SCS-C02 Practice Test 22 — 15 Questions

Question 1

During a security incident, a security engineer needs to verify whether an EC2 instance's security group allowed inbound SSH from a specific IP address at the time of the incident. Which AWS service or feature should the engineer use to obtain this historical information?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Config configuration history.. AWS Config configuration history records changes to security group rules, including the addition or removal of inbound SSH allow rules. By querying the configuration history for the specific security group, the engineer can determine the exact state of the rules at the time of the incident, including whether a specific IP address was allowed. This is the only service that provides a historical record of security group rule configurations.

Answer

Amazon CloudTrail event history.

Answer

AWS Systems Manager Inventory.

Answer

VPC Flow Logs.

Question 2

A financial services company is designing a data protection strategy for its DynamoDB table containing sensitive customer data. The table has a global secondary index (GSI). The company needs to encrypt the data at rest using a customer managed key (CMK) that is rotated annually. Which solution meets these requirements?

Accepted Answer

Create the table with a customer managed key (CMK) and enable automatic key rotation. DynamoDB supports encryption at rest using AWS KMS. When a table is created, you must specify whether to use a default AWS managed key or a customer managed key (CMK). The global secondary index (GSI) inherits the encryption settings from the base table and cannot have separate encryption settings. Option D is correct because you can create the table with a CMK and enable automatic key rotation on that CMK. Option A is incorrect because you cannot change the encryption key of an existing DynamoDB table; encryption settings must be specified at creation. Option B is incorrect because DynamoDB tables always have encryption enabled by default (you cannot create a table without encryption), and you cannot enable encryption separately on the GSI. Option C is incorrect because the requirement specifies a customer managed key (CMK), not an AWS managed key; while AWS managed keys have automatic rotation by default, they do not provide customer control over the key.

Answer

Create the table with default encryption, then update the table to use a CMK and enable automatic rotation

Answer

Create the table without encryption, then enable encryption on the table and GSI separately using a CMK

Answer

Create the table with an AWS managed key and use AWS KMS automatic rotation

Question 3

A company wants to grant cross-account access to an S3 bucket owned by Account A to a user in Account B. The bucket policy in Account A allows access from Account B. What additional configuration is required?

Accepted Answer

The IAM user in Account B must have a policy that allows access to the S3 bucket.. Cross-account access to an S3 bucket requires both a resource-based policy (the bucket policy in Account A) and an identity-based policy (an IAM policy attached to the user or role in Account B). The bucket policy grants access to the external account, but the IAM user in Account B must also have an explicit policy that allows the desired actions (e.g., s3:GetObject). Therefore, Option A is correct. Option B is incorrect because the bucket policy alone is not sufficient. Option C is incorrect because ACLs are not required and are generally not recommended for cross-account access. Option D is incorrect because SCPs (Service Control Policies) are used for organization-wide guardrails and are not required for this specific cross-account access.

Answer

Nothing; the bucket policy is sufficient.

Answer

The bucket must be configured with ACLs.

Answer

An SCP must allow the s3:GetObject action.

Question 4

A company is designing a data protection strategy for sensitive data stored in Amazon S3. Compliance requirements mandate that all data be encrypted at rest using customer-provided keys (SSE-C). Which solution meets the requirements with minimal operational overhead?

Accepted Answer

Use server-side encryption with customer-provided keys (SSE-C) and store the keys in AWS Secrets Manager.. Server-side encryption with customer-provided keys (SSE-C) allows the customer to supply their own encryption keys while AWS manages the encryption/decryption process, meeting compliance requirements with minimal operational overhead. Storing the keys in AWS Secrets Manager adds convenience and security. Option A is incorrect because SSE-S3 uses AWS-managed keys, not customer-provided keys. Option B is incorrect because client-side encryption with the AWS Encryption SDK requires the application to handle encryption, increasing overhead and complexity, and it does not use SSE-C. Option D is incorrect because SSE-KMS uses AWS KMS managed keys, not customer-provided keys, even if key rotation is enabled.

Answer

Use server-side encryption with Amazon S3 managed keys (SSE-S3) and enable bucket versioning.

Answer

Use client-side encryption with the AWS Encryption SDK and store keys in the application configuration.

Answer

Use server-side encryption with AWS KMS managed keys (SSE-KMS) and enable automatic key rotation.

