SCS-C02 Practice Exam 3 — 20 Questions

Question 1

Refer to the exhibit. A security engineer reviews this CloudFormation template. The bucket is intended to be private. What is the security issue in the configuration?

Accepted Answer

The PublicAccessBlock configuration is missing the BlockPublicPolicy setting.. The PublicAccessBlock configuration in the template is missing the BlockPublicPolicy setting. Without BlockPublicPolicy enabled, a bucket policy that grants public read access (Effect: Allow, Principal: *, Action: s3:GetObject) can be applied to the bucket, overriding the intended private configuration. The other PublicAccessBlock settings (BlockPublicAcls, IgnorePublicAcls, RestrictPublicBuckets) do not block bucket policies; only BlockPublicPolicy does. The security issue is that the bucket policy, though present, would be blocked if BlockPublicPolicy were enabled, but since it is missing, the bucket becomes publicly accessible.

Answer

The bucket does not have versioning enabled.

Answer

The bucket policy grants public read access to the bucket, which overrides the PublicAccessBlock configuration.

Answer

The bucket policy uses an incorrect resource ARN.

Question 2

A security engineer is configuring a VPC for a highly sensitive application. The VPC must not have a route to the internet, but the application needs to periodically download security patches from a specific domain (patches.example.com). Which solution meets these requirements with minimal operational overhead?

Accepted Answer

Use a VPC endpoint for Amazon S3 and DynamoDB to download patches.. It uses VPC endpoints for Amazon S3 (and optionally DynamoDB) to provide private connectivity to AWS services without requiring an internet gateway. By storing the security patches in an S3 bucket with a custom domain alias (e.g., patches.example.com), the application can download patches through the VPC endpoint, meeting the requirement of no internet route and minimizing operational overhead. Options A and D require an internet gateway, which creates a route to the internet. Option C does not provide access to an external domain like patches.example.com.

Answer

Launch a proxy server in a public subnet and configure the application to use the proxy.

Answer

Create a VPC interface endpoint for AWS Systems Manager and use Systems Manager Patch Manager to apply patches.

Answer

Deploy a NAT gateway in a public subnet and add a route to the NAT gateway for the private subnet.

Question 3

A company runs a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application processes sensitive customer data. The Security team has enabled VPC Flow Logs, CloudTrail, and GuardDuty. Recently, the team received a GuardDuty finding indicating a potential SSH brute force attack originating from an external IP address 203.0.113.50 targeting one of the EC2 instances. The Security Engineer needs to automatically isolate the affected instance and capture forensic evidence for analysis. The company has strict requirements: the instance must be isolated immediately, and a snapshot of the EBS volume must be taken before any remediation actions are taken. The instance is part of an Auto Scaling group, and the Security Engineer wants to minimize manual intervention. The Security Engineer has access to AWS Systems Manager and AWS Lambda. Which combination of steps should the Security Engineer implement to meet the requirements?

Accepted Answer

Configure Amazon EventBridge to detect the GuardDuty finding and invoke an AWS Lambda function. The Lambda function first calls the EC2 CreateSnapshot API to capture a forensic snapshot of the instance's EBS volume. Then, it uses AWS Systems Manager Automation to run a pre-defined automation document that isolates the instance by modifying the instance's security group to only allow traffic from a trusted management IP, and then stops the instance.. It uses EventBridge to directly detect the GuardDuty finding, which triggers a Lambda function that first takes an EBS snapshot (forensic capture) via the CreateSnapshot API before any remediation. Then it uses Systems Manager Automation to isolate the instance by modifying the security group to allow only a trusted management IP and stops the instance, ensuring isolation without destroying the instance. This sequence satisfies the strict requirement that a snapshot must be taken before any remediation actions, and it minimizes manual intervention by automating the entire response.

Answer

Use AWS Systems Manager to automatically connect to the instance via EC2 Instance Connect, run commands to capture forensic data, and then modify the security group to deny all inbound traffic.

