SCS-C02 Practice Test 24 — 15 Questions

Question 1

A company's security team wants to receive alerts when an IAM user creates a new access key. Which AWS service can be used to monitor and notify on this specific API call?

Accepted Answer

AWS CloudTrail with Amazon CloudWatch Events. CloudTrail logs IAM CreateAccessKey events, and CloudWatch Events can trigger a notification. Option A is wrong because Trusted Advisor is for best practices. Option B is wrong because GuardDuty is for threat detection. Option D is wrong because AWS Config is for resource compliance.

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Answer

AWS Config

Question 2

A company is using AWS KMS to encrypt data in Amazon S3. The security team discovers that an S3 bucket has a bucket policy that allows s3:PutObject without requiring encryption. What is the risk?

Accepted Answer

Data can be uploaded without encryption at rest. When the bucket policy allows s3:PutObject without requiring encryption (e.g., x-amz-server-side-encryption header), data can be uploaded as plaintext and stored without encryption at rest, violating data protection requirements. Option A is incorrect because the KMS key usage is controlled by KMS policies, not the bucket policy. Option B is incorrect because authentication is required for PutObject, but encryption is not enforced. Option C is incorrect because encryption in transit (TLS) is separate from encryption at rest.

Answer

The KMS key can be used by unauthorized users

Answer

Data can be downloaded without authentication

Answer

Data in transit is not encrypted

Question 3

A company wants to ensure that data stored in Amazon EBS volumes is encrypted at rest. What is the easiest way to achieve this?

Accepted Answer

Enable EBS encryption by default in the AWS Region. Enabling EBS encryption by default in the AWS Region automatically encrypts all new EBS volumes and snapshots with no additional effort. Option A is incorrect: KMS key rotation does not enable encryption; it rotates the key used for encryption. Option B is incorrect: while you can encrypt individual volumes after creation, the easiest method is to enable default encryption. Option D is incorrect: application-level encryption is not needed for EBS volumes and is more complex to implement.

Answer

Use AWS KMS to rotate the EBS encryption key

Answer

Use a script to encrypt each volume after creation

Answer

Use application-level encryption

Question 4

A company has an AWS Direct Connect connection to its on-premises data center. The security team wants to ensure that traffic between the VPC and the data center is encrypted. Which solution should they use?

Accepted Answer

Set up an IPsec VPN connection over the Direct Connect virtual interface.. AWS Direct Connect does not encrypt traffic by default. To encrypt, you can use an IPsec VPN over the Direct Connect virtual interface (option A). Option B is incorrect because Direct Connect does not support native encryption on the virtual interface; encryption must be added via IPsec or application-level encryption. Option C is not optimal because the requirement specifies using the existing Direct Connect connection, not internet-based VPN. Option D is incorrect because VPC Peering connects VPCs within AWS, not an on-premises data center, and does not provide encryption.

Answer

Enable encryption on the Direct Connect virtual interface.

Answer

Use AWS Site-to-Site VPN over the internet.

Answer

Use VPC Peering to connect the VPC to the data center.

Question 5

Which THREE of the following are best practices for managing IAM access keys? (Choose THREE.)

Accepted Answer

Use IAM roles for EC2 instances instead of access keys. Option A is correct because IAM roles deliver temporary credentials to EC2 instances via the instance metadata service, eliminating the need to store long-lived access keys on the instance and automatically rotating credentials. Option C is correct because unused access keys represent an unnecessary attack surface; deleting them (or deactivating them first) removes the risk of leaked or forgotten credentials being abused. Option E is correct because regularly rotating access keys limits the window of exposure if a key is compromised and aligns with AWS guidance to rotate keys periodically. Options B and D are not best practices: long-lived keys increase exposure risk, and embedding keys in application code makes them hard to rotate and easy to leak through source control or logs.

Answer

Use long-lived access keys for applications

Answer

Embed access keys in application code for convenience

Question 6

A company uses AWS Shield Advanced to protect its web application from DDoS attacks. The security team wants to receive real-time notifications when a DDoS attack is detected. Which configuration should be used?

