SCS-C02 Practice Test 22 — 15 Questions

Question 1

A security engineer needs to monitor for unauthorized changes to security group rules in an AWS account. The engineer wants to receive real-time notifications when a security group rule is added, modified, or removed. Which AWS service should the engineer use to capture these API calls?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to the AWS environment, including EC2 APIs such as AuthorizeSecurityGroupIngress, RevokeSecurityGroupIngress, AuthorizeSecurityGroupEgress, RevokeSecurityGroupEgress, CreateSecurityGroup, and DeleteSecurityGroup. By enabling CloudTrail trail with management events and optionally data events for EC2, the security engineer can capture these API calls in near real-time and stream them to Amazon CloudWatch Logs or Amazon EventBridge to trigger notifications for unauthorized changes to security group rules.

Answer

Amazon GuardDuty

Answer

VPC Flow Logs

Answer

AWS Config

Question 2

A security engineer needs to ensure that all API calls made in an AWS account are captured and retained for auditing purposes. The engineer must be able to query the logs for specific user activity over the past 90 days. Which AWS service should the engineer use to meet these requirements?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made in an AWS account, including the identity, source IP, request parameters, and response elements. By default, CloudTrail stores event history for the last 90 days, which can be queried via the Event History console or API, meeting the requirement to query logs for specific user activity over the past 90 days without additional configuration.

Answer

Amazon VPC Flow Logs

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Question 3

A company is designing a shared services VPC architecture with multiple VPCs connected via a transit gateway. The security engineer needs to ensure that all traffic between VPCs is inspected by a centralized firewall appliance deployed in the shared services VPC. What configuration is required?

Accepted Answer

Configure transit gateway route tables to route all inter-VPC traffic through the firewall appliance.. A transit gateway can use separate route tables to control traffic flow. By configuring the transit gateway route tables to point the default route (0.0.0.0/0) or specific inter-VPC CIDR ranges to a network interface of the centralized firewall appliance in the shared services VPC, all traffic between VPCs is forced through the firewall for inspection. This design ensures that the firewall acts as a central inspection point without requiring VPC peering or complex routing.

Answer

Create VPC peering connections between each VPC and the shared services VPC.

Answer

Use security groups to route traffic through the firewall.

Answer

Deploy a Gateway Load Balancer (GWLB) in the shared services VPC and register the firewall as a target.

Question 4

A company has an AWS Organization with hundreds of accounts. The security team wants to enforce that no account can disable AWS CloudTrail logging. Which TWO approaches can achieve this?

Accepted Answer

Enable CloudTrail as a trusted service and create an organization trail.. Options A and C are correct. An SCP can deny the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions (C), and enabling CloudTrail as a trusted service with an organization trail (A) prevents individual accounts from stopping or modifying the trail. Option B is wrong because IAM policies are account-specific and cannot be enforced across all accounts. Option D is wrong because AWS Config can detect and remediate, but cannot prevent the initial disabling. Option E is wrong because CloudWatch Logs alerts do not prevent disabling CloudTrail.

Answer

Apply an IAM policy to each account's root user to prevent disabling CloudTrail.

Answer

Use AWS Config to automatically re-enable CloudTrail if it is disabled.

Answer

Configure CloudWatch Logs to monitor CloudTrail logs and alert if logging stops.

Question 5

A company runs a critical application on Amazon EC2 instances behind an Application Load Balancer (ALB). The security team wants to ensure that only traffic from the ALB reaches the EC2 instances, and that instances cannot initiate outbound connections to the internet. Which combination of security group rules should be implemented? (Select TWO.)

Accepted Answer

Inbound rule: Allow HTTP/HTTPS from the ALB's security group.. Referencing the ALB's security group as the source for inbound HTTP/HTTPS traffic ensures that only traffic that has passed through the ALB can reach the EC2 instances. This leverages security group chaining, where the ALB's security group acts as a trusted source, preventing direct internet access to the instances. Option D is correct because a deny-all outbound rule to 0.0.0.0/0 blocks all outbound internet connections, satisfying the requirement that instances cannot initiate outbound connections.

Answer

Inbound rule: Allow HTTP/HTTPS from 0.0.0.0/0.

Answer

Outbound rule: Allow all traffic to the ALB's security group only.

Answer

Outbound rule: Allow all traffic to 0.0.0.0/0.

Question 6

Refer to the exhibit. A security engineer configured this S3 bucket policy for CloudTrail, but CloudTrail logs are not being delivered. What is the MOST likely missing permission?

