SCS-C02 Practice Test 21 — 15 Questions

Question 1

A security engineer notices that an EC2 instance is sending outbound traffic to a known malicious IP address. The engineer needs to immediately block the traffic and capture a packet capture for forensic analysis. Which combination of actions should the engineer take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a network ACL deny rule for the malicious IP, and enable VPC Traffic Mirroring.. A network ACL (NACL) is a stateless firewall that operates at the subnet level, allowing immediate blocking of traffic to/from a specific IP address without affecting the instance's security group rules. Enabling VPC Traffic Mirroring captures a full packet-level copy of the traffic for forensic analysis, which is superior to VPC Flow Logs (which only capture metadata). This combination provides both rapid containment and deep forensic data.

Answer

Use Amazon GuardDuty to block the IP and enable VPC Traffic Mirroring.

Answer

Stop the EC2 instance and enable VPC Flow Logs.

Answer

Modify the security group to deny outbound traffic to the IP, and enable VPC Flow Logs.

Question 2

A security engineer is configuring automated response to a specific GuardDuty finding type. The engineer wants to automatically block the offending IP address in the security group when a finding is generated. Which TWO AWS services should the engineer use together to achieve this? (Choose TWO.)

Accepted Answer

AWS Lambda. AWS Lambda is correct because it can execute custom code to modify security group rules, such as removing an offending IP address. Amazon EventBridge is correct because it can capture GuardDuty findings as events and trigger the Lambda function in response to a specific finding type. Together, they enable automated, event-driven remediation without manual intervention.

Answer

AWS Config

Answer

Amazon Simple Notification Service (SNS)

Answer

Amazon CloudWatch Logs

Question 3

An organization wants to detect and alert on any IAM user that creates a new access key without using multi-factor authentication (MFA). What is the MOST efficient way to achieve this?

Accepted Answer

Create a CloudWatch Events rule that triggers on CreateAccessKey events, and check if the user's MFA status is inactive.. CloudWatch Events (now Amazon EventBridge) can capture the CreateAccessKey API call in real time, and a Lambda target can check the IAM user's MFA status via the GetLoginProfile or ListMFADevices API. This provides immediate detection and alerting without polling or log analysis, making it the most efficient approach for this specific requirement.

Answer

Analyze S3 server access logs to detect access key creation.

Answer

Enable AWS Config managed rule for IAM user MFA, which monitors if users have MFA enabled.

Answer

Use IAM Access Analyzer to monitor for unused access keys.

Question 4

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The Security Engineer needs to ensure that traffic between VPCs is inspected by a central network appliance. Which architecture should the Engineer implement?

Accepted Answer

Use Transit Gateway with appliance mode enabled on the attachments to the inspection VPC, and route inter-VPC traffic through the inspection VPC.. Enabling appliance mode on the Transit Gateway attachments to the inspection VPC forces the Transit Gateway to preserve the source and destination MAC addresses of packets, ensuring that asymmetric routing does not cause the network appliance to drop traffic. By routing inter-VPC traffic through the inspection VPC, the appliance can inspect all packets, and appliance mode ensures that return traffic is sent back through the same appliance, maintaining stateful inspection.

Answer

Use VPC Peering connections between all VPCs and route traffic through the inspection VPC.

Answer

Place the network appliance in a public subnet of the inspection VPC and use internet gateways for routing.

Answer

Use Transit Gateway with route tables that point to the network appliance's ENI for all inter-VPC traffic.

Question 5

Refer to the exhibit. A security engineer applied the bucket policy shown. What is the effect of this policy?

Accepted Answer

Only GetObject requests that use HTTP are denied.. The bucket policy includes a Deny statement for s3:GetObject requests that are not using HTTPS. The condition `aws:SecureTransport` is set to false, meaning the request is over HTTP. Therefore, any GetObject request made over HTTP is denied. PutObject requests are not affected, and GetObject requests over HTTPS are allowed regardless of IP address.

Answer

All PutObject requests are denied.

Answer

Only GetObject requests from specific IP ranges are denied.

Answer

All GetObject requests to the bucket are denied.

