SCS-C02 Practice Test 23 — 15 Questions

Question 1

A company is migrating on-premises file servers to Amazon EFS. The data must be encrypted at rest and in transit. Which THREE steps should the company take to meet these requirements?

Accepted Answer

Use a KMS customer managed key for encryption at rest. To meet the requirements for encryption at rest and in transit on Amazon EFS, you need three steps: (1) Use a KMS customer managed key for encryption at rest (option A). (2) Enable encryption at rest on the EFS file system (option E). (3) Mount the EFS file system using TLS to ensure encryption in transit (option D). Option B (using AWS Certificate Manager) is not needed because EFS does not require certificates for its TLS implementation. Option C (installing an SSL certificate on the EFS file system) is incorrect because EFS does not support installing certificates directly; TLS is handled at the client side during mounting.

Answer

Use AWS Certificate Manager to issue a certificate

Answer

Install an SSL certificate on the EFS file system

Question 2

A company is implementing a data retention policy for CloudTrail logs. The logs are stored in an S3 bucket. The policy requires that logs be retained for 7 years and then automatically deleted. Which TWO actions should the security engineer take to meet this requirement?

Accepted Answer

Enable S3 Object Lock in compliance mode on the bucket.. To retain logs for 7 years and then automatically delete, the security engineer should enable S3 Object Lock in compliance mode (B) to prevent any deletion during the retention period, and create an S3 Lifecycle policy to expire objects after 2555 days (E). The Object Lock ensures logs cannot be deleted prematurely, while the lifecycle policy handles automatic deletion after 7 years. Option C is incorrect because denying s3:DeleteObject to all principals would block the lifecycle policy from deleting objects. Options A and D are not suitable for this requirement.

Answer

Use AWS Backup to manage retention and deletion.

Answer

Configure the S3 bucket policy to deny s3:DeleteObject actions for all principals.

Answer

Enable S3 Versioning and create a lifecycle policy to delete noncurrent versions.

Question 3

A company uses AWS CloudTrail to log data events for S3 buckets. They notice that some S3 object-level API calls are not being logged. Which configuration could be the cause?

Accepted Answer

The trail is not configured to log data events for the S3 bucket.. CloudTrail trails must be explicitly configured to log data events for S3 buckets. Data events are high-volume operations (e.g., GetObject, PutObject, DeleteObject) and are not captured by default. If the trail is not configured to log data events for the specific S3 bucket, those object-level API calls will not appear in the CloudTrail logs.

Answer

The trail is configured to log management events only.

Answer

The trail is using a CloudWatch Logs log group for delivery.

Answer

The trail is configured to log read events only.

Question 4

A company uses Amazon S3 to store sensitive documents. The security team wants to ensure that all objects are encrypted at rest using server-side encryption. Additionally, any attempt to upload an unencrypted object must be denied. What should the security team do?

Accepted Answer

Add an S3 bucket policy that denies PutObject if the object is not encrypted using SSE-S3 or SSE-KMS.. An S3 bucket policy that denies PutObject if the object is not encrypted using SSE-S3 or SSE-KMS ensures that any upload attempt without proper server-side encryption is blocked. Option A is incorrect because enabling default encryption does not deny unencrypted uploads if the request explicitly sets encryption to none. Option B is incorrect because the 's3:x-amz-server-side-encryption' condition key can require encryption but does not cover all cases; using a deny statement for unencrypted uploads is more robust. Option D is incorrect because AWS Config can only detect non-compliance, not deny the upload in real-time.

Answer

Enable default encryption on the S3 bucket using SSE-S3.

Answer

Add an S3 bucket policy that requires encryption using the 's3:x-amz-server-side-encryption' condition key.

Answer

Create an AWS Config rule to detect unencrypted objects and trigger a Lambda function to encrypt them.

Question 5

A company has an S3 bucket policy that allows cross-account access for a specific IAM role in another account. The bucket policy includes a Principal element with the ARN of the role. However, users in the other account that assume the role are unable to access the bucket. Which of the following is the MOST likely cause?

Accepted Answer

The IAM role does not have a permissions policy granting s3:GetObject on the bucket.. For cross-account access using an S3 bucket policy, the IAM role in the trusted account must have a permissions policy that grants the necessary S3 actions (e.g., s3:GetObject). Without this policy, even if the bucket policy allows the role, the role itself does not have permission to perform the action. Options B, C, and D are less likely: B is possible but not the most common; C is incorrect because the trust policy allows users to assume the role, not the S3 service; D is incorrect because role ARNs are valid principals in S3 bucket policies.