Answer

Create a CloudWatch Logs metric filter on the VPC Flow Logs for the attacker IP. When the metric breaches a threshold, trigger an SNS topic that runs an AWS Systems Manager Automation document to isolate the instance and take an EBS snapshot.

Answer

Configure a CloudWatch Events rule to detect the GuardDuty finding and invoke an AWS Lambda function. The Lambda function terminates the EC2 instance and then takes a snapshot of the EBS volume for forensic analysis.

Question 4

A company is designing a VPC with public and private subnets. The web servers in the public subnets must be accessible from the internet on port 443, but the database servers in the private subnets should only be accessible from the web servers on port 3306. Which combination of security group rules and network ACL rules should be used to meet these requirements with the least administrative overhead?

Accepted Answer

Use security groups for all tiers; add an inbound rule to the database security group allowing traffic from the web security group on port 3306.. Security groups are stateful and support referencing other security groups as a source, which allows you to permit traffic from the web security group to the database security group on port 3306 without needing to specify IP addresses. This approach minimizes administrative overhead as security group rules are automatically applied to all instances associated with the group, and changes propagate without updating network ACLs or CIDR ranges. The web security group can have an inbound rule allowing HTTPS (port 443) from the internet (0.0.0.0/0), while the database security group only allows inbound MySQL/Aurora (port 3306) from the web security group, meeting the access requirements precisely.

Answer

Use security groups for all tiers; add an inbound rule to the web security group allowing internet traffic on port 443, and add an outbound rule to the web security group allowing traffic to the database security group on port 3306.

Answer

Use security groups for the web tier and network ACLs for the database tier; add an inbound rule to the database network ACL allowing traffic from the web subnet CIDR on port 3306.

Answer

Use security groups for the web tier and network ACLs for the database tier; add an inbound rule to the database network ACL allowing all traffic from the web security group.

Question 5

A security engineer is investigating a potential data exfiltration incident. The engineer needs to determine whether an IAM user in account A accessed an S3 bucket in account B. The engineer has access to both accounts. Which combination of steps should the engineer take to identify the cross-account access?

Accepted Answer

Enable CloudTrail in account B and check the S3 event history for the bucket.. To identify cross-account access to an S3 bucket, enable CloudTrail in the account that owns the bucket (account B) and configure a trail with data events for S3 object-level operations. This captures the IAM user ARN from account A in the CloudTrail event. S3 server access logging (Option A) can also provide similar details, but CloudTrail is the recommended approach for auditing API calls. Ensure data events are enabled for the bucket.

Answer

Enable S3 server access logging on the bucket in account B and check the logs.

Answer

Enable CloudTrail in account A and check the S3 event history.

Answer

Enable CloudWatch Logs in account A and check the S3 access logs.

Question 6

A security engineer is troubleshooting why CloudTrail is not delivering logs to an S3 bucket. The bucket policy allows CloudTrail to write objects, and the trail is configured with the correct bucket name. However, no log files appear. What is the most likely cause?

Accepted Answer

The S3 bucket uses AWS KMS server-side encryption (SSE-KMS) and the KMS key policy does not grant CloudTrail permission to use the key.. When CloudTrail is configured to deliver logs to an S3 bucket that uses SSE-KMS, CloudTrail must have explicit permission to use the KMS key for encrypting the log files. Even if the bucket policy allows CloudTrail to write objects, the KMS key policy must grant the `kms:GenerateDataKey` and `kms:Decrypt` actions to the CloudTrail service principal. Without these permissions, CloudTrail cannot encrypt the logs, and delivery fails silently—no log files appear.

Answer

The S3 bucket has an S3 Object Lock configuration that prevents writes.

Answer

The S3 bucket is in a different AWS Region from the trail.

Answer

CloudTrail is not enabled in the AWS Region where the S3 bucket resides.

Question 7

A company is using Amazon EC2 instances in a VPC with a security group that allows inbound SSH from 0.0.0.0/0. A security engineer needs to restrict SSH access to only the company's public IP range (203.0.113.0/24) while maintaining all other existing rules. What is the MOST efficient way to accomplish this?

