SCS-C02 Practice Test 25 — 15 Questions

Question 1

A security engineer is designing a network architecture for a multi-tier application. The web servers must be accessible from the internet, while the application servers must only be accessible from the web servers. Which TWO configurations should be used? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Place the web servers in a public subnet with a route to an internet gateway.. Placing web servers in a public subnet with a route to an internet gateway allows them to receive inbound traffic from the internet. This is the standard AWS design for internet-facing resources, where the subnet's route table directs 0.0.0.0/0 traffic to an internet gateway, enabling direct communication from the internet.

Answer

Configure a NAT gateway in the private subnet for the application servers.

Answer

Use a network ACL on the application subnet to allow inbound traffic from the web subnet's IP range.

Answer

Place the application servers in a public subnet with a route to an internet gateway.

Question 2

A security engineer is investigating a potential security incident. The engineer has enabled CloudTrail and VPC Flow Logs. Which THREE pieces of information can the engineer obtain from CloudTrail logs that are NOT available in VPC Flow Logs? (Choose three.)

Accepted Answer

The AWS Region where the API call was made.. CloudTrail logs capture management-plane API calls, including the AWS Region where the call was made (via the 'awsRegion' field). VPC Flow Logs only capture network-level metadata (IP addresses, ports, protocols) and have no visibility into the AWS Region of an API call because they operate at Layer 3/4 of the OSI model and do not log control-plane events. Therefore, the Region information is uniquely available in CloudTrail.

Answer

The payload of the API request.

Answer

The destination IP address and port of the network traffic.

Question 3

A company wants to implement a defense-in-depth strategy for its web application running on EC2 instances. Which TWO AWS services should be used to provide both network and application-layer protection?

Accepted Answer

AWS WAF. AWS WAF is correct because it provides application-layer protection by inspecting HTTP/HTTPS requests to your web application, allowing you to block common attack patterns such as SQL injection and cross-site scripting (XSS) using customizable rules. Security Groups are correct because they act as a virtual firewall at the instance level (network layer), controlling inbound and outbound traffic based on IP addresses, ports, and protocols, thus forming the first line of defense in a defense-in-depth strategy.

Answer

Amazon GuardDuty

Answer

AWS Shield Advanced

Answer

Network ACLs

Question 4

A company uses AWS KMS to encrypt data in Amazon S3. The security team wants to ensure that only users from a specific AWS account can decrypt objects. Which TWO steps should be taken to achieve this?

Accepted Answer

Configure the KMS key policy to allow the target AWS account to use the key for decrypt.. Options B and D are correct. To allow decryption by a specific AWS account, you must configure the KMS key policy to grant the target account permission to use the key for decrypt (option B). Additionally, the target account must create an IAM policy that allows its users to call the kms:Decrypt action (option D). Option A is incorrect because S3 bucket policies cannot grant KMS decryption permissions; they only control S3 operations. Option C is incorrect because using a separate KMS key per object adds unnecessary complexity and does not solve the cross-account requirement. Option E is incorrect because enabling S3 default encryption with a KMS key does not restrict decryption to a specific account; it only ensures encryption is applied.

Answer

Add a bucket policy that denies decrypt for all users except those from the target account.

Answer

Use a different KMS key for each object to isolate permissions.

Answer

Enable S3 default encryption with the KMS key.

Question 5

A company configures a Route 53 alias record to point to a CloudFront distribution. The security team wants to ensure that users can only access the website via CloudFront and not directly via the S3 bucket origin. What additional configuration is needed?

Accepted Answer

Create an Origin Access Control (OAC) for the S3 bucket origin. An Origin Access Control (OAC) is the recommended AWS mechanism to restrict access to an S3 bucket origin so that it only accepts requests from a specific CloudFront distribution. By configuring OAC on the CloudFront distribution and updating the S3 bucket policy to deny any requests that do not include the required OAC headers, the security team ensures that users cannot bypass CloudFront and access the S3 bucket directly via its public URL.

Answer

Create a Route 53 health check to verify CloudFront availability

Answer

Configure CloudFront signed URLs to restrict access

Answer

Attach a security group to the S3 bucket

Question 6

A security engineer is implementing centralized logging across multiple AWS accounts. Which TWO actions should the engineer take to ensure logs are securely stored and immutable? (Choose TWO.)