Answer

The bucket policy has an explicit Deny statement that overrides the Allow.

Answer

The role's trust policy does not allow the S3 service to assume the role.

Answer

The bucket policy uses the role ARN in the Principal element instead of the AWS account ID.

Question 6

A financial services company uses AWS KMS to encrypt sensitive data. The security team has a requirement to rotate the CMK every 90 days and to maintain a record of all previous key versions for decryption of historical data. The team creates a new CMK every 90 days and manually updates applications to use the new key. This process is error-prone and causes downtime. What is the MOST operationally efficient solution that meets the requirements?

Accepted Answer

Create a new CMK every 90 days and update the alias to point to the new key. Applications reference the alias.. It uses aliases to decouple the key identifier from the application configuration. By creating a new CMK every 90 days and updating the alias to point to the new key, applications that reference the alias automatically use the new key without code changes, eliminating downtime. AWS KMS aliases are mutable pointers that can be reassigned to different CMKs, and the old key versions remain available for decryption of historical data.

Answer

Enable automatic key rotation on the existing CMK.

Answer

Use a CMK with imported key material and rotate the material every 90 days.

Answer

Continue creating new CMKs but use a script to update the application configuration files.

Question 7

A company is designing an automated incident response workflow. When a high-severity GuardDuty finding is generated, the security team wants to automatically isolate the affected EC2 instance by modifying its security group to deny all traffic. Which service should orchestrate this response?

Accepted Answer

AWS Systems Manager Automation. AWS Systems Manager Automation is the correct choice because it provides a pre-built runbook (AWS-DetachAndIsolateEC2Instance) that can be triggered by Amazon EventBridge when a GuardDuty finding is generated. This runbook automatically modifies the EC2 instance's security group to deny all traffic, effectively isolating the instance without requiring custom code. Systems Manager Automation is designed for such operational workflows, offering built-in error handling and approval steps.

Answer

AWS Lambda

Answer

AWS Config

Answer

AWS Step Functions

Question 8

Refer to the exhibit. A developer receives an 'UnauthorizedOperation' error when launching an EC2 instance with the specified security group. The developer has permissions to use ec2:RunInstances. What is the most likely cause?

Accepted Answer

The security group contains an inbound rule with a source of 0.0.0.0/0 for port 80, which is too permissive and triggers a service control policy (SCP) that denies launching instances with overly permissive rules.. The 'UnauthorizedOperation' error is an authorization error that occurs when a service control policy (SCP) explicitly denies the ec2:RunInstances action. In this scenario, the SCP is configured to deny launching instances associated with security groups that have overly permissive rules, such as an inbound rule from 0.0.0.0/0. Although SCPs cannot dynamically inspect security group rule content, administrators can implement deny policies targeting specific security groups known to be permissive. The developer's IAM policy allows RunInstances, but the SCP overrides that permission. Option D is incorrect because an instance type not being available in an Availability Zone results in a capacity or compatibility error (e.g., 'InsufficientInstanceCapacity'), not an 'UnauthorizedOperation' error.

Answer

The security group allows inbound HTTPS from the entire RFC 1918 address space, but the instance is in a public subnet.

Answer

The security group allows outbound all traffic, which violates the principle of least privilege.

Answer

The instance type t2.micro is not available in the specified subnet's Availability Zone.

Question 9

A company is designing a data protection strategy for its Amazon RDS for PostgreSQL database. The database contains sensitive customer data. Compliance requirements mandate that all backups be encrypted at rest and that the encryption keys be rotated annually. Which solution meets these requirements?

Accepted Answer

Enable encryption at rest on the RDS instance using a customer managed KMS key. Enable automatic key rotation in KMS.. Enabling encryption at rest on the RDS instance using a customer managed KMS key and enabling automatic key rotation in KMS provides annual key rotation, satisfying the compliance requirement. Option A is incorrect because an encrypted read replica inherits the source instance's encryption key and does not provide independent backup encryption or key rotation. Option B is incorrect because S3 server-side encryption is not relevant to RDS automated backups; RDS encrypts backups using the KMS key associated with the DB instance, and S3 lifecycle policies rotate objects, not encryption keys. Option C is incorrect because although an AWS managed KMS key encrypts the RDS instance and backups, its automatic key rotation occurs every three years, not annually as required.

Answer

Create an encrypted read replica of the RDS instance and use the replica for backups.

Answer

Use S3 server-side encryption with a customer managed key for automated backups. Configure lifecycle policies to rotate the key.

Answer

Enable encryption at rest on the RDS instance using an AWS managed KMS key. The key will be rotated automatically every year.

