SCS-C02 Practice Exam 4 — 20 Questions

Question 1

A company uses AWS Organizations to manage multiple accounts. The security team wants to enable CloudTrail for all accounts and centrally store logs. What is the most efficient way to achieve this?

Accepted Answer

Create a CloudTrail trail in the management account and apply it to all accounts in the organization. AWS Organizations allows you to create a single CloudTrail trail in the management account that automatically applies to all member accounts within the organization. This is the most efficient method as it eliminates the need for manual per-account configuration or custom automation, and it ensures consistent logging across the entire organization with centralized log delivery to a single S3 bucket.

Answer

Use an S3 bucket policy to allow cross-account log delivery

Answer

Use AWS Lambda to create trails in each account

Answer

Ask each account admin to create their own CloudTrail trail and deliver to a central S3 bucket

Question 2

A company wants to encrypt data at rest in Amazon S3 using server-side encryption with Amazon S3-managed keys (SSE-S3). What is the minimum permission required for an IAM user to upload an object that will be encrypted with SSE-S3?

Accepted Answer

s3:PutObject. (s3:PutObject) is correct. SSE-S3 does not require any special permissions beyond s3:PutObject; S3 handles the encryption automatically. Option A (s3:PutObjectAcl) is wrong because it is for managing object ACLs, not for uploading. Option B (kms:Decrypt) is wrong because it is not needed for SSE-S3; kms:Decrypt is used for decryption with KMS. Option D (kms:GenerateDataKey) is wrong because it is needed for SSE-KMS, not SSE-S3.

Answer

s3:PutObjectAcl

Answer

kms:Decrypt

Answer

kms:GenerateDataKey

Question 3

A company is designing a data protection strategy for Amazon EFS file systems. The security team requires encryption at rest and in transit. Additionally, the team needs to control which KMS keys can be used to encrypt the file system. Which THREE steps should the team take?

Accepted Answer

Configure a KMS key policy that allows the EFS service to use the key.. You must configure the KMS key policy to allow the EFS service to use the key for encryption at rest. Option B is correct because encryption at rest is enabled by specifying a customer-managed KMS key when creating the EFS file system. Option E is correct because encryption in transit is enabled by using the TLS option when mounting the file system on the client. Option C is incorrect because EFS does not support SSE-S3; it uses KMS for encryption at rest. Option D is incorrect because IAM policies can restrict who can create encrypted file systems, but the question specifically asks about controlling which KMS keys can be used, which is done via KMS key policies, not IAM policies.

Answer

Enable default encryption on the EFS file system using SSE-S3.

Answer

Use an IAM policy to restrict which users can create encrypted file systems.

Question 4

A company has an AWS environment with multiple accounts managed under AWS Organizations. The security team wants to enforce that all newly created S3 buckets in any account have encryption enabled by default. Which approach should the security team take?

Accepted Answer

Create a Service Control Policy (SCP) that denies the creation of S3 buckets without encryption.. A Service Control Policy (SCP) can be applied at the organizational level to deny the creation of S3 buckets without encryption, enforcing the policy across all accounts proactively. Option A is wrong because AWS Config rules are reactive and only detect violations after buckets are created. Option B is wrong because S3 default encryption is a bucket-level setting that must be configured per bucket, not an organization-wide enforcement. Option C is wrong because IAM policies are account-specific and cannot be centrally enforced across all accounts in the organization.

Answer

Use AWS Config rules to detect unencrypted buckets and send alerts.

Answer

Enable S3 default encryption in each account's S3 settings.

Answer

Apply an IAM policy to the root user of each account to enforce bucket encryption.

Question 5

A security engineer is troubleshooting an issue where an EC2 instance cannot access an S3 bucket via a VPC endpoint. The bucket policy allows access only from the VPC endpoint. The instance has an IAM role that grants s3:GetObject on the bucket. The EC2 instance receives an AccessDenied error. What is the most likely cause?

Accepted Answer

The bucket policy does not include the aws:SourceVpce condition.. The AccessDenied error occurs because the S3 bucket policy must include the aws:SourceVpce condition to allow access from the specific VPC endpoint. Without this condition, the bucket policy denies all requests that do not originate from the endpoint, regardless of IAM permissions. Option B is correct because the missing condition is the most likely cause.

Answer

The IAM role does not have sufficient permissions.

Answer

The VPC endpoint policy is blocking the request.