Accepted Answer

Use AWS KMS with a customer managed key for encryption. Using AWS KMS with a customer managed key (CMK) for encryption ensures that the security engineer has full control over the encryption keys, including key rotation, access policies, and the ability to disable or revoke the key. This prevents unauthorized decryption of logs, even by AWS, and is a critical component of securing log data at rest. Option C is correct because enabling S3 Object Lock on the destination bucket enforces a write-once-read-many (WORM) model, preventing logs from being deleted or overwritten for a specified retention period, which ensures immutability and compliance with regulatory requirements.

Answer

Enable S3 Transfer Acceleration on the bucket

Answer

Enable CloudTrail log file validation

Answer

Enable MFA Delete on the bucket

Question 7

A security engineer is investigating a potential security incident in an AWS account. The engineer needs to determine which user or role performed a specific API call that created a new security group. Which THREE AWS tools can the engineer use to find this information? (Choose THREE.)

Accepted Answer

AWS CloudTrail event history. D, and E are correct. CloudTrail logs all API calls, including who made the call. CloudTrail event history provides a view of the last 90 days. AWS Config records configuration changes, including security group creation. Option B is wrong because CloudWatch Logs does not capture API calls unless specifically configured. Option C is wrong because VPC Flow Logs capture network traffic, not API calls.

Answer

Amazon CloudWatch Logs

Answer

VPC Flow Logs

Question 8

A security team needs to analyze historical CloudTrail logs across multiple AWS accounts to detect patterns of suspicious activity. Which solution provides the MOST cost-effective and scalable analysis?

Accepted Answer

Aggregate logs into a central S3 bucket and query with Amazon Athena. Aggregating CloudTrail logs into a central S3 bucket and querying with Amazon Athena is the most cost-effective and scalable solution because Athena uses a serverless, pay-per-query model with no infrastructure to manage, and it can directly analyze large volumes of structured log data stored in S3 using standard SQL. This approach avoids the cost of provisioning and maintaining dedicated clusters (as with Redshift or Elasticsearch) and avoids the per-GB ingestion and storage fees of CloudWatch Logs Insights, making it ideal for historical analysis across multiple accounts.

Answer

Stream logs to Amazon Elasticsearch Service and use Kibana

Answer

Load logs into Amazon Redshift for analysis

Answer

Use Amazon CloudWatch Logs Insights across all accounts

Question 9

A company needs to encrypt data at rest for an Amazon RDS for Oracle database. The database is deployed in a Multi-AZ configuration. The company also wants to encrypt automated backups and snapshots. Which TWO steps should the security team take?

Accepted Answer

Enable encryption at rest when launching the RDS instance.. Encryption must be enabled at launch; it cannot be added later. Option C is correct because enabling encryption at rest automatically encrypts backups and snapshots. Option B is wrong because encryption cannot be enabled on an existing unencrypted instance. Option D is wrong because encryption must be enabled at launch, not after. Option E is wrong because KMS key must be specified at launch; can be changed later only for certain engines.

Answer

Modify the DB instance to enable encryption after creation.

Answer

Enable encryption at rest on the existing RDS instance via a modification.

Answer

Specify a KMS key after the instance is launched.

Question 10

A security engineer needs to ensure that all changes to IAM policies in an AWS account are logged and that the logs are immutable and cannot be deleted by any user, including the root user. Which actions should the engineer take? (Choose two.)

Accepted Answer

Enable AWS CloudTrail to log IAM events.. AWS CloudTrail is the service specifically designed to log all API activity, including IAM policy changes. By enabling CloudTrail with management event logging, all IAM CreatePolicy, PutPolicy, DeletePolicy, and similar actions are recorded in a log file delivered to an S3 bucket. This provides an authoritative audit trail of who made the change, when, and from which source IP. Option E is correct because S3 Object Lock in compliance mode prevents any user, including the root user, from overwriting or deleting objects for the specified retention period. This ensures the log files are immutable and cannot be tampered with or deleted, fulfilling the requirement that logs cannot be deleted by any user.

Answer

Enable default encryption with AWS KMS on the bucket.

Answer

Enable S3 Versioning on the bucket.

Answer

Enable multi-factor authentication (MFA) delete on the S3 bucket.

Question 11

A security team wants to centrally collect and analyze VPC Flow Logs from multiple AWS accounts for security monitoring. Which solution is MOST scalable and cost-effective?