Accepted Answer

Missing s3:PutObject permission for the bucket.. CloudTrail requires that the S3 bucket policy grants the s3:PutObject permission to the CloudTrail service principal to write log files. The exhibit shows a bucket policy that grants s3:GetBucketAcl but is missing a statement that allows s3:PutObject on the bucket (or on the appropriate log prefix). Without s3:PutObject, CloudTrail cannot deliver log files to the bucket. Therefore, the most likely missing permission is s3:PutObject for the bucket, making option C correct.

Answer

Missing s3:GetBucketAcl permission.

Answer

The condition StringEquals should be StringLike.

Answer

The bucket ARN is incorrect.

Question 7

A company has a VPC with multiple subnets. An EC2 instance in a private subnet needs to access an S3 bucket. Which configuration provides the most secure and efficient access?

Accepted Answer

Create a Gateway VPC Endpoint for S3 and update the route table.. A Gateway VPC Endpoint for S3 provides private, secure access to S3 without traversing the internet, using AWS's internal network. It is more efficient than an Interface Endpoint for S3 because it does not incur hourly charges or require additional route table entries for each subnet, and it leverages prefix lists to route traffic directly to S3 via the route table. This configuration ensures the EC2 instance in the private subnet can access S3 without a NAT Gateway or public IP, maintaining security and minimizing data transfer costs.

Answer

Create an Interface VPC Endpoint for S3.

Answer

Route the traffic through a NAT Gateway to the internet.

Answer

Assign a public IP address to the EC2 instance and allow it to access S3 via internet.

Question 8

A company wants to centralize security logs from multiple AWS accounts into a single S3 bucket. The logging accounts (e.g., security, production) each have their own CloudTrail trails. Which configuration is required to allow cross-account log delivery?

Accepted Answer

Create an S3 bucket policy in the destination account that allows the CloudTrail service principal to write objects.. CloudTrail cross-account log delivery requires the destination S3 bucket to have a bucket policy that explicitly grants the CloudTrail service principal (`cloudtrail.amazonaws.com`) permission to write objects (e.g., `s3:PutObject`). This allows CloudTrail in any source account to deliver logs directly to the bucket without needing IAM roles or shared credentials, as the service principal authenticates on behalf of the source account.

Answer

Create an IAM role in the destination account with write permissions and allow CloudTrail in source accounts to assume that role.

Answer

Use a customer-managed KMS key in the destination account and share it with the source accounts.

Answer

Configure S3 bucket ACLs to grant write access to the source account IDs.

Question 9

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that all IAM users in the organization have multi-factor authentication (MFA) enabled. Which combination of actions should be taken to enforce this requirement?

Accepted Answer

Create an SCP that denies IAM actions without MFA and attach it to the root organizational unit (OU).. Service Control Policies (SCPs) in AWS Organizations can be attached to the root organizational unit (OU) to apply a blanket denial of IAM actions when MFA is not present, affecting all accounts and users within the organization. This leverages the `aws:MultiFactorAuthPresent` condition key in an SCP to enforce MFA at the organization level, ensuring that even if IAM users are created in member accounts, they cannot perform IAM actions without MFA. Attaching the SCP to the root OU ensures the policy cascades down to all child OUs and accounts, providing centralized enforcement.

Answer

Create an SCP that denies IAM actions without MFA and attach it to the IAM group that contains all users.

Answer

Create an SCP that denies IAM actions without MFA and attach it to each IAM user.

Answer

Create an SCP that denies IAM actions without MFA and attach it to the management account.

Question 10

A company wants to automate the response to a specific GuardDuty finding. When GuardDuty detects a finding of type `UnauthorizedAccess:EC2/SSHBruteForce`, they want to automatically block the offending IP address using a network ACL. Which AWS service can they use to orchestrate this response?

Accepted Answer

AWS Systems Manager Automation. AWS Systems Manager Automation is the correct service because it provides a runbook-based automation framework that can be triggered by Amazon EventBridge events from GuardDuty. When GuardDuty generates a finding of type `UnauthorizedAccess:EC2/SSHBruteForce`, an EventBridge rule can invoke an SSM Automation document that modifies the network ACL to block the offending IP address. This orchestration is natively supported by SSM Automation without requiring custom code, making it the ideal choice for automated incident response workflows.

Answer

AWS Lambda

Answer

AWS Config

Answer

AWS CloudFormation

Question 11

A company is required to retain CloudTrail logs for 7 years for compliance. Which solution meets this requirement with the LEAST operational overhead?

