SCS-C02 Practice Test 24 — 15 Questions

Question 1

A healthcare company stores sensitive patient data in Amazon S3. The security team has implemented a data protection strategy that includes S3 default encryption using SSE-KMS with a customer managed key. They also use S3 Object Lock to prevent deletion. Recently, an administrator accidentally deleted the KMS key used for encryption. As a result, all objects in the bucket are now inaccessible. The company has a backup of the key material but does not have the original key ID. Which action should the team take to restore access to the data?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Import the key material into a new KMS key and re-encrypt all objects using S3 Batch Operations.. When a KMS key is deleted and you have a backup of the key material, you can import that material into a new KMS key. Even though the new key has a different key ID, because the cryptographic material is identical, it can decrypt the data keys that were encrypted with the original key. S3 Batch Operations can then re-encrypt all objects under the new key, restoring access. Option A is incorrect because the objects were encrypted with SSE-KMS, meaning the data key itself is encrypted by KMS and cannot be decrypted without the KMS key. Option C is incorrect because KMS does not allow you to specify the key ID when creating a new key; AWS generates a unique key ID. Option D is incorrect because CloudHSM is a separate service for generating and storing keys; it is not used to back up KMS keys.

Answer

Use the backup key material directly in an application to decrypt objects without KMS.

Answer

Create a new KMS key with the same key ID using the backup material.

Answer

Restore the deleted KMS key from the CloudHSM backup.

Question 2

A company has a single AWS account with multiple IAM users. The administrator created an IAM policy that allows all users to launch EC2 instances, but only if they use a specific AMI ID (ami-12345678) and a specific instance type (t3.micro). The policy uses a condition that checks the EC2 instance type and AMI ID. However, a user is able to launch an EC2 instance with a different AMI ID and a larger instance type. The administrator reviews the policy and confirms that the condition is correctly written. What is the most likely reason that the policy is not working as expected?

Accepted Answer

The policy does not include an explicit deny statement for non-compliant launches.. The most likely reason is that the user has another IAM policy attached (e.g., a managed policy or group policy) that allows ec2:RunInstances without the condition. IAM evaluates all policies; if any allow statement grants the action, the action is permitted unless explicitly denied. The conditional allow only restricts when that specific statement is used, but a separate unconditional allow overrides the condition. Adding an explicit deny for non-compliant launches would block them regardless of other policies.

Answer

The condition keys used (ec2:InstanceType and ec2:ImageId) are not supported for the RunInstances action in IAM policies.

Answer

The policy is attached to the user but must also be attached to the IAM group.

Answer

The condition is written incorrectly; it should use StringLike instead of StringEquals.

Question 3

Which TWO actions are valid ways to grant an IAM user access to an S3 bucket owned by another AWS account? (Choose TWO.)

Accepted Answer

Have the user assume an IAM role in the bucket-owning account with appropriate permissions.. Correct answers are A and B. Option A: Assuming a role in the bucket-owning account is a standard cross-account access method. Option B: A bucket policy granting access to the user's AWS account, combined with the user having appropriate IAM permissions (e.g., s3:GetObject), allows access. Option C is incorrect because the user's own IAM policy cannot grant access to resources in another account; the resource owner must grant access. Option D is incorrect because ACLs do not support granting access to an IAM user ARN; they only support AWS accounts or predefined groups. Option E is incorrect because S3 access points are used within the same account or with bucket policies, but cannot be used to grant access to an IAM user in another account directly.

Answer

Attach an IAM policy to the user in their own account allowing access to the bucket.

Answer

Add the user's ARN to the bucket's ACL.

Answer

Use an S3 access point with a policy that allows the user.

Question 4

A security engineer needs to design an IAM policy that allows an IAM user to launch EC2 instances only if they specify a specific security group ID (sg-12345) and a specific instance type (t2.micro). Which policy achieves this?

Accepted Answer

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:RunInstances",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "ec2:InstanceType": "t2.micro",
          "ec2:SecurityGroup": "sg-12345"
        }
      }
    }
  ]
}. It uses the condition keys 'ec2:InstanceType' and 'ec2:SecurityGroup' to restrict the RunInstances action to only allow launching t2.micro instances into the security group sg-12345. Option A incorrectly specifies the security group as a resource ARN, but security groups cannot be specified as resources in RunInstances; they are specified via condition keys. Option B uses 'aws:RequestTag/security-group' which is not a valid condition key for security groups; security groups are identified by 'ec2:SecurityGroup'. Option C only restricts instance type but does not restrict the security group. Therefore, only D correctly enforces both constraints.