Accepted Answer

Use AWS Organizations to centralize logging by delivering VPC Flow Logs to a centralized S3 bucket and query with Amazon Athena.. Using AWS Organizations to centrally deliver VPC Flow Logs to a centralized S3 bucket, then querying with Amazon Athena, is both scalable and cost-effective. S3 provides durable, low-cost storage for large volumes of log data, and Athena allows serverless, pay-per-query analysis without provisioning infrastructure. This approach avoids the operational overhead of managing EC2 instances or streaming pipelines, and scales seamlessly as log volume grows.

Answer

Aggregate logs in an EC2 instance running an ELK stack.

Answer

Use Amazon Kinesis Data Firehose to stream logs to an S3 bucket and process with AWS Lambda.

Answer

Configure VPC Flow Logs to send to a centralized CloudWatch Logs account using cross-account subscriptions.

Question 12

A security engineer notices that an S3 bucket contains objects that are accessible to authenticated users from other AWS accounts. The bucket policy allows access to the 'aws:SourceArn' condition that references an Amazon Resource Name (ARN) from another account. What is the MOST effective way to restrict access to only users from the company's own account?

Accepted Answer

Add a condition using 'aws:SourceAccount' with the company's account ID.. Using the 'aws:SourceAccount' condition key with the company's account ID ensures that only requests originating from that account are allowed, effectively blocking cross-account access from other accounts. Option A is incorrect because SCPs apply to principals within the organization and cannot restrict access from external accounts ('aws:SourceAccount' is not evaluated for SCPs). Option B is incorrect because simply removing the bucket policy would break all cross-account access but also removes any existing policy-based permissions within the account; adding IAM policies alone does not grant cross-account access and may not be the most effective solution. Option C is incorrect because 'aws:SourceArn' is typically used for service-to-service access (e.g., SNS to S3) and does not reliably restrict by account; the proper condition key for account-level restriction is 'aws:SourceAccount'.

Answer

Apply an SCP to deny s3:GetObject for any principal outside the organization.

Answer

Remove the bucket policy and add an IAM policy to the company's users.

Answer

Modify the condition to use 'aws:SourceArn' with an ARN from the company's account.

Question 13

A company wants to automatically detect and notify about any S3 buckets that have public read access. Which combination of services should be used?

Accepted Answer

AWS Config and Amazon EventBridge. AWS Config can evaluate S3 bucket public access using managed rules, and Amazon EventBridge can trigger notifications via SNS.

Answer

AWS CloudTrail and AWS Lambda

Answer

AWS IAM Access Analyzer and Amazon CloudWatch

Answer

AWS Trusted Advisor and Amazon SES

Question 14

A company has a security policy that requires all IAM users to use multi-factor authentication (MFA) when accessing the AWS Management Console. The company also wants to enforce this policy using an SCP. Which TWO conditions must be met for the SCP to be effective?

Accepted Answer

The SCP must use a condition that checks if MFA is present.. Options A and D are correct. The SCP must use a condition key such as `aws:MultiFactorAuthPresent` to deny access if the user has not authenticated with MFA (A), and it must be attached to the root organizational unit to apply to all accounts in the organization (D). Option B is incorrect because `aws:SourceIp` is for IP-based restrictions, not MFA. Option C is incorrect because SCPs cannot require MFA registration; they can only enforce conditional access. Option E is incorrect because SCPs are attached to organizational units, not individual IAM users.

Answer

The SCP must use the condition key 'aws:SourceIp' to allow only MFA-enabled IPs.

Answer

The SCP must require users to register MFA devices before accessing the console.

Answer

The SCP must be attached to individual IAM users.

Question 15

A security engineer is investigating a potential compromise of an EC2 instance. The engineer wants to capture memory and disk forensics without shutting down the instance. Which service should the engineer use?

Accepted Answer

AWS Systems Manager. AWS Systems Manager (SSM) is the correct service because it provides the capability to perform forensic data collection on a running EC2 instance without shutting it down. Specifically, SSM Automation documents like AWS-RunShellScript or AWS-GatherEC2InstanceInfo can execute commands to capture memory (e.g., using LiME or fmem) and disk forensics (e.g., dd or volume snapshots) via the SSM Agent, which runs as a system service and does not require instance termination.

Answer

AWS Config

Answer

EC2 Instance Connect

Answer

Amazon CloudWatch Logs