SCS-C02 Practice Test 25 — 15 Questions

Question 1

Which TWO are best practices for managing IAM roles for EC2 instances?

Accepted Answer

Apply the principle of least privilege when defining role permissions.. The principle of least privilege ensures that an IAM role attached to an EC2 instance grants only the minimum permissions required for the application to function. This reduces the attack surface and limits potential damage from compromised instances. AWS Identity and Access Management (IAM) roles for EC2 use temporary security credentials obtained via the instance metadata service (IMDS), eliminating the need for long-term access keys.

Answer

Regularly rotate IAM user access keys.

Answer

Attach the same role to all instances for simplicity.

Answer

Store AWS access keys directly on the instance.

Question 2

A security engineer is analyzing the VPC Flow Logs entry in the exhibit. The log shows traffic from an internal IP to an external IP. Which potential security concern should the engineer investigate?

Accepted Answer

An EC2 instance is attempting to connect to an external host on port 3389 (RDP).. The VPC Flow Logs entry shows outbound traffic from an internal IP to an external IP on destination port 3389, which is the default port for Remote Desktop Protocol (RDP). RDP outbound from an EC2 instance to an external host is a security concern because it could indicate an attacker using the instance as a pivot point to connect to an external command-and-control server or to exfiltrate data via an RDP tunnel. The log direction (src internal, dst external) and port 3389 specifically point to an outbound RDP attempt, not inbound scanning or DDoS.

Answer

The instance is participating in a DDoS attack against the external IP.

Answer

An external host is scanning the internal network on port 443.

Answer

The security group allows inbound RDP from 0.0.0.0/0.

Question 3

A security engineer is configuring an AWS environment to detect and respond to potential security threats. Which AWS service can be used to automate the remediation of unwanted access to Amazon S3 buckets by invoking AWS Lambda functions?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior across AWS accounts and workloads. It can integrate with AWS Lambda functions via CloudWatch Events to automate remediation actions, such as blocking unwanted access to S3 buckets by updating bucket policies or removing public access. This makes GuardDuty the correct choice for detecting and automatically responding to security threats against S3 resources.

Answer

AWS Config

Answer

Amazon Inspector

Answer

AWS WAF

Question 4

A company is using AWS Shield Advanced to protect its web application against DDoS attacks. Which additional AWS service can be used to automatically mitigate application layer attacks?

Accepted Answer

AWS WAF. AWS WAF is the correct choice because it integrates directly with AWS Shield Advanced to provide application-layer (Layer 7) DDoS mitigation. Shield Advanced handles network and transport layer attacks, while AWS WAF uses web access control lists (ACLs) to inspect HTTP/HTTPS traffic and block malicious requests such as SQL injection or cross-site scripting, which are common application-layer attack vectors.

Answer

AWS Network Firewall

Answer

Amazon GuardDuty

Answer

AWS Firewall Manager

Question 5

A company is using Amazon CloudWatch Logs to collect logs from its EC2 instances. The security team wants to ensure that logs are encrypted at rest and that access to the logs is controlled. Which solution should the team implement?

Accepted Answer

Enable encryption using AWS KMS customer managed keys (CMK) and apply IAM policies to control access.. CloudWatch Logs supports encryption at rest using AWS KMS customer managed keys (CMK), which allows the security team to control access to the encrypted log data via IAM policies and key policies. This ensures both encryption and fine-grained access control, meeting the requirements.

Answer

Use SSE-C with a customer-provided key to encrypt log data.

Answer

Use SSE-S3 to encrypt the log data in CloudWatch Logs.

Answer

Enable default encryption on the log group and use S3 bucket policies.

Question 6

A company is using AWS CloudTrail to monitor API activity in its AWS account. The security team needs to be alerted when unauthorized API calls are made to delete Amazon S3 buckets. Which TWO steps should the security team take to meet this requirement? (Choose TWO.)