Answer

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:RunInstances",
      "Resource": "arn:aws:ec2:*:*:security-group/sg-12345",
      "Condition": {
        "StringEquals": { "ec2:InstanceType": "t2.micro" }
      }
    }
  ]
}

Answer

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:RunInstances",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "ec2:InstanceType": "t2.micro",
          "aws:RequestTag/security-group": "sg-12345"
        }
      }
    }
  ]
}

Answer

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:RunInstances",
      "Resource": "*",
      "Condition": {
        "StringEquals": { "ec2:InstanceType": "t2.micro" }
      }
    }
  ]
}

Question 5

During an incident response, a security engineer needs to capture a forensic image of an EC2 instance's root volume for analysis. The instance is running and cannot be stopped. What is the recommended approach to capture the volume without stopping the instance?

Accepted Answer

Create a snapshot while the volume is attached to the instance.. The correct approach is to create a snapshot of the EBS root volume while it is still attached to the running instance (Option C). Snapshots can be taken of in-use volumes without stopping the instance, providing a point-in-time copy for forensic analysis. Option B is incorrect because you cannot detach the root volume of a running instance without first stopping it, which contradicts the requirement not to stop the instance.

Answer

Use the dd command via AWS Systems Manager to create a raw image and store it in S3.

Answer

Detach the volume from the instance, create a snapshot, and then attach it to a forensic analysis instance.

Answer

Use AWS Systems Manager to run a command that copies the volume content to S3.

Question 6

A company has a CloudTrail trail that logs management events for all regions in the management account. They want to also log data events for all S3 buckets in the organization. Which configuration change will meet this requirement with the LEAST operational overhead?

Accepted Answer

Modify the existing trail to add an event selector for S3 data events with a scope of all buckets.. CloudTrail trails can be configured with an event selector that includes data events for S3, and setting the scope to 'all buckets' logs data events for every S3 bucket in the account without needing separate configurations. This approach reuses the existing management trail, minimizing operational overhead by avoiding additional trails, services, or aggregation steps.

Answer

Use Amazon EventBridge to capture S3 events and forward them to CloudTrail.

Answer

Enable S3 server access logs for all buckets and aggregate them using Athena.

Answer

Create a new trail in each member account to log S3 data events and deliver to a central S3 bucket.

Question 7

A security engineer notices that an EC2 instance is sending outbound traffic to a known malicious IP address. The instance is part of an Auto Scaling group behind an Application Load Balancer. The engineer needs to immediately stop the exfiltration while preserving forensic evidence. What is the BEST course of action?

Accepted Answer

Remove the instance from the target group and apply a security group that denies all traffic.. Removing the instance from the target group immediately stops new traffic from the Application Load Balancer to the instance, while applying a security group that denies all outbound traffic (e.g., a custom security group with no outbound rules) halts any ongoing exfiltration without destroying the instance or its attached EBS volumes. This preserves the forensic evidence (memory, disk, logs) for later analysis, unlike termination or shutdown which could lose volatile data.

Answer

Detach the EBS volume from the instance.

Answer

Terminate the EC2 instance immediately.

Answer

Shut down the instance from within the OS.

Question 8

A security team is setting up incident response automation. Which TWO steps should be taken to ensure that a compromised EC2 instance is isolated while preserving forensic data? (Choose TWO.)

Accepted Answer

Remove the instance from any Auto Scaling group or load balancer target group.. Removing the instance from Auto Scaling groups or load balancer target groups stops new traffic from being routed to it, effectively isolating it from application traffic without destroying the instance. Option D is correct because creating an EBS snapshot preserves the root volume's data for forensic analysis before any changes occur. Together, these steps ensure the instance is isolated for investigation while retaining evidence.

Answer

Assign a new security group that denies all inbound and outbound traffic.

Answer

Shut down the instance from the OS.

Answer

Terminate the instance.

Question 9

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The ALB is configured to terminate SSL/TLS and forward traffic to the instances over HTTP. The security team wants to ensure that the instances only accept traffic from the ALB, not from any other source. How can this be achieved?

Accepted Answer

Configure the instance security group to allow HTTP traffic only from the ALB's security group.. Referencing the ALB's security group in the instance security group rule allows traffic only from the ALB, regardless of the ALB's IP address changes. This leverages AWS security group referencing, which is a managed and scalable way to restrict traffic to a specific source security group. The ALB's security group acts as a logical identifier, ensuring that only traffic forwarded by the ALB reaches the instances.

Answer

Configure the instance security group to allow HTTP traffic only from the VPC CIDR block.

Answer

Configure the network ACL on the instance's subnet to allow HTTP traffic only from the ALB's private IP address.

Answer

Configure the instance security group to allow HTTP traffic only from the subnet CIDR block where the ALB resides.

Question 10

A company uses AWS CloudTrail to log all API calls. During an incident investigation, the security team needs to identify who deleted an S3 bucket. CloudTrail logs are stored in a centralized S3 bucket with server-side encryption using AWS KMS. Which additional step is required to ensure the CloudTrail logs can be queried quickly for this investigation?