Answer

The EC2 instance's security group does not allow outbound traffic to S3.

Question 6

A company has a multi-account AWS environment with 50 accounts. The security team uses AWS CloudTrail to log management events in each account and delivers logs to a centralized S3 bucket in the security account. Recently, the team noticed that some CloudTrail logs are missing from the central bucket for a few accounts. The logs appear to be delivered intermittently. The security engineer checks the CloudTrail configuration in one of the affected accounts and sees that the trail is configured to deliver to the central bucket. The bucket policy in the security account allows CloudTrail to write from all accounts. The engineer also checks the CloudTrail console and sees that the trail status is 'Logging'. What is the MOST likely cause of the intermittent log delivery?

Accepted Answer

The CloudTrail trail is using Kinesis Data Firehose for delivery, which has a throughput limit.. The most likely cause is that the CloudTrail trail is configured to deliver logs via Kinesis Data Firehose, which has a throughput limit. If the volume of log data exceeds the Firehose stream's capacity, some logs may fail to be delivered, resulting in intermittent missing logs. Option A is incorrect because S3 default encryption (SSE-S3) does not interfere with CloudTrail writes; CloudTrail can write to encrypted buckets. Option B is incorrect because a lifecycle policy deletes objects after they are stored, not during delivery, so it would not cause intermittent missing logs. Option D is incorrect because CloudTrail does not use SQS for log delivery; it delivers directly to S3 or via Firehose.

Answer

The S3 bucket has default encryption enabled, which interferes with CloudTrail writes.

Answer

The S3 bucket has a Lifecycle policy that deletes objects prematurely.

Answer

The CloudTrail trail in each account is not associated with an SQS queue, causing delivery failures.

Question 7

A company is using AWS Organizations to manage multiple accounts. The security team wants to prevent the creation of Amazon EC2 instances with public IP addresses in all accounts. Which TWO actions should the team take to implement this control using Service Control Policies (SCPs)?

Accepted Answer

Create an SCP with a Deny effect for ec2:RunInstances where the request parameter ec2:AssociatePublicIpAddress is true.. An SCP with a Deny effect for ec2:RunInstances can use the condition key ec2:AssociatePublicIpAddress to block instance creation when a public IP is requested. Option D is correct because attaching the SCP to the root OU ensures it applies to all accounts in the organization. Option A is wrong because the condition key ec2:LaunchTemplate is used to restrict based on launch templates, not public IP assignment. Option B is wrong because SCPs do not add IAM policies; they set permission boundaries that deny or allow actions. Option E is wrong because SCPs can deny actions based on tags but the condition key for public IP is ec2:AssociatePublicIpAddress, not a tag.

Answer

Use the condition key 'ec2:LaunchTemplate' to deny public IPs.

Answer

Create an SCP that adds an IAM policy to deny ec2:RunInstances.

Answer

Create an SCP that requires the tag 'PublicIP' to be set to 'false'.

Question 8

A company is required to audit all changes to IAM policies. Which AWS service should be used to record these changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API activity in your AWS account, including all IAM policy changes made via the AWS Management Console, SDKs, CLI, or AWS services. Each event is captured as a CloudTrail event with details such as the identity making the request, the time of the request, and the request parameters, enabling a complete audit trail of IAM policy modifications.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

Amazon S3

Answer

IAM Access Analyzer

Question 9

Refer to the exhibit. A security engineer is reviewing this IAM policy attached to a user. The user reports that they are able to stop and start instances, but they cannot terminate instances. However, the engineer notices that there is no explicit deny for termination. Why is the user unable to terminate instances?

Accepted Answer

The policy does not include an explicit Allow for ec2:TerminateInstances.. IAM policies operate on an explicit allow model. Even though there is no explicit deny for ec2:TerminateInstances, the user is unable to terminate instances because the policy does not include an explicit Allow action for ec2:TerminateInstances. Without an explicit Allow, the default behavior is to deny the action, regardless of whether a deny statement is present.

Answer

The second statement's Resource is set to '*' but the Action list does not include termination.

Answer

The first statement's Resource element is too restrictive and does not include the termination API call.

Answer

The policy has a syntax error that prevents termination from being evaluated.

Question 10

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. Which component should be added to the VPC to enable this?