Accepted Answer

Modify the existing security group rule to change the source from 0.0.0.0/0 to 203.0.113.0/24.. Modifying the existing security group rule's source from 0.0.0.0/0 to 203.0.113.0/24 directly restricts inbound SSH to the company's public IP range without affecting any other rules. Security groups are stateful and rule changes apply immediately, making this the most efficient approach as it requires only a single edit to the existing rule.

Answer

Disable SSH and use AWS Systems Manager Session Manager to connect to instances.

Answer

Create a network ACL with an inbound rule allowing SSH from 203.0.113.0/24 and deny all other traffic.

Answer

Create a new security group rule allowing SSH from 203.0.113.0/24 and keep the existing rule.

Question 8

A company has a requirement to retain AWS CloudTrail logs for 7 years for compliance. The logs are stored in an S3 bucket. The company wants to reduce storage costs by automatically moving older logs to a cheaper storage class. Which solution should the company implement?

Accepted Answer

Configure an S3 Lifecycle policy to transition objects from S3 Standard to S3 Glacier after a specified number of days.. An S3 Lifecycle policy can automatically transition CloudTrail logs from S3 Standard to S3 Glacier after a specified number of days, meeting the 7-year retention requirement while reducing storage costs. S3 Glacier is designed for long-term archival at low cost, and lifecycle rules can be configured to transition objects directly or through intermediate classes like S3 Standard-IA. S3 Intelligent-Tiering (Option A) also automatically optimizes costs and supports archival tiers, but it works based on access patterns, not fixed age-based rules, and incurs per-object monitoring fees. For compliance-driven, age-based retention, a Lifecycle policy is the more direct and cost-effective solution.

Answer

Use S3 Intelligent-Tiering to automatically move logs to the most cost-effective access tier.

Answer

Move logs to S3 Standard-IA after 30 days.

Answer

Use S3 Batch Operations to manually copy logs to S3 Glacier.

Question 9

A security engineer discovers an Amazon GuardDuty finding of type 'UnauthorizedAccess:EC2/SSHBruteForce' for an EC2 instance. The instance is part of an Auto Scaling group and has a public IP address. What is the MOST effective immediate step to mitigate the threat?

Accepted Answer

Detach the instance from the Auto Scaling group and terminate it.. The instance is compromised and part of an Auto Scaling group. Detaching it first prevents the Auto Scaling group from immediately replacing it with a new instance that might inherit the same vulnerability, allowing for forensic analysis. Terminating it after detachment stops the SSH brute force attack at its source without risking automatic re-provisioning of a similarly exposed instance.

Answer

Modify the network ACL to block SSH traffic from the attacker's IP.

Answer

Terminate the instance without detaching it from the Auto Scaling group.

Answer

Update the security group to restrict SSH access to known IP addresses.

Question 10

A company wants to restrict access to an Amazon S3 bucket so that only users from a specific AWS account can upload objects. Which policy mechanism should be used?

Accepted Answer

Create a bucket policy with a condition that checks the aws:SourceAccount condition key.. A bucket policy with the `aws:SourceAccount` condition key allows you to restrict access to a specific AWS account. When users from the allowed account upload objects, the condition evaluates the source account ID, ensuring only requests originating from that account are permitted. This is the recommended approach for cross-account access control in S3, as it directly enforces the account-level restriction at the bucket policy level.

Answer

Attach an IAM policy to the bucket that denies access to all users except those from the allowed account.

Answer

Generate a pre-signed URL for each upload request.

Answer

Configure the bucket ACL to grant access only to the allowed account's canonical user ID.

Question 11

An organization uses AWS Organizations with hundreds of accounts. The security team wants to automatically respond to a specific GuardDuty finding by isolating the affected EC2 instance. What is the recommended architecture?