Accepted Answer

Use Amazon CloudWatch Events to trigger an AWS Lambda function that sends an Amazon SNS notification when a Shield Advanced event occurs.. AWS Shield Advanced integrates with Amazon CloudWatch Events (now Amazon EventBridge) to emit events when DDoS attacks are detected. The standard pattern is to create an EventBridge rule that matches Shield Advanced events and triggers a Lambda function, which then publishes to an SNS topic for real-time notification. This is the documented, supported mechanism for proactive DDoS alerting.

Answer

Enable VPC Flow Logs and create a CloudWatch alarm for high traffic volume.

Answer

Subscribe an SNS topic to Shield Advanced notifications directly.

Answer

Enable AWS CloudTrail and create a metric filter for DDoS events.

Question 7

A company wants to encrypt data at rest in an Amazon S3 bucket. Which AWS service can centrally manage the encryption keys?

Accepted Answer

AWS Key Management Service (AWS KMS). AWS Key Management Service (AWS KMS) is the correct service because it is a fully managed, centralized service that allows you to create, manage, and control the encryption keys used to encrypt data at rest in Amazon S3. S3 integrates directly with KMS via Server-Side Encryption with AWS KMS (SSE-KMS), enabling you to use customer managed keys (CMKs) or AWS managed keys to enforce granular access control and audit key usage through AWS CloudTrail.

Answer

AWS CloudHSM

Answer

AWS Certificate Manager (ACM)

Answer

AWS Secrets Manager

Question 8

A company has a requirement to log all network traffic flowing through a VPC, including traffic between EC2 instances within the same subnet. Which AWS service should be used?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information for network interfaces in a VPC, including traffic between EC2 instances within the same subnet, and can be published to CloudWatch Logs or S3. It is the only AWS service listed that provides packet-level metadata for all traffic flowing through VPC network interfaces.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

AWS CloudTrail

Question 9

A company has a requirement to automatically rotate encryption keys for Amazon EBS volumes every 90 days. The EBS volumes are encrypted using AWS KMS. What is the simplest way to meet this requirement?

Accepted Answer

Create a new KMS key every 90 days and re-encrypt volumes using a script.. KMS automatic key rotation creates new backing keys yearly, not every 90 days. To meet the 90-day rotation requirement, you must manually create a new KMS key every 90 days and then re-encrypt the EBS volumes (e.g., by taking a snapshot, copying it with the new key, and restoring). Option A is incorrect because AWS Secrets Manager manages secrets, not KMS keys; it cannot rotate KMS keys. Option C is incorrect because client-side encryption would require managing keys outside of KMS, which adds complexity and does not meet the requirement of using AWS KMS. Option D is incorrect because automatic key rotation on the existing KMS key only rotates the backing key once per year, not every 90 days.

Answer

Use AWS Secrets Manager to rotate the KMS key automatically.

Answer

Switch to client-side encryption and rotate keys manually.

Answer

Enable automatic key rotation on the existing KMS key.

Question 10

A company uses IAM roles for EC2 instances. An application running on an EC2 instance needs to read from an S3 bucket in another AWS account. What is the most secure way to grant access?

Accepted Answer

Create an IAM role in the target account with read access to the bucket, and allow the EC2 instance's role to assume it.. The most secure cross-account access pattern is to create an IAM role in the target (bucket-owning) account with read access to the S3 bucket, and allow the EC2 instance's role in the source account to assume it via STS AssumeRole. This uses temporary credentials, avoids long-term keys, and follows least privilege without exposing the bucket publicly.

Answer

Store the other account's IAM user access keys in the EC2 instance.

Answer

Make the bucket public.

Answer

Create a bucket policy that allows access from the EC2 instance's public IP.

Question 11

A company uses AWS Organizations with multiple accounts. They want to centralize logging of all API calls across all accounts and store them in a single S3 bucket. Which configuration should be used?