Accepted Answer

NAT gateway. (NAT gateway). A NAT gateway enables instances in a private subnet to initiate outbound traffic to the internet for tasks like software updates, while preventing inbound traffic from the internet. Option A (Internet gateway) is incorrect because it is used for public subnets to allow direct internet access. Option B (VPN connection) is used for secure connectivity to an on-premises network, not for outbound internet access. Option C (VPC peering connection) is used to connect two VPCs, not to provide internet access.

Answer

Internet gateway

Answer

VPN connection

Answer

VPC peering connection

Question 11

A security engineer is investigating a potential data exfiltration incident. The engineer notices large volumes of data being transferred from an Amazon S3 bucket to an external IP address. Which AWS services can be used to detect and alert on such behavior? (Choose THREE.)

Accepted Answer

Amazon CloudWatch Logs with S3 access log analysis.. Amazon CloudWatch Logs can ingest and analyze S3 access logs, which record detailed information about requests made to an S3 bucket, including the source IP address, request type, and bytes transferred. By analyzing these logs with CloudWatch Logs Insights or metric filters, you can detect large data transfers to external IPs and trigger alerts via CloudWatch Alarms, making it a valid detection and alerting mechanism for data exfiltration.

Answer

AWS Config with compliance rules.

Answer

VPC Flow Logs.

Question 12

A security engineer is designing a VPC with a public subnet and a private subnet. The private subnet will host a database instance that should only be accessible from the application instances in the public subnet. The application instances use an Auto Scaling group. Which configuration ensures that only the application instances can access the database?

Accepted Answer

Allow inbound database port from the security group attached to the application instances in the public subnet.. Security group rules can reference other security groups, allowing dynamic scaling of the application instances without needing to update CIDR blocks. Auto Scaling group instances are automatically assigned the application security group, so only they can access the database. Option B is incorrect because allowing 0.0.0.0/0 would expose the database to the internet. Option C is incorrect because network ACLs are stateless and cannot reference security groups; they would require explicit rules for return traffic. Option D is incorrect because referencing the public subnet CIDR would allow any instance in that subnet, not just the application instances, and would not handle changes in the application instances' IPs.

Answer

Allow inbound database port from 0.0.0.0/0 in the database security group.

Answer

Configure a network ACL on the private subnet to allow the database port from the public subnet CIDR.

Answer

Allow inbound database port from the public subnet CIDR block in the database security group.

Question 13

A company needs to grant cross-account access to an S3 bucket. Which IAM feature should be used?

Accepted Answer

Use an S3 bucket policy that grants access to the external account's IAM users.. A bucket policy can grant access to principals in another account. Option A is wrong because IAM users are within the same account. Option C is wrong because SCPs apply within an organization. Option D is wrong because a role can be used but requires the external account to assume the role, not directly access the bucket.

Answer

Create an IAM user in the source account and share the credentials.

Answer

Use a service control policy (SCP) to allow cross-account access.

Answer

Use an IAM role in the source account that the external account can assume.

Question 14

An organization wants to enforce that all IAM users must use MFA to access the AWS API. Which TWO steps should be taken?

Accepted Answer

Attach the policy to all IAM users or to a group that all users belong to.. Options B and C are correct. An IAM policy with a condition that denies access if MFA is not present (C) must be attached to all users or groups (B). Option A is wrong because rotating access keys does not enforce MFA. Option D is wrong because password policy only affects console login. Option E is wrong because SCPs cannot enforce MFA for IAM users in the same account; they apply to member accounts.

Answer

Rotate all IAM user access keys.

Answer

Configure the account password policy to require MFA.

Answer

Create a service control policy (SCP) that requires MFA for all API calls.

Question 15

A security engineer is investigating a potential data exfiltration incident. They suspect that an EC2 instance was compromised and used to transfer large amounts of data from an S3 bucket to an external IP address. The engineer has enabled VPC Flow Logs for the subnet where the EC2 instance resides, but the logs are not capturing traffic to the external IP. What is the most likely reason?

Accepted Answer

The traffic is routed through a NAT gateway, and flow logs are not enabled on the NAT gateway's subnet.. VPC Flow Logs capture traffic at the subnet or ENI level. If traffic from an EC2 instance to an external IP is routed through a NAT gateway, the flow logs on the EC2 instance's subnet will only show traffic to the NAT gateway, not the external IP. To capture the external traffic, flow logs must be enabled on the subnet where the NAT gateway resides. Option A is incorrect because Security Groups do not affect flow log capture; they filter traffic but flow logs log both accepted and rejected traffic. Option B is incorrect because VPC Flow Logs capture all traffic, not just rejected. Option C is incorrect because flow logs capture traffic to any IP, not just other VPC resources.