Accepted Answer

Use EventBridge to trigger a Lambda function in the delegated administrator account, which assumes an IAM role in the affected account to isolate the instance.. It follows the recommended architecture for cross-account automated response to GuardDuty findings. EventBridge in the delegated administrator account captures the finding and triggers a Lambda function, which then assumes an IAM role (using STS AssumeRole) in the affected member account to perform the isolation. This pattern centralizes management while respecting the security boundary between accounts.

Answer

Configure GuardDuty to invoke a Lambda function in the affected account directly.

Answer

Use EventBridge to send the finding to a Step Functions workflow that isolates the instance.

Answer

Use AWS Systems Manager Automation to isolate the instance across accounts.

Question 12

A security engineer sees the above security group configuration for an EC2 instance. The instance hosts a web application that should only be accessible from the internal network (10.0.0.0/8) over HTTPS, and SSH should not be open to the internet. What is the security issue with this configuration?

Accepted Answer

The outbound rule allows all traffic to all destinations.. The outbound rule allowing all traffic to all destinations (0.0.0.0/0) violates the principle of least privilege. While the inbound rules restrict HTTPS to the internal network (10.0.0.0/8) and SSH is not open to the internet, the outbound rule permits any instance in the security group to initiate connections to any IP address and port, including malicious external hosts. This could allow data exfiltration or outbound attacks, which is a security issue even if inbound access is properly restricted.

Answer

The inbound HTTPS rule is too permissive.

Answer

The inbound SSH rule is too permissive.

Answer

There is no security issue; the configuration is correct.

Question 13

A security engineer needs to identify which IAM users have been inactive for the past 90 days. Which AWS service should the engineer use?

Accepted Answer

AWS IAM Credential Report. AWS IAM Credential Report is the correct service because it provides a CSV report that lists all IAM users in an account and includes the `password_last_used` and `access_key_last_used_date` fields. By examining these fields, a security engineer can determine which users have not authenticated or used their access keys for more than 90 days, directly meeting the requirement to identify inactive IAM users.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

AWS CloudTrail

Question 14

A financial services company uses a multi-account AWS organization with a centralized security account. The security team has enabled Amazon GuardDuty in all accounts and configured it to send findings to the security account via AWS Organizations. The team also uses AWS Security Hub in the security account to aggregate findings. They have set up automated response using AWS Systems Manager Automation documents to isolate compromised EC2 instances by applying a security group that denies all traffic. However, during a recent incident, the automation failed because the Systems Automation document did not have permission to modify the security group in the member account. The security team needs to design a solution that allows the security account to automatically isolate instances in any member account. What should they do?

Accepted Answer

Use AWS CloudFormation StackSets to deploy an IAM role in each member account with permissions to modify security groups. Then, in the security account, configure the Systems Manager Automation document to assume that role when running the isolation step.. It uses AWS CloudFormation StackSets to deploy an IAM role in each member account with the necessary permissions to modify security groups. The Systems Manager Automation document in the security account can then assume this role via a cross-account IAM role assumption, allowing it to isolate EC2 instances in any member account without requiring a single monolithic role or per-account Lambda functions.

Answer

Create a Lambda function in each member account that is triggered by GuardDuty findings and modifies the security group.

Answer

Create a single IAM role in the security account that has permissions to modify security groups in all member accounts.

Answer

Modify the IAM role used by Systems Manager Automation in the security account to include permissions to modify security groups in all member accounts.

Question 15

A company wants to centrally collect CloudTrail logs from multiple AWS accounts and enable real-time analysis. Which combination of services should be used?

Accepted Answer

CloudTrail, Amazon S3, S3 Event Notifications, and AWS Lambda.. It enables centralized collection of CloudTrail logs from multiple accounts by delivering logs to a central S3 bucket, then using S3 Event Notifications to trigger a Lambda function for real-time analysis. This pattern allows near-instant processing of log events as they arrive, meeting the requirement for real-time analysis without polling or batching delays.

Answer

CloudTrail, Amazon Kinesis Data Firehose, and Amazon Athena.

Answer

CloudTrail, Amazon CloudWatch Logs, and cross-account log subscription.

Answer

CloudTrail, Amazon S3, and Amazon Simple Queue Service (SQS).