Accepted Answer

Configure CloudTrail to deliver logs to Amazon CloudWatch Logs and create a metric filter for the DeleteBucket API call.. Option D is correct because CloudTrail can be configured to deliver management event logs to an Amazon CloudWatch Logs log group, where a metric filter can be created to match the DeleteBucket API call (for example, filtering on eventName = DeleteBucket and errorCode = AccessDenied), and a CloudWatch alarm on that metric can then trigger an SNS notification to alert the security team. Option E is correct because CloudWatch Events (now Amazon EventBridge) can match CloudTrail API activity by event pattern, such as {"eventSource":"s3.amazonaws.com","eventName":"DeleteBucket"}, and route the matching event directly to an Amazon SNS topic to notify the team. Option A is not correct because VPC Flow Logs capture IP traffic metadata at the ENI level, not API calls, so they cannot identify DeleteBucket events. Option B is not correct because a CloudTrail trail does not 'monitor CloudWatch Logs'; the correct direction is CloudTrail delivering logs to CloudWatch Logs, and a trail alone does not generate alerts. Option C is not correct because AWS Config rules evaluate resource configuration compliance and cannot detect or alert on individual DeleteBucket API calls.

Answer

Enable Amazon VPC Flow Logs to capture API calls and use Amazon Athena to query for DeleteBucket events.

Answer

Create an AWS CloudTrail trail that monitors Amazon CloudWatch Logs for DeleteBucket API calls.

Answer

Create an AWS Config rule to detect DeleteBucket API calls and send an SNS notification.

Question 7

A company uses a hybrid architecture with on-premises servers and AWS. The company uses AWS Site-to-Site VPN to connect to a VPC. The security team suspects that a VPN tunnel has been compromised and an attacker is intercepting traffic. The team needs to verify the integrity of the VPN connection. What is the MOST effective way to detect if traffic is being intercepted?

Accepted Answer

Monitor Amazon CloudWatch metrics for the VPN tunnel, such as tunnel state and data throughput.. Monitoring Amazon CloudWatch metrics for the VPN tunnel, specifically the 'TunnelState' metric, directly indicates whether the tunnel is up or down. A compromised tunnel that is intercepting traffic would likely cause the tunnel to flap or drop unexpectedly, which CloudWatch can alert on. Additionally, abnormal data throughput patterns (e.g., sudden spikes or drops) can signal interception or rerouting of traffic, making this the most effective way to detect integrity issues without relying on traffic content.

Answer

Use AWS Config to check VPN configuration compliance.

Answer

Use a third-party network monitoring tool to perform deep packet inspection.

Answer

Enable VPC Flow Logs and analyze traffic patterns for unusual destinations.

Question 8

Refer to the exhibit. A security engineer is reviewing an S3 bucket policy. The policy is intended to allow access only from the corporate network (10.0.0.0/8). What is a potential security issue with this policy?

Accepted Answer

The policy allows anonymous access from the specified IP range.. The policy's `Principal: "*"` element allows anonymous access from any IP address, and the `Condition` block only restricts the source IP to 10.0.0.0/8. This means any unauthenticated request originating from within the corporate network (10.0.0.0/8) is permitted, effectively granting anonymous access to the S3 bucket. The intended goal of restricting access to authenticated corporate users is not achieved, as no `aws:userid` or `aws:username` condition is enforced.

Answer

The policy grants access to all actions, not just GetObject.

Answer

The policy resource is incorrect; it should be the bucket ARN without the /*.

Answer

The policy does not include a condition to require MFA.

Question 9

Refer to the exhibit. An administrator applies this bucket policy to an S3 bucket. Which of the following statements describes the effect of this policy?

Accepted Answer

The policy denies all PutObject requests that do not specify SSE-KMS.. The bucket policy contains two Deny statements: the first denies PutObject when the `x-amz-server-side-encryption` header is not `aws:kms`, and the second denies PutObject when the header is absent (null). Together, they ensure that any upload without SSE-KMS is denied, effectively requiring SSE-KMS for all PutObject requests. Options B, C, and D are incorrect because the policy does not allow any unencrypted uploads or uploads with SSE-S3; it only allows uploads with SSE-KMS.

Answer

The policy allows uploads without encryption but denies uploads with SSE-KMS.

Answer

The policy allows unencrypted uploads but denies uploads with SSE-KMS.

Answer

The policy allows uploads with SSE-S3 but denies uploads with SSE-KMS.

Question 10

A company wants to allow cross-account access to an S3 bucket. The bucket owner (Account A) wants to grant read-only access to users in Account B. Which combination of policies is required?

