

Answer

aws:VpcSourceIp

Answer

aws:SourceVpc

Answer

aws:SourceIp

Question 18

A security engineer is configuring AWS Config to track changes to security groups in a VPC. The engineer wants to be notified when a security group is modified. Which TWO steps are required to achieve this?

Accepted Answer

Configure an SNS topic and subscribe to it to receive notifications when the Config rule triggers.. Options A and D are correct. To monitor security group changes with AWS Config, you need to create an AWS Config rule (option D) that tracks changes to security groups. To receive notifications when the rule triggers, you configure an SNS topic and subscribe to it (option A). Option B is incorrect because AWS CloudTrail logs API calls to security groups, but Config itself monitors resource configuration changes without requiring CloudTrail. Option C is incorrect because Amazon GuardDuty is a threat detection service, not a configuration change monitor. Option E is incorrect because VPC Flow Logs capture network traffic, not configuration changes. The common pitfall is assuming CloudTrail or GuardDuty is necessary, but Config's built-in change tracking suffices.

Answer

Enable AWS CloudTrail to log security group changes.

Answer

Enable Amazon GuardDuty to detect security group modifications.

Answer

Enable VPC Flow Logs to capture security group activity.

Question 19

A company is using AWS KMS to encrypt data at rest. The security team needs to ensure that keys cannot be deleted before a retention period. Which THREE steps should be taken? (Choose three.)

Accepted Answer

Enable AWS CloudTrail to log key deletion events.. Options A, B, and E are correct. Enabling CloudTrail to log key deletion events helps audit attempts. Setting CloudWatch alarms on kms:ScheduleKeyDeletion events provides notification. Scheduling key deletion with a waiting period (e.g., 7 days) implements a retention period. Option C is incorrect because IAM policies can prevent deletion but do not enforce a retention period; the question asks to ensure keys cannot be deleted before a retention period, which requires a waiting period, not just denial. Option D is incorrect because automatic rotation does not prevent deletion.

Answer

Create an IAM policy that denies kms:ScheduleKeyDeletion.

Answer

Enable automatic key rotation.

Question 20

A company uses AWS KMS to encrypt objects in an S3 bucket. The security team wants to ensure that only users with the appropriate KMS key permissions can decrypt objects. Which TWO conditions should be included in the S3 bucket policy to enforce this? (Choose TWO.)

Accepted Answer

"Condition": {"StringEquals": {"kms:ViaService": "s3.us-east-1.amazonaws.com"}}. Options A and E are the only distinct conditions that can be used in an S3 bucket policy to enforce that only users with appropriate KMS key permissions can decrypt objects. kms:ViaService restricts the use of the KMS key to requests coming via the S3 service, and kms:EncryptionContext restricts decryption to requests that include the specific S3 bucket ARN. Option C is identical to A and thus does not provide an additional constraint, making it redundant. Options B and D are not valid condition keys for S3 bucket policies.

Answer

"Condition": {"StringEquals": {"kms:KeySpec": "SYMMETRIC_DEFAULT"}}

Answer

"Condition": {"StringEquals": {"kms:ViaService": "s3.us-east-1.amazonaws.com"}}

Answer

"Condition": {"StringEquals": {"kms:GranteePrincipal": "arn:aws:iam::123456789012:role/Admin"}}