Question 16

A Security Engineer needs to block SSH traffic (port 22) from the internet to all EC2 instances in a VPC. Which approach is the most secure and scalable?

Accepted Answer

Add a network ACL rule to deny inbound traffic on port 22 from 0.0.0.0/0 at the subnet level.. Network ACLs (NACLs) are stateless and operate at the subnet level, allowing you to explicitly deny inbound SSH traffic from 0.0.0.0/0. This approach is more secure and scalable than security group rules because NACLs can block traffic before it reaches the instance, and they support explicit deny rules, which security groups do not. Security groups only support allow rules, so you cannot add a deny rule to block SSH traffic; you must omit the allow rule, which is less explicit and can be accidentally overridden.

Answer

Add a security group rule to deny inbound traffic on port 22 from 0.0.0.0/0.

Answer

Add a network ACL rule to allow inbound traffic on port 22 from 0.0.0.0/0 and then add a deny rule for the same traffic.

Answer

Add a security group rule to block inbound traffic on port 22 from 0.0.0.0/0 at the VPC level.

Question 17

A security engineer notices that an Amazon S3 bucket has been accessed from an IP address outside the company's allowed range. The engineer needs to identify the IAM user who made the request. Which AWS service should be used to find this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to AWS services, including S3 operations, and captures the identity of the IAM user or role that made the request. By examining CloudTrail logs, the security engineer can find the specific IAM user associated with the source IP address that accessed the bucket, as CloudTrail logs include both the user identity and the source IP address for each event.

Answer

S3 server access logs

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Question 18

During an incident, a security engineer needs to isolate a compromised Amazon EC2 instance without losing the ability to capture forensic data from its EBS volumes. What is the best course of action?

Accepted Answer

Take a snapshot of the EBS volumes, then detach the instance from the Auto Scaling group and modify the security group to deny all traffic.. Taking a snapshot of the EBS volumes preserves the forensic data before any changes occur, while detaching the instance from the Auto Scaling group prevents automatic replacement, and modifying the security group to deny all traffic isolates the instance without losing the running state or the ability to capture additional volatile data. This approach balances isolation with forensic preservation, ensuring the instance remains available for further analysis if needed.

Answer

Terminate the instance immediately and take a snapshot after termination.

Answer

Stop the instance, detach the volumes, and attach them to a forensic instance.

Answer

Change the security group to restrict traffic to only the forensic team's IP addresses.

Question 19

A security engineer is configuring a new VPC with public and private subnets. The application servers in the private subnet need to download patches from the internet. Which component is required?

Accepted Answer

NAT gateway. A NAT gateway is required to allow instances in a private subnet to initiate outbound traffic to the internet (e.g., to download patches) while preventing the internet from initiating inbound connections to those instances. The NAT gateway resides in a public subnet with an attached Internet Gateway, and it translates the private IP addresses of the application servers to the NAT gateway's Elastic IP address for outbound traffic.

Answer

VPC endpoint

Answer

Direct Connect

Answer

Internet gateway

Question 20

A security engineer is designing an incident response plan for a containerized application running on Amazon ECS with Fargate. The engineer needs to ensure that if a container is compromised, the incident response team can capture a memory dump and disk snapshot for forensic analysis. The containers are stateless and use ephemeral storage. Which approach provides the necessary forensic data?

Accepted Answer

Use ECS Exec to access the container and capture a memory dump; snapshot the task's ephemeral storage.. ECS Exec allows interactive access to a running container without stopping it, enabling the capture of a memory dump (e.g., via `gcore` or `/proc/kcore`). Additionally, the task's ephemeral storage can be snapshotted while the container is still running, preserving disk state for forensic analysis. This approach aligns with incident response best practices for stateless containers on Fargate, where traditional host-level forensics are unavailable.

Answer

Configure the container to stream /dev/mem to CloudWatch Logs.

Answer

Enable ECS task memory dumps to CloudWatch Logs.

Answer

Stop the task and create a new task from the same image.