Question 6

A security engineer notices that an EC2 instance is sending outbound traffic to a known malicious IP address. The engineer needs to immediately block the traffic and capture a packet capture for forensic analysis. Which combination of actions should the engineer take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The VPC has an egress-only internet gateway for IPv6 traffic.. An egress-only internet gateway (EIGW) allows outbound IPv6 traffic from instances in a private subnet without requiring a public IPv4 address or NAT. Since the instance is making outbound connections to the internet and has no public IP or NAT, and the VPC likely has IPv6 enabled, the EIGW is the most plausible cause. Option D is incorrect because a default route to an internet gateway requires the instance to have a public IPv4 address for return traffic, which contradicts the scenario.

Answer

The instance has a public IP assigned automatically via Auto-assign Public IP.

Answer

The instance is using a VPC endpoint (Gateway type) for S3.

Answer

The subnet's route table has a default route (0.0.0.0/0) pointing to an internet gateway.

Question 7

A security engineer notices that an IAM user has permissions to launch EC2 instances but the engineer wants to ensure that all new instances are automatically tagged with the creator's user name. What is the most efficient way to enforce this?

Accepted Answer

Add an IAM policy to the user that uses a condition key 'aws:RequestTag/Creator' with a value '${aws:username}'.. Using an IAM policy with a condition key 'aws:RequestTag/Creator' set to '${aws:username}' ensures that any EC2 RunInstances request must include the tag 'Creator' with the IAM user's name, otherwise the request is denied. This enforces tagging at the time of instance creation. Option A (CloudTrail) only provides auditing, not enforcement. Option C (AWS Config rules) can detect and remediate after creation but is less efficient than proactive enforcement. Option D (SCP) can deny based on missing tags but cannot enforce the tag value to match the user name; also, SCPs are used for account-wide policies, not per-user.

Answer

Use AWS CloudTrail to monitor and alert on untagged instances.

Answer

Use AWS Config rules to automatically tag resources after creation.

Answer

Create an SCP that denies EC2:RunInstances unless the request includes a 'Creator' tag with the user name.

Question 8

A company uses a multi-account AWS Organizations setup with hundreds of accounts. The security team uses AWS Security Hub in the management account to aggregate findings from all accounts. They have configured Amazon GuardDuty in all accounts and enabled AWS Config with recording. Recently, they noticed that Security Hub is not displaying any findings from GuardDuty in member accounts, even though GuardDuty is generating sample findings. The security team has verified that the Security Hub integration with GuardDuty is enabled in the management account. What is the most likely reason for the missing findings?

Accepted Answer

The member accounts have not enabled the integration between GuardDuty and Security Hub.. In a multi-account AWS Organizations setup, Security Hub in the management account aggregates findings from member accounts only if each member account has explicitly enabled the integration between GuardDuty and Security Hub. Even if GuardDuty is generating sample findings in member accounts, Security Hub will not display those findings unless the member account has enabled the GuardDuty-to-SecurityHub integration (via the Security Hub console or API). The management account enabling the integration does not automatically propagate the integration to member accounts.

Answer

The IAM role for Security Hub in the management account lacks permissions to read findings from member accounts.

Answer

AWS Security Hub is not enabled in the member accounts.

Answer

Amazon GuardDuty is not enabled in the member accounts.

Question 9

A company uses AWS CloudTrail to log all API calls across multiple accounts in AWS Organizations. The security team notices that management events are being logged, but data events for Amazon S3 are not appearing in the CloudTrail logs for any account. The team needs to enable data event logging for S3 across all accounts. Currently, the organization trail is configured in the management account, and all member accounts have default CloudTrail configurations. What is the MOST efficient way to enable S3 data event logging for all current and future accounts in the organization?

Accepted Answer

Update the existing organization trail's event selectors in the management account to include S3 data events for all accounts.. An organization trail in the management account can have its event selectors updated to include S3 data events for all accounts in the organization. This change automatically applies to all existing and future member accounts, as organization trails are replicated to all accounts by AWS CloudTrail. No additional configuration is needed in member accounts, making it the most efficient approach.

Answer

Ask each member account to create a new trail in their own account with S3 data events enabled.

Answer

Enable S3 server access logging on all S3 buckets across the organization and aggregate logs in a central S3 bucket.

Answer

Create a new organization trail in the management account with S3 data events enabled, and share it with member accounts.

Question 10

A company uses an IAM role to allow an EC2 instance to access an S3 bucket. The security team wants to ensure that if the EC2 instance is compromised, the attacker cannot use the role credentials to access resources outside the account. What should the security team do?

Accepted Answer

Attach a permissions boundary to the IAM role that limits access to only the required S3 bucket.. Using a permissions boundary restricts the maximum permissions the role can have, limiting the impact of a compromised instance.