Accepted Answer

A bucket policy in Account A granting s3:GetObject to Account B and an IAM policy in Account B allowing s3:GetObject. Cross-account S3 access requires two-sided permission: the bucket owner (Account A) must grant access via a bucket policy that allows Account B's principal to perform s3:GetObject, and the IAM user or role in Account B must also have an IAM policy allowing s3:GetObject. Both are evaluated, and the request is allowed only if both sides permit it.

Answer

A bucket ACL in Account A granting READ access to Account B

Answer

An IAM policy in Account A that allows s3:GetObject

Answer

An IAM role in Account B that grants s3:GetObject to Account A

Question 11

A company uses AWS Organizations and wants to enforce that all S3 buckets created in any account within the organization have default encryption enabled. Which policy should be used?

Accepted Answer

Use a service control policy (SCP) to deny creation of buckets without default encryption. (SCP) is correct because a service control policy can be applied to all accounts in an AWS Organization to deny the creation of S3 buckets without default encryption, providing a preventive control. Option A is incorrect because bucket policies are applied per bucket and are not preventive during creation. Option C is incorrect because IAM policies are account-specific and do not cover all accounts in the organization. Option D is incorrect because AWS Config rules are detective, not preventive; they can trigger remediation but do not prevent creation.

Answer

Use a bucket policy on each bucket to enforce encryption

Answer

Use an IAM policy to require encryption on all bucket creation actions

Answer

Use AWS Config rules to automatically enable encryption on new buckets

Question 12

A company uses AWS Secrets Manager to rotate secrets for its RDS database. The rotation fails periodically, and the security team needs to troubleshoot. Which CloudWatch metric should be monitored to detect rotation failures?

Accepted Answer

AWS/SecretsManager: SecretRotationSucceeded. The correct metric to monitor for Secrets Manager rotation failures is `AWS/SecretsManager:SecretRotationSucceeded`. When rotation fails, the `SecretRotationSucceeded` metric reports a value of 0, allowing the security team to set alarms. Option A is incorrect because KMS key usage metrics are not specific to rotation. Option C is incorrect because Lambda invocations may not capture all rotation failures and are not a direct indicator. Option D is incorrect because RDS metrics do not include Secrets Manager rotation status.

Answer

AWS/KMS: KeyUsage

Answer

AWS/Lambda: Invocations

Answer

AWS/RDS: DatabaseConnections

Question 13

Refer to the exhibit. This IAM policy is attached to a user. The user attempts to assume the AdminRole without using MFA. What is the result?

Accepted Answer

The user cannot assume the role because the Deny statement blocks all actions when MFA is not present. The Deny statement explicitly denies all actions when MFA is not present, overriding the Allow statement. Since the user is not using MFA, sts:AssumeRole is denied. Option A is incorrect because the Deny overrides the Allow. Option C is incorrect because the Deny applies to all actions, including sts:AssumeRole. Option D is incorrect because the Deny, not the Allow, imposes the MFA requirement.

Answer

The user can assume the role because the Allow statement grants it

Answer

The user can assume the role because the Deny statement does not apply to sts:AssumeRole

Answer

The user cannot assume the role because the Allow statement requires MFA

Question 14

Which AWS service can be used to centrally manage VPC security groups and network ACLs across multiple accounts in AWS Organizations?

Accepted Answer

AWS Firewall Manager. AWS Firewall Manager is the correct service because it provides centralized management of security groups and network ACLs across multiple accounts within AWS Organizations. It allows you to define common security rules and apply them automatically to new and existing accounts, ensuring consistent enforcement of VPC security policies without manual per-account configuration.

Answer

AWS Shield

Answer

AWS Config

Answer

AWS WAF

Question 15

A company wants to enforce that all IAM users use multi-factor authentication (MFA) to access the AWS Management Console. Which AWS service can be used to enforce this requirement?

Accepted Answer

AWS Identity and Access Management (IAM). AWS IAM allows you to create a policy with a condition that requires MFA for console access. Option A is wrong because AWS Organizations is used to manage multiple accounts, not to enforce MFA on individual users. Option B is wrong because AWS Config can check compliance but cannot enforce the requirement; it only evaluates resource configurations. Option D is wrong because Amazon Cognito is used for external identity federation, not for enforcing MFA on IAM users.

Answer

AWS Organizations

Answer

AWS Config

Answer

Amazon Cognito