Accepted Answer

Configure an S3 Lifecycle policy to transition logs to S3 Glacier Deep Archive after 90 days and expire after 7 years.. It uses an S3 Lifecycle policy to automatically transition CloudTrail logs to S3 Glacier Deep Archive after 90 days (reducing storage costs) and then expire (delete) the objects after 7 years, meeting the retention requirement with zero ongoing operational effort. This is the least operational overhead solution as it is fully automated within S3, requiring no custom code, manual intervention, or additional services.

Answer

Store logs in CloudWatch Logs with a retention period of 7 years.

Answer

Configure CloudTrail to automatically delete logs older than 7 years.

Answer

Use an AWS Lambda function to delete logs older than 7 years.

Answer

Export logs to AWS Snowball for offline archival.

Question 12

Refer to the exhibit. An IAM policy is attached to a group. An IAM user in that group attempts to stop an EC2 instance from IP address 198.51.100.10. What will happen?

Accepted Answer

The action is denied because the source IP does not match the allowed range. The IAM policy includes a `Deny` statement with a `NotIpAddress` condition that restricts all actions (including `StopInstances`) to the IP range `10.0.0.0/8`. Since the user's source IP is `198.51.100.10`, which falls outside this range, the deny statement explicitly blocks the action. In IAM, an explicit deny always overrides any allow, so the request is denied regardless of the allow statement in the first policy block.

Answer

The action is allowed because the first statement allows StopInstances

Answer

The action is allowed because the resource is '*'

Answer

The action is denied only if the user is not using MFA

Question 13

A company uses AWS Organizations to manage 50 accounts. The security team has enabled AWS CloudTrail in the management account with an organization trail that delivers logs to a central S3 bucket. The bucket policy grants necessary permissions to CloudTrail. Recently, the security team noticed that logs from two member accounts stopped appearing in the bucket. Other accounts continue to deliver logs correctly. The CloudTrail status in the management account shows that the trail is logging and deliveries are succeeding. The security team checked the CloudTrail configuration in the affected member accounts and found that they do not have any trails configured. The IAM roles used for CloudTrail in the management account have sufficient permissions. What is the most likely cause of the missing logs?

Accepted Answer

The S3 bucket policy does not grant write access to the CloudTrail service for the affected member accounts.. The most likely cause is that the S3 bucket policy does not grant write access to the CloudTrail service for the affected member accounts. When an organization trail is created, CloudTrail uses the management account's permissions to deliver logs to the S3 bucket. However, the bucket policy must explicitly allow the CloudTrail service principal from each member account to write logs. If the policy only allows the management account, member accounts' logs will be rejected. Option A is incorrect because the issue is not about KMS key permissions; if SSE-KMS is used, the key policy must also grant decrypt permissions to CloudTrail, but the question does not mention KMS. Option C is incorrect because CloudTrail does not use a service-linked role for organization trails; it uses the CloudTrail service role in the management account. Option D is incorrect because an SCP denying cloudtrail:PutLogEvents would affect all CloudTrail actions, but the logs from other accounts are still arriving, so it is unlikely.

Answer

The KMS key used for encryption does not include permissions for the member accounts.

Answer

The CloudTrail service-linked role in the member accounts is missing.

Answer

An SCP attached to the affected member accounts denies cloudtrail:PutLogEvents.

Question 14

A security engineer is investigating a potential data exfiltration from an Amazon S3 bucket. The bucket policy allows access to a specific IAM role, but the engineer suspects that the role has been compromised. The engineer wants to quickly block all access to the bucket without deleting the bucket or the policy. What is the BEST course of action?

Accepted Answer

Add a bucket policy statement that denies access unless the request comes from a specific IP address that does not exist.. Adding a bucket policy statement that denies access unless the request originates from a specific IP address that does not exist effectively blocks all traffic to the bucket. This approach leverages the explicit deny in AWS IAM policy evaluation logic, which overrides any allow, and does not require deleting the bucket or the existing policy. It provides an immediate, reversible block without altering the original policy structure or the IAM role.

Answer

Delete the IAM role that is allowed access to the bucket.

Answer

Use AWS WAF to block the IP addresses of the compromised role.

Answer

Modify the bucket policy to deny all principals.

Question 15

A company's security team is implementing an incident response plan for a potential ransomware attack on their EC2 instances. Which THREE steps should the team take to preserve forensic evidence while containing the incident?

Accepted Answer

Create an EBS snapshot of the root volume.. Creating an EBS snapshot of the root volume preserves the exact disk state at the time of the incident, including any ransomware artifacts, file system metadata, and encryption keys. This snapshot can be used for offline forensic analysis without altering the original evidence, as it captures the block-level data of the volume.

Answer

Stop the instance to preserve its state.

Answer

Delete the compromised instance immediately.