Question 5

A company is designing a data encryption solution for its Amazon RDS for PostgreSQL database. The database must be encrypted at rest. What is the simplest way to achieve this?

Accepted Answer

Enable encryption when creating the RDS instance using a KMS key.. RDS supports encryption at rest for new databases using AWS KMS. Option B is incorrect because there is no separate encryption layer; RDS uses KMS. Option C is incorrect because application-level encryption is not the simplest. Option D is incorrect because RDS does not support CloudHSM for encryption at rest.

Answer

Enable AWS KMS encryption on the RDS instance after creation.

Answer

Use application-level encryption before inserting data into the database.

Answer

Use AWS CloudHSM to encrypt the EBS volumes attached to the RDS instance.

Question 6

A security engineer needs to enable VPC Flow Logs to capture traffic metadata. Which THREE components are required to create a VPC Flow Log?

Accepted Answer

A CloudWatch Logs log group to publish the flow logs.. A CloudWatch Logs log group is required because VPC Flow Logs publish traffic metadata to CloudWatch Logs as the default destination. The flow logs are stored as log streams within the specified log group, enabling querying and monitoring via CloudWatch Logs Insights. Without a log group, there is no destination for the flow log records to be sent to.

Answer

An S3 bucket to store the flow logs.

Answer

An Amazon Kinesis Data Firehose delivery stream.

Question 7

A security engineer is designing a solution to automatically remediate non-compliant resources in an AWS account. The engineer needs to trigger an AWS Lambda function when an EC2 instance is launched without the required tags. Which AWS service should be used to detect the non-compliant resource and invoke the Lambda function?

Accepted Answer

AWS Config. AWS Config is the correct service because it continuously evaluates resource configurations against desired rules. You can create a Config rule that checks for required tags on EC2 instances; when a non-compliant instance is detected, Config can automatically invoke a Lambda function via an remediation action. This native integration enables automatic, event-driven remediation without custom polling or additional services.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS Systems Manager

Question 8

A security engineer is investigating a potential data exfiltration incident. The engineer suspects that an attacker is using an Amazon S3 bucket to exfiltrate data. Which AWS service can be used to analyze S3 access logs and detect anomalous patterns?

Accepted Answer

Amazon Athena. Amazon Athena is the correct choice because it allows you to run SQL queries directly against Amazon S3 access logs stored in S3, enabling you to analyze large volumes of log data for anomalous patterns such as unusual data transfer volumes, repeated access from unfamiliar IP ranges, or unexpected object reads. This serverless query service is purpose-built for ad-hoc analysis of structured and semi-structured data in S3 without needing to load data into a separate database, making it ideal for incident response investigations.

Answer

Amazon CloudFront

Answer

AWS Shield

Answer

AWS WAF

Question 9

A company wants to share an encrypted Amazon Machine Image (AMI) with another AWS account. The AMI uses an EBS snapshot encrypted with a customer managed key in KMS. What is the correct procedure to allow the other account to launch an EC2 instance from this AMI?

Accepted Answer

Share the AMI, share the snapshot, and grant the target account decrypt permissions on the KMS key.. An encrypted EBS snapshot backed by a customer managed KMS key requires three separate permissions to be shared: the AMI must be shared with the target account, the underlying snapshot must be shared (modify-snapshot-attribute), and the KMS key policy must grant the target account kms:Decrypt and kms:CreateGrant (and typically kms:DescribeKey). Without all three, the target account cannot launch an instance because it cannot decrypt the snapshot volumes.

Answer

Export the snapshot as an unencrypted snapshot and share it.

Answer

Share the AMI and have the target account create a new KMS key to encrypt the snapshot.

Answer

Share only the AMI; the snapshot permissions are inherited from the AMI.

Question 10

A company uses AWS Organizations with multiple accounts. The security team needs to ensure that all accounts have CloudTrail enabled and that logs are delivered to a centralized S3 bucket in the management account. Which solution meets these requirements?

Accepted Answer

Use AWS CloudTrail with Organizations to create an organization trail that logs all accounts to the central bucket.. AWS CloudTrail supports integration with AWS Organizations, allowing you to create an organization trail that automatically logs events for all accounts in the organization. This trail delivers log files to a single centralized S3 bucket in the management account without requiring per-account configuration, ensuring compliance with the security team's requirement.