Answer

The EC2 instance's security group is blocking the traffic.

Answer

VPC Flow Logs only capture rejected traffic.

Answer

VPC Flow Logs only capture traffic to and from other VPC resources.

Question 16

A company wants to protect data stored in Amazon S3 by encrypting it at rest using keys managed by the company. Which encryption option should be used?

Accepted Answer

SSE-C. (SSE-KMS) is incorrect because while the customer can manage KMS keys, they are stored and managed by AWS KMS, not directly provided by the customer. The question specifies the company manages the keys themselves. Option B (SSE-C) is correct because it allows the customer to provide their own encryption keys and manage them outside AWS. Option C (client-side encryption) is incorrect because it encrypts data before upload, not at rest in S3. Option D (SSE-S3) is incorrect because it uses AWS-managed keys, not customer-managed keys.

Answer

SSE-KMS

Answer

Client-side encryption

Answer

SSE-S3

Question 17

A security engineer is configuring Amazon Inspector to assess EC2 instances for software vulnerabilities. The engineer has installed the SSM Agent on all instances and ensured that the instances have internet access. However, Amazon Inspector shows the instances as 'Unmanaged'. What is the MOST likely cause?

Accepted Answer

The SSM Agent is not running or is not registered with AWS Systems Manager.. Amazon Inspector requires EC2 instances to be managed by AWS Systems Manager (SSM) to install the SSM Agent and register it with the Systems Manager service. If the SSM Agent is not running or not registered, the instance cannot communicate with Systems Manager, and Inspector will report it as 'Unmanaged'. Even with internet access and the agent installed, the agent must be actively running and registered for the instance to be properly managed.

Answer

The IAM role attached to the EC2 instance does not have permissions to publish metrics to CloudWatch.

Answer

The security group attached to the instance blocks outbound traffic to the Amazon Inspector service.

Answer

The instance does not have the EC2 instance metadata service enabled.

Question 18

A Security Engineer is configuring a VPC with a public subnet for a web server and a private subnet for a database. The web server needs to download patches from the internet. Which TWO actions should the Engineer take to allow the web server internet access without exposing the database to the internet?

Accepted Answer

Create a NAT Gateway in the public subnet.. A NAT Gateway in the public subnet allows instances in the private subnet to initiate outbound IPv4 traffic to the internet (e.g., to download patches) while preventing unsolicited inbound connections from the internet. By adding a route in the private subnet's route table that points 0.0.0.0/0 to the NAT Gateway, the web server's outbound traffic is forwarded to the NAT Gateway, which then uses the Internet Gateway to reach the internet. The database remains isolated because it has no direct route to the Internet Gateway and no public IP address.

Answer

Create a bastion host in the public subnet and configure the web server to use it as a proxy.

Answer

Create a VPC endpoint for Amazon S3.

Answer

Attach an Internet Gateway to the VPC and add a route to the Internet Gateway in the private subnet's route table.

Question 19

Which TWO actions can be taken to protect an S3 bucket from accidental public access? (Choose 2.)

Accepted Answer

Enable S3 Block Public Access at the account level. Options A and B are correct. Enabling S3 Block Public Access at the account level (option A) prevents any public access to all buckets. Using a bucket policy with a condition that denies s3:PutBucketPolicy unless the request comes from a specific VPC (option B) ensures that only authorized VPCs can modify the bucket policy, preventing accidental public exposure. Option C is wrong because default encryption does not affect public access. Option D is wrong because MFA Delete protects against accidental deletion, not public access. Option E is wrong because requiring MFA for S3 actions does not prevent public access.

Answer

Enable default encryption for the bucket

Answer

Enable MFA Delete on the bucket

Answer

Use an IAM policy that requires MFA for all S3 actions

Question 20

A security engineer is designing a VPC with private and public subnets. Which TWO actions improve network security? (Choose two.)

Accepted Answer

Use security groups to restrict traffic to the database from only the application tier.. Security groups act as a stateful virtual firewall at the instance level, allowing you to restrict inbound traffic to the database instances to only the application tier's security group. This ensures that only traffic originating from the application instances can reach the database, effectively implementing a least-privilege security model.

Answer

Use a single subnet for all resources to simplify network rules.

Answer

Place database instances in a public subnet for easier management.

Answer

Place an internet gateway in a private subnet.