Accepted Answer

Use Amazon Athena with a table defined over the S3 bucket. Amazon Athena allows you to query CloudTrail logs directly in S3 using standard SQL without needing to move or transform the data. Since the logs are already in a centralized S3 bucket, defining a table over that location enables fast, ad-hoc queries to identify the specific DeleteBucket event, including who performed it and when. This approach is cost-effective and avoids additional streaming or storage costs.

Answer

Enable CloudTrail Lake

Answer

Stream logs to CloudWatch Logs and use CloudWatch Logs Insights

Answer

Enable Amazon GuardDuty

Question 11

A company has enabled AWS CloudTrail in all accounts and regions, with log file validation enabled. The security team needs to verify that a specific log file has not been modified since it was delivered. Which action should be taken?

Accepted Answer

Use the AWS CLI `validate-logs` command with the digest file from the S3 bucket.. CloudTrail log file validation creates a hash of each log file and stores it in a digest file. To verify that a specific log file has not been altered since delivery, you must use the AWS CLI `validate-logs` command, which compares the hash in the digest file against the current hash of the log file. This command also validates the digital signature of the digest file itself, ensuring end-to-end integrity.

Answer

Query the log files using Amazon CloudWatch Logs Insights.

Answer

Enable S3 server-side encryption with AWS KMS (SSE-KMS) on the CloudTrail bucket.

Answer

Enable S3 Object Lock on the bucket to prevent modifications.

Question 12

A security team wants to implement a centralized logging solution for multiple AWS accounts. The team needs to collect VPC Flow Logs, CloudTrail logs, and DNS query logs from all accounts. Which THREE services should the team use to aggregate these logs? (Choose THREE.)

Accepted Answer

Amazon Route 53 Resolver query logging. Amazon Route 53 Resolver query logging (Option C) is correct because it enables centralized collection of DNS query logs from VPCs across multiple AWS accounts. By configuring Route 53 Resolver query logging to send logs to a central Amazon S3 bucket or CloudWatch Logs group, the security team can aggregate DNS query logs from all accounts, meeting the requirement for centralized DNS logging.

Answer

AWS CloudHSM

Answer

AWS Config

Question 13

A company uses AWS CloudTrail to log API activity across multiple accounts. The security team wants to ensure that any S3 bucket created with public read access is detected within minutes. Which solution is MOST efficient?

Accepted Answer

Create an Amazon EventBridge rule that matches CloudTrail CreateBucket API calls and triggers a Lambda function that inspects the bucket's public access settings and alerts if public.. It uses an Amazon EventBridge rule to capture the CloudTrail `CreateBucket` API call in near real-time, then triggers a Lambda function to immediately inspect the bucket's public access settings. This approach detects public buckets within minutes without polling or batch processing, making it the most efficient solution for the stated requirement.

Answer

Use AWS Config rules to check S3 bucket public access settings and trigger an AWS Lambda function to send alerts.

Answer

Use S3 server access logs and run a daily script to parse the logs for PutBucketAcl actions.

Answer

Enable CloudTrail log file validation and use Athena to query logs hourly for CreateBucket events with public ACLs.

Question 14

A company uses Amazon Route 53 for DNS and wants to log all DNS queries made from its VPC. The logs must be stored in Amazon S3 for compliance purposes. Which solution meets these requirements?

Accepted Answer

Enable Route 53 Resolver query logging and publish to an S3 bucket.. Route 53 Resolver query logging is the native AWS feature designed to capture DNS queries that originate from resources within a VPC. By enabling this feature and specifying an S3 bucket as the destination, you can log all DNS queries made by EC2 instances, Lambda functions, and other VPC resources without needing any additional agents or configuration. This directly meets the requirement for storing DNS query logs in S3 for compliance.

Answer

Install a CloudWatch Logs agent on each EC2 instance and configure it to send DNS logs to CloudWatch Logs.

Answer

Enable AWS CloudTrail for DNS API calls and deliver to an S3 bucket.

Answer

Enable VPC Flow Logs and publish to an S3 bucket.

Question 15

A security engineer is configuring automated response to a GuardDuty finding of type 'UnauthorizedAccess:EC2/SSHBruteForce'. The engineer needs to isolate the compromised instance by modifying the security group to deny all inbound traffic. Which AWS service should be used to orchestrate this response?

Accepted Answer

AWS Systems Manager Automation. AWS Systems Manager Automation is the correct service because it provides a pre-built runbook, AWS-IsolateInstanceEC2, specifically designed to isolate an EC2 instance by modifying its security group to deny all inbound traffic. This runbook can be triggered directly by a CloudWatch Events rule that matches the GuardDuty finding, enabling fully automated incident response without custom code. Systems Manager Automation also supports cross-account and cross-region execution, making it suitable for enterprise-scale response orchestration.

Answer

AWS Lambda

Answer

AWS CloudFormation

Answer

AWS Config