Answer

Write a script that runs in each account using AWS Lambda to enable CloudTrail and point to the central bucket.

Answer

Use AWS Config rules in each account to check CloudTrail status and remediate via Lambda.

Answer

Create an IAM role that each account assumes to enable CloudTrail and log to the central bucket.

Question 11

A company hosts a web application on EC2 instances behind an Application Load Balancer. The security team wants to ensure that only traffic from the ALB can reach the EC2 instances. Which configuration should be applied?

Accepted Answer

Configure the instances' security group to allow traffic from the ALB's security group.. Security groups support referencing other security groups as a source. By configuring the EC2 instances' security group to allow inbound traffic from the ALB's security group, only traffic originating from the ALB (which uses the ALB's security group) is permitted. This ensures that traffic from any other source, including direct internet traffic, is blocked at the instance level.

Answer

Configure the instances' security group to allow traffic from the client's source IP addresses.

Answer

Configure a network ACL on the subnet to allow traffic from the ALB's private IP addresses.

Answer

Assign an IAM role to the instances that allows traffic only from the ALB.

Question 12

A company uses Amazon EBS volumes for EC2 instances. Security policy requires that all EBS volumes be encrypted at rest. The company already has a default KMS key for EBS encryption. However, some new volumes are created without encryption. What is the most efficient way to enforce encryption for all new EBS volumes?

Accepted Answer

Enable EBS encryption by default in the EC2 console or via the API. Enabling EBS encryption by default in the EC2 console or via the API (EnableEbsEncryptionByDefault) ensures that every new EBS volume created in the region is automatically encrypted with the specified KMS key, without requiring any per-volume action or custom tooling. This is the most efficient, native enforcement mechanism because it operates at the account/region level and applies to all volume creation paths, including those from AMIs, snapshots, and instance launches.

Answer

Use AWS CloudTrail to monitor volume creation and send alerts

Answer

Create an AWS Config rule to detect unencrypted volumes and trigger a Lambda function to encrypt them

Answer

Use a custom AMI that enforces encryption

Question 13

An organization uses AWS Organizations and wants to restrict the use of specific EC2 instance types across all member accounts. Which policy type should be used to enforce this restriction?

Accepted Answer

Service control policy (SCP). Service control policies (SCPs) are the only AWS Organizations policy type that can centrally restrict the maximum available permissions for all accounts in an organization or organizational unit. By attaching an SCP that denies the ec2:RunInstances action for specific instance types (using condition keys like ec2:InstanceType), the organization can enforce the restriction across all member accounts, regardless of their local IAM policies. SCPs do not grant permissions; they only filter them, so they are ideal for guardrails.

Answer

Resource-based policy

Answer

IAM policy

Answer

AWS CloudFormation policy

Question 14

A security engineer notices that an IAM role has a trust policy that allows 'sts:AssumeRole' from any AWS account. What is the security risk?

Accepted Answer

Any IAM user in any AWS account can assume the role and gain its permissions.. A trust policy with a Principal of "*" (or an account root without conditions) allows sts:AssumeRole from any AWS account, meaning any IAM principal in any account that knows the role ARN can call AssumeRole and obtain temporary credentials scoped to that role's permissions. This is a classic cross-account confused-deputy vulnerability: the role's identity-based policies determine what the assumer can do, so the blast radius is exactly the role's permissions. The risk is not that permissions are 'exposed' in a read sense, but that they can be actively exercised by untrusted external principals.

Answer

The role can be assumed by any AWS service.

Answer

The role's permissions are exposed to all AWS accounts.

Answer

The role can be used to access resources in other accounts.

Question 15

A security engineer is designing a network ACL for a public subnet containing an Application Load Balancer. The subnet must allow inbound HTTPS traffic from the internet and outbound traffic to the internet for patches. Which inbound rule should be added?

Accepted Answer

Allow TCP port 443 from 0.0.0.0/0. HTTPS traffic uses TCP port 443, and the network ACL must explicitly allow inbound TCP traffic on port 443 from the internet (0.0.0.0/0) to reach the Application Load Balancer. Network ACLs are stateless, so each direction requires a separate rule; this inbound rule permits the initial HTTPS connection requests.

Answer

Allow TCP port 1024-65535 from 0.0.0.0/0

Answer

Allow UDP port 443 from 0.0.0.0/0

Answer

Allow all traffic from 0.0.0.0/0