Answer

Store the role credentials in AWS Secrets Manager and rotate them frequently.

Answer

Use an instance profile with a short-lived session token.

Answer

Use an SCP to deny all actions except S3 access for the role.

Question 11

A developer has created an S3 bucket policy that grants public read access. The security team wants to prevent any S3 bucket from becoming public. Which AWS service can enforce this restriction across all accounts?

Accepted Answer

A service control policy (SCP) denying s3:PutBucketPolicy. A service control policy (SCP) is the correct choice because it operates at the AWS Organizations level to centrally restrict permissions across all accounts. By creating an SCP that denies the s3:PutBucketPolicy action, you prevent any account in the organization from modifying bucket policies to grant public access, regardless of individual account settings. This enforces a guardrail that cannot be overridden by account administrators.

Answer

AWS CloudTrail with a metric filter

Answer

S3 Block Public Access settings on each account

Answer

IAM permissions boundary

Question 12

A company is designing a network architecture for a critical application that must meet strict compliance requirements. The application consists of Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The instances need to access an Amazon RDS database in a different VPC. The company wants to minimize exposure to the internet. Which solution should the company use?

Accepted Answer

Use a VPC Peering connection between the two VPCs.. VPC Peering establishes a private, direct network connection between two VPCs using AWS's internal infrastructure, with no exposure to the internet. Traffic stays within the AWS global network, meeting strict compliance requirements for minimizing internet exposure. This allows EC2 instances in the application VPC to communicate with the RDS database in the database VPC securely and with low latency, using private IP addresses.

Answer

Use a site-to-site VPN connection between the VPCs.

Answer

Use a NAT gateway in the database VPC and route traffic through it.

Answer

Use an internet gateway and route traffic over the internet with security groups.

Question 13

A company uses Amazon RDS for MySQL and needs to monitor database activity for suspicious queries, such as unauthorized access attempts or SQL injection. The security team wants to centralize the logs from multiple RDS instances and analyze them in near real-time. Which solution should be implemented?

Accepted Answer

Enable database audit logs on each RDS instance, stream them to Amazon CloudWatch Logs, and use CloudWatch Logs Insights to query the logs.. RDS for MySQL audit logs capture detailed database-level activity, including login attempts, query execution, and SQL injection patterns. Streaming these logs to CloudWatch Logs enables near real-time analysis using CloudWatch Logs Insights, which supports querying and alerting on suspicious queries across multiple RDS instances from a centralized location.

Answer

Enable RDS Enhanced Monitoring and stream the metrics to Amazon CloudWatch.

Answer

Enable VPC Flow Logs for the RDS instances and analyze the logs using Amazon Athena.

Answer

Enable AWS CloudTrail for RDS API calls and use Amazon GuardDuty to analyze the logs.

Question 14

A company uses AWS CloudTrail to log management events. The security team wants to be alerted when an IAM user creates a new access key. Which solution would meet this requirement with the least operational overhead?

Accepted Answer

Create an Amazon EventBridge rule that matches the CreateAccessKey event and triggers an Amazon SNS notification.. Amazon EventBridge can directly capture CloudTrail API calls (like CreateAccessKey) as events and route them to an SNS topic for notification, requiring no custom code or polling. This serverless, event-driven approach minimizes operational overhead by eliminating the need to manage log groups, metric filters, or scheduled scripts.

Answer

Create a CloudWatch Logs metric filter on the CloudTrail log group for CreateAccessKey events and set an alarm.

Answer

Write a Python script that uses the CloudTrail LookupEvents API and run it on a scheduled basis using Amazon EventBridge Scheduler.

Answer

Develop a custom AWS Lambda function that queries CloudTrail logs in S3 every hour.

Question 15

A company's security policy requires that all S3 buckets be encrypted at rest. An security engineer needs to detect any S3 bucket that does not have default encryption enabled. Which AWS service should the engineer use to continuously monitor and alert on non-compliant buckets?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides continuous monitoring and evaluation of your AWS resource configurations against desired policies. You can create an AWS Config rule, such as the managed rule 's3-bucket-default-encryption-enabled', which automatically checks each S3 bucket for the presence of default encryption (SSE-S3 or SSE-KMS) and triggers an alert or remediation action for any non-compliant bucket. This aligns directly with the requirement to detect and alert on buckets lacking encryption at rest.

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty