SCS-C02 Practice Test 21 — 15 Questions

Question 1

A company has multiple AWS accounts in AWS Organizations. The security team wants to centralize threat detection and automate incident response. Which combination of services should they use?

Accepted Answer

GuardDuty + Amazon EventBridge + AWS Lambda. GuardDuty generates threat detection findings, which are sent to Amazon EventBridge as events. EventBridge then triggers an AWS Lambda function to automate incident response actions, such as isolating an EC2 instance or revoking IAM credentials. This combination provides a fully serverless, event-driven pipeline for centralized threat detection and automated remediation across multiple AWS accounts in Organizations.

Answer

GuardDuty + Security Hub + Step Functions

Answer

Amazon Macie + AWS Config + SNS

Answer

CloudTrail + CloudWatch Logs + Lambda

Question 2

A company wants to allow an IAM user to manage only their own access keys. Which IAM policy should be attached to the user?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"iam:*AccessKey*","Resource":"arn:aws:iam::*:user/${aws:username}"}]}. The IAM policy uses the ${aws:username} variable in the Resource element. When this policy is attached to a user, ${aws:username} resolves to that user's username, thereby restricting the actions to only that user's own access keys. Option A allows access to all users' keys. Option B denies all AccessKey actions. Option D allows all AccessKey actions without restriction.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"iam:*AccessKey*","Resource":"arn:aws:iam::*:user/*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"iam:*AccessKey*","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"iam:*AccessKey*","Resource":"*"}]}

Question 3

Refer to the exhibit. A security engineer runs the command shown and gets the output. What does this output indicate about the bucket's encryption configuration?

Accepted Answer

The bucket has default encryption enabled using SSE-S3.. The output shows that default encryption is set to AES256, which corresponds to SSE-S3. This means new objects uploaded to the bucket will be encrypted with SSE-S3 unless a different encryption header is provided. Therefore, option D is correct. Option A is incorrect because the default encryption setting does not prevent unencrypted objects from being uploaded if the client does not provide encryption headers—it only applies encryption by default. Option B is incorrect because SSE-KMS uses a different key management service, not AES256. Option C is incorrect because default encryption does not require all objects to be encrypted with SSE-KMS; it sets a server-side default, but clients can override with their own encryption settings.

Answer

The bucket does not allow unencrypted objects.

Answer

The bucket has default encryption enabled using SSE-KMS.

Answer

The bucket requires all objects to be encrypted with SSE-KMS.

Question 4

A security engineer needs to centrally manage and enforce security policies across multiple AWS accounts in an organization. Which AWS service should they use?

Accepted Answer

AWS Organizations with SCPs. AWS Organizations with Service Control Policies (SCPs) allows central policy management across accounts. Firewall Manager focuses on VPC security, not general policies.

Answer

AWS CloudFormation StackSets

Answer

AWS IAM

Answer

AWS Firewall Manager

Question 5

Refer to the exhibit. A user from IP 10.1.2.3 attempts to download an object from my-secret-bucket using HTTP (not HTTPS). What will be the outcome?

Accepted Answer

Failure, because the Deny statement blocks HTTP requests.. The Deny statement with condition aws:SecureTransport=false will block HTTP requests. Even though the IP matches the allow rule, the explicit Deny overrides the Allow.

Answer

Success, because the Allow statement is evaluated first.

Answer

Failure, because the user's IP is not in the allowed range.

Answer

Success, because the user's IP is within the allowed range.

Question 6

A security engineer is tasked with implementing network segmentation for a multi-tier application. The web tier must be accessible from the internet, but the application tier must only be accessible from the web tier. The database tier must only be accessible from the application tier. All tiers are in the same VPC. Which design meets these requirements?

Accepted Answer

Create a security group for each tier. Configure inbound rules to allow traffic only from the preceding tier's security group.. Security groups can reference other security groups as sources in inbound rules, allowing granular traffic control between tiers without CIDR blocks. This approach allows the web tier security group to allow inbound from the internet, the app tier security group to allow inbound only from the web tier security group, and the database tier security group to allow inbound only from the app tier security group. Option B is incorrect because IAM policies control user permissions, not network traffic. Option C is incorrect because network ACLs with CIDR blocks are less specific and do not scale well, and placing tiers in separate subnets is not necessary. Option D is incorrect because placing all instances in public subnets unnecessarily exposes them to the internet, increasing security risk.

Answer

Use a single security group for all instances and use IAM policies to restrict access.

Answer

Place each tier in separate subnets and use network ACLs with CIDR blocks to allow traffic between tiers.

Answer

Place all instances in public subnets and restrict access using security groups.

Question 7

A company uses AWS CloudHSM to generate and store encryption keys for a custom database. The security team needs to back up the keys to another AWS Region for disaster recovery. What is the most secure and efficient way to achieve this?

Accepted Answer

Create a backup of the source CloudHSM cluster and copy the backup to the destination Region.. AWS CloudHSM allows you to create a backup of a cluster and copy that backup to another region using the AWS CLI or console. This is the most secure method as it avoids exporting keys in plaintext. Option B is incorrect because CloudHSM does not support exporting keys directly; you must use backups. Option C is incorrect because CloudHSM does not have a cross-region replication feature for clusters. Option D is incorrect because copying keys via an on-premises HSM is unnecessary and less secure than using CloudHSM's built-in backup copy functionality.

Answer

Export the keys from the source CloudHSM cluster and import them into a destination cluster in the other Region.

Answer

Enable cross-Region replication on the CloudHSM cluster.

Answer

Use the key_mgmt_util command-line tool to copy the keys to an on-premises HSM, then upload to the destination Region.

Question 8

A security engineer notices that an S3 bucket policy allows access to a principal from another AWS account. Which AWS feature can be used to check if this external access is intended?

Accepted Answer

AWS IAM Access Analyzer. IAM Access Analyzer generates findings for external access to S3 buckets. You can review and archive findings if intended.

Answer

AWS Trusted Advisor bucket permissions check

Answer

AWS Config rule s3-bucket-public-read-prohibited

Answer

AWS CloudTrail event history

Question 9

A company is designing a new AWS account structure using AWS Organizations. The security team wants to restrict the use of specific AWS services across all member accounts. Which feature should they use?

Accepted Answer

Service control policies (SCPs). Service control policies (SCPs) are the correct feature because they allow you to centrally restrict which AWS services and actions are permitted across all member accounts in an AWS Organization. SCPs act as a permission guardrail that applies to all IAM users, roles, and root users within the affected accounts, enabling the security team to enforce service restrictions without modifying individual account configurations.

Answer

AWS Single Sign-On (SSO)

Answer

AWS CloudTrail

Answer

AWS Identity and Access Management (IAM) cross-account roles

Question 10

Refer to the exhibit. A security engineer is reviewing the CloudWatch Logs configuration for a Lambda function. The log group is encrypted with a customer managed key. The engineer needs to ensure that only the Lambda service can write logs to this log group and that only a specific IAM role can read logs. Which additional configuration is required?

Accepted Answer

Add a condition to the KMS key policy that uses kms:ViaService to restrict encryption/decryption to logs.amazonaws.com and a condition that the Lambda function is the source. To ensure only the Lambda service can write logs and only a specific IAM role can read logs, you need to use KMS key policy conditions. The key policy should include a condition that allows CloudWatch Logs to use the key for encryption/decryption only when the request originates from the Lambda service (using kms:ViaService condition). Additionally, you can restrict read access by specifying the IAM role in the key policy. Option A is incorrect because resource-based policies on log groups cannot restrict write access to Lambda only; they are typically used for cross-account access. Option B is incorrect because S3 bucket policies are not applicable to CloudWatch Logs. Option C is incorrect because you cannot assign an IAM role to a log group; IAM roles are assumed by entities, not assigned to resources.