Question 10

Match each AWS security tool to its purpose.

Accepted Answer

AWS Shield: Protects against DDoS attacks. Correct matches: AWS Shield protects against DDoS, AWS WAF filters web traffic, and GuardDuty provides threat detection. Common confusions include swapping Shield with WAF and Inspector with Macie.

Answer

AWS Inspector: Protects against DDoS attacks

Answer

AWS Macie: Automates vulnerability assessments

Question 11

A company wants to grant a third-party auditor read-only access to specific CloudTrail log files stored in an S3 bucket. The auditor should not be able to list or access any other objects in the bucket. What is the most secure way to achieve this?

Accepted Answer

Generate pre-signed URLs for the specific log files and share them with the auditor.. Using S3 pre-signed URLs grants time-limited access to specific objects without requiring the auditor to have AWS credentials. Option A is wrong because CloudTrail does not provide built-in console access for auditors. Option B is wrong because granting s3:GetObject on the entire bucket would allow access to all objects, not just specific log files. Option D is wrong because a bucket policy granting s3:GetObject to a specific prefix still requires the auditor to have AWS credentials, and the policy must explicitly deny s3:ListBucket to prevent listing; even then, managing credentials for a third party is less secure than using pre-signed URLs.

Answer

Use CloudTrail's built-in console access for the auditor.

Answer

Create a new IAM user for the auditor with an S3 policy that grants s3:GetObject on the entire bucket.

Answer

Use a bucket policy that grants the auditor's IAM user s3:GetObject access to the specific log file prefix.

Question 12

A company has an S3 bucket with a bucket policy that grants access to a specific IAM role. However, users who assume that role are unable to list objects in the bucket. The bucket policy includes a Principal element set to the role ARN. What is the MOST likely cause?

Accepted Answer

The IAM role does not have a permissions policy that allows s3:ListBucket.. Bucket policies do not grant permissions to IAM role principals unless the role has an IAM policy that allows the S3 action. Option B is false; ACLs are not the issue here; the role lacks an IAM policy. Option C is false; the scenario does not involve MFA, and even if MFA were required, the role’s inability to list objects is due to missing IAM permissions. Option D is false; the role’s trust policy allows AssumeRole, otherwise the users could not assume the role.

Answer

The bucket has an ACL that denies access to the role.

Answer

The bucket policy requires MFA, but the role does not enforce MFA.

Answer

The role's trust policy does not allow sts:AssumeRole.

Question 13

A security engineer needs to capture all API calls made to AWS services for forensic analysis. Which AWS service should be used to store these logs durably and cost-effectively for long-term retention?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it captures all API calls made to AWS services, including the identity of the caller, time of the call, source IP address, and request parameters. It stores these logs durably in Amazon S3, which provides cost-effective long-term retention for forensic analysis. CloudTrail is specifically designed for auditing and monitoring API activity across an AWS environment.

Answer

VPC Flow Logs

Answer

Amazon GuardDuty

Answer

AWS Config

Question 14

A company wants to grant an IAM user the ability to manage (create and update) their own access keys. Which TWO IAM actions must be allowed in the policy?

Accepted Answer

iam:UpdateAccessKey. To allow a user to manage (create and update) their own access keys, the policy must include iam:CreateAccessKey and iam:UpdateAccessKey. These actions enable the user to generate new keys and activate/deactivate them. iam:DeleteAccessKey is not required for this specific scope.

Answer

iam:GetAccessKeyLastUsed

Answer

iam:DeleteAccessKey

Answer

iam:ListAccessKeys

Question 15

A company is deploying a web application on EC2 instances behind an Application Load Balancer. The security team requires that all traffic between the ALB and the EC2 instances be encrypted. Which configuration should the engineer implement?

Accepted Answer

Configure the ALB listener with HTTPS protocol and the target group with HTTPS protocol, and install SSL certificates on the EC2 instances.. It ensures end-to-end encryption between the ALB and EC2 instances. The ALB listener uses HTTPS to terminate client SSL/TLS, and the target group uses HTTPS to re-encrypt traffic to the instances, requiring SSL certificates on the EC2 instances to decrypt and re-encrypt. This satisfies the security requirement that all traffic between the ALB and EC2 instances be encrypted.

Answer

Configure the ALB listener with HTTP protocol and the target group with HTTP protocol, then use a security group to restrict traffic.

Answer

Configure the ALB listener with HTTPS protocol and the target group with HTTP protocol.

Answer

Configure the ALB listener with TCP protocol and the target group with TCP protocol, then install SSL certificates on the EC2 instances.