Accepted Answer

Create an organization trail in the management account. AWS Organizations allows you to create an organization trail in the management account that automatically logs API calls for all member accounts. This centralizes CloudTrail logs into a single S3 bucket without needing to configure individual trails per account, ensuring complete coverage and simplified management.

Answer

Use AWS Config to record API calls across all accounts

Answer

Create a separate CloudTrail trail in each account and aggregate logs using Amazon Athena

Answer

Enable VPC Flow Logs in each account and send to a central S3 bucket

Question 12

Which THREE AWS services can be used to detect and alert on suspicious network traffic patterns? (Choose three.)

Accepted Answer

AWS Network Firewall. AWS Network Firewall is correct because it is a managed firewall service that can inspect network traffic at the VPC level using stateful and stateless rules. It can detect suspicious patterns such as port scans, malicious IP addresses, or protocol anomalies and generate alerts via Amazon CloudWatch metrics and logs, enabling real-time notification of suspicious network traffic.

Answer

AWS Systems Manager

Answer

AWS CloudTrail

Question 13

A company uses AWS Organizations with multiple accounts. The security team needs to enforce that all Amazon S3 buckets across the organization are configured to block public access. Which solution should be used to centrally enforce this requirement?

Accepted Answer

Use a service control policy (SCP) to deny the s3:PutBucketPublicAccessBlock action at the organization root.. Service control policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts within the organization. By denying the s3:PutBucketPublicAccessBlock action at the organization root, you prevent any account from disabling or modifying the public access block settings on any S3 bucket, thereby enforcing the security team's requirement across all accounts. This approach works because SCPs are applied at the organization level and override any IAM or bucket-level permissions that would otherwise allow the action.

Answer

Enable AWS Trusted Advisor to automatically remediate public buckets.

Answer

Create an IAM role in each account that denies the s3:PutBucketPublicAccessBlock action.

Answer

Apply a bucket policy to each bucket that blocks public access.

Question 14

A company has a web application running on EC2 instances behind an Application Load Balancer (ALB). The application uses a custom header X-Auth-Token to authenticate requests. The security team wants to use AWS WAF to block requests that do not contain this header or contain an invalid token. The WAF is associated with the ALB. The team creates a rule with a match condition that checks for the presence of the X-Auth-Token header and a regex pattern for the token value. However, the rule is not blocking any requests. What is the most likely cause?

Accepted Answer

There is an allow rule with a higher priority that allows all requests before the block rule is evaluated.. AWS WAF evaluates rules in priority order, and the first rule that matches determines the action. If an allow rule with a lower number (higher priority) matches all requests, the block rule is never evaluated. Therefore, the most likely cause is that an allow rule with higher priority is permitting all traffic before the block rule can inspect the header.

Answer

AWS WAF is not supported for Application Load Balancers; it only supports CloudFront.

Answer

AWS WAF cannot inspect custom headers; it can only inspect standard HTTP headers.

Answer

The regex pattern for the token is too complex for AWS WAF to process.

Question 15

A security engineer is implementing automated incident response. The engineer wants to use AWS Lambda to automatically remediate GuardDuty findings. What is the recommended pattern to trigger the Lambda function?

Accepted Answer

Configure an Amazon EventBridge rule to match GuardDuty findings and invoke the Lambda function.. Amazon EventBridge is the recommended pattern because it natively integrates with AWS GuardDuty to receive all finding events in near real-time. By configuring an EventBridge rule that matches GuardDuty finding types (e.g., 'UnauthorizedAccess:EC2/SSHBruteForce'), you can directly invoke a Lambda function for automated remediation without polling or intermediate services. This pattern is serverless, event-driven, and follows AWS best practices for decoupled incident response.

Answer

Subscribe the Lambda function to an SNS topic that GuardDuty publishes findings to.

Answer

Use CloudWatch Logs subscription filter to trigger Lambda on GuardDuty log entries.

Answer

Have the Lambda function poll the EC2 instance metadata for threat indicators.