Answer

Attach a resource-based policy to the log group that allows only the Lambda service to write logs

Answer

Create an S3 bucket policy to allow only Lambda to write to the log group

Answer

Assign an IAM role to the log group that has permission to write logs

Question 11

A company stores data in Amazon S3 and uses AWS KMS with Customer Master Keys (CMKs) for encryption. The security team wants to audit when the CMK is used to decrypt data. Which of the following will provide this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail logs all KMS Decrypt API calls, which is exactly what is needed to audit CMK decryption. Option A (AWS Config) records configuration changes, not API calls. Option B (Amazon CloudWatch Logs) can store logs but does not generate the KMS decrypt logs itself; CloudTrail generates them. Option D (S3 server access logs) record requests to S3 objects, not the KMS decryption calls that happen when accessing encrypted objects.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

S3 server access logs

Question 12

A company uses AWS KMS to manage encryption keys for sensitive data stored in S3. The security team wants to ensure that keys are rotated automatically every year. What should they do?

Accepted Answer

Enable automatic key rotation on a customer managed key.. Automatic key rotation is a native feature of AWS KMS customer managed keys (CMKs). Enabling it causes KMS to generate new backing key material every year (or a custom period of 90-2560 days) while retaining the same key ID, so existing ciphertext remains decryptable without re-encryption. This satisfies the 'rotate automatically every year' requirement with no manual intervention.

Answer

Use a custom key store and rotate keys manually.

Answer

Use a CloudHSM to store keys and rotate them manually.

Answer

Use an AWS managed key, which rotates automatically every year.

Question 13

A company has a policy that requires all IAM users to use multi-factor authentication (MFA) to access the AWS Management Console. A user reports that they are unable to sign in even after configuring MFA. What is the most likely cause?

Accepted Answer

The MFA device is not properly synchronized with AWS.. The most likely cause is that the MFA device is not properly synchronized with AWS. When an IAM user configures MFA, the device must be synchronized with AWS to generate valid tokens. If synchronization fails, the token entered during sign-in will be rejected, preventing console access. Option A is unlikely because if the policy explicitly denied console access, the user would not be able to sign in at all regardless of MFA, but the user specifically reported having configured MFA and still fails. Option B is incorrect because the root account does not require MFA for console access by default, and the user stated they are an IAM user. Option C is incorrect because MFA tokens do not expire; they are time-based and change every 30 seconds, but the token itself does not become permanently invalid after a period. The issue is synchronization.

Answer

The IAM policy explicitly denies console access.

Answer

The user is using the root account instead of an IAM user.

Answer

The MFA token has expired.

Question 14

A company wants to centrally manage backups for Amazon RDS instances across multiple AWS accounts. Which AWS service should be used to automate the creation and enforcement of backup policies?

Accepted Answer

AWS Backup. AWS Backup allows centralized backup policies across accounts and regions. Option A is wrong because S3 Lifecycle policies are for object lifecycle, not RDS backups. Option C is wrong because CloudTrail is for auditing API calls. Option D is wrong because Systems Manager is for operational management, not backup policies.

Answer

S3 Lifecycle policies

Answer

AWS CloudTrail

Answer

AWS Systems Manager

Question 15

A security engineer is investigating a potential compromise. They notice that an IAM user 'svc-backup' has been making unusual API calls from an IP address outside the company's VPC. The engineer wants to ensure all future API calls from this user are logged with full event details. However, the current CloudTrail trail is set to log only management events. What should the engineer do to capture the required details?

Accepted Answer

Update the existing trail to log data events for IAM.. CloudTrail trails configured to log only management events do not capture IAM user activity such as API calls made by the user. By updating the existing trail to log data events for IAM, the engineer ensures that all future API calls from 'svc-backup' are logged with full event details, including the source IP address and request parameters. This directly addresses the requirement without creating unnecessary additional trails or services.

Answer

Enable VPC Flow Logs and correlate with CloudTrail logs.

Answer

Create a new trail that logs data events for S3 and configure it to deliver to a separate S3 bucket.

Answer

Enable CloudTrail Insights to detect unusual activity for the user.