SCS-C02 Practice Test 25 — 15 Questions

Question 1

Refer to the exhibit. A security engineer configured the above bucket policy for CloudTrail log delivery. However, logs are not being delivered. What is the most likely cause?

Accepted Answer

The condition requires 'bucket-owner-full-control' ACL, but CloudTrail does not set this ACL when delivering to the same account.. The bucket policy requires the 'bucket-owner-full-control' canned ACL, but CloudTrail by default uses 'bucket-owner-full-control' only when delivering to a different account. For same-account delivery, the ACL is not set, causing a mismatch. Option A is wrong because the principal is correct. Option B is wrong because the resource ARN is correct. Option D is wrong because the action is correct.

Answer

The Action should be 's3:PutObjectAcl' instead of 's3:PutObject'.

Answer

The Principal is incorrect; it should be the CloudTrail service principal for the region.

Answer

The Resource ARN is missing the account ID in the path.

Question 2

A company is using Amazon RDS for MySQL and needs to monitor database login attempts for security analysis. Which feature should be enabled to capture authentication events?

Accepted Answer

Enable RDS MySQL audit logs. Option D is correct because RDS MySQL supports general logs and audit logs that can capture login attempts. Enabling the '--log_queries_not_using_indexes' parameter logs queries without indexes, not login attempts. Option B is wrong because VPC Flow Logs capture network traffic. Option C is wrong because CloudTrail does not log database-level events.

Answer

Enable VPC Flow Logs for the RDS subnet

Answer

Enable AWS CloudTrail data events for RDS

Answer

Enable the '--log_queries_not_using_indexes' parameter

Question 3

A security engineer is investigating a potential data exfiltration from an EC2 instance. CloudTrail logs show that an IAM user created a new access key for an existing IAM role and used it to call S3 GetObject from an unfamiliar IP address. What is the MOST likely reason the CloudTrail logs captured this activity?

Accepted Answer

CloudTrail was enabled to capture management events.. Option B is correct because CloudTrail records IAM user actions, including creating access keys and API calls. Option A is wrong because VPC Flow Logs do not capture IAM actions. Option C is wrong because CloudTrail is enabled by default for management events. Option D is wrong because S3 server access logs do not capture IAM user actions.

Answer

S3 server access logs were enabled on the bucket containing the objects.

Answer

VPC Flow Logs were enabled for the EC2 instance's subnet.

Answer

The security engineer had enabled CloudTrail Insights.

Answer

AWS Config was enabled to record resource changes.

Question 4

A security engineer is investigating a potential security incident. Which TWO AWS services can be used to analyze historical network traffic patterns? (Choose TWO.)

Accepted Answer

VPC Flow Logs. Option A and Option D are correct. VPC Flow Logs capture IP traffic information, and Amazon Athena can query VPC Flow Logs stored in S3. Option B is wrong because CloudTrail records API calls, not network traffic. Option C is wrong because GuardDuty is for real-time threat detection. Option E is wrong because CloudWatch Logs can store flow logs but is not primarily for analysis.

Answer

Amazon GuardDuty

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail

Question 5

A security engineer is designing a logging solution for an application that runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The engineer needs to capture and store the following logs for analysis: (1) HTTP request logs from the ALB, (2) operating system logs from the EC2 instances, and (3) network traffic logs for the VPC. Which combination of AWS services should the engineer use? (Choose three.)

Accepted Answer

Enable access logging on the ALB and store logs in an S3 bucket.. Correct options: A (ALB access logs), B (CloudWatch Logs agent for OS logs), D (VPC Flow Logs). Option C is wrong because CloudTrail does not capture OS logs. Option E is wrong because S3 server access logs are for S3 buckets, not network traffic.

Answer

Enable S3 server access logging for the application's S3 buckets.

Answer

Enable AWS CloudTrail to capture API calls.

Question 6

A security engineer is reviewing AWS CloudTrail logs and finds that an IAM user 'developer1' deleted an S3 bucket. The engineer needs to determine the source IP address of the delete operation. Which field in the CloudTrail log record contains this information?

Accepted Answer

sourceIPAddress. Option B is correct because the 'sourceIPAddress' field in CloudTrail logs contains the IP address from which the API call was made. Option A is wrong because 'userIdentity' contains details about the IAM user or role, not the IP address. Option C is wrong because 'eventTime' is the timestamp of the event. Option D is wrong because 'requestParameters' contains the parameters of the request, not the IP address.

Answer

userIdentity

Answer

requestParameters

Answer

eventTime

Question 7

Refer to the exhibit. A security engineer runs the above AWS CLI command to search for CreateKeyPair events in CloudTrail. The command returns no results, but the engineer knows that a key pair was created during that time. What is the most likely reason for the missing events?

Accepted Answer

The command was run in a different region than where the key pair was created.. Option C is correct because CloudTrail events are delivered within about 15 minutes of the API call. The command looks for events in the past, so delivery time is not an issue. However, the most common reason for missing events is that the command is run in a different region than where the event occurred, or the trail is not logging management events. Option A is wrong because CloudTrail logs management events by default. Option B is wrong because key pair creation is a management event. Option D is wrong because events are delivered quickly.

Answer

CreateKeyPair is a data event and not recorded by CloudTrail.

Answer

CloudTrail events are only available after 24 hours.

Answer

CloudTrail is not enabled for management events.

Question 8

A company wants to detect and alert on SSH brute force attacks on EC2 instances. Which AWS service should be used?

Accepted Answer

Amazon GuardDuty. Option B is correct because GuardDuty can analyze VPC Flow Logs and DNS logs to detect brute force attempts. Option A is wrong because CloudTrail does not monitor network traffic. Option C is wrong because Inspector is for vulnerability scanning. Option D is wrong because Config is for configuration compliance. Option E is wrong because Shield is for DDoS protection.

Answer

AWS Config

Answer

Amazon Inspector

Answer

AWS CloudTrail

Answer

AWS Shield

Question 9

A security engineer needs to monitor for unauthorized changes to security group rules in an AWS account. The engineer wants to receive real-time notifications when a security group rule is added, modified, or removed. Which AWS service should the engineer use to capture these API calls?

Accepted Answer

AWS CloudTrail. Option B is correct because CloudTrail records API calls, including EC2 AuthorizeSecurityGroupIngress, etc. Option A is wrong because VPC Flow Logs capture network traffic, not API calls. Option C is wrong because Config records resource state changes but not real-time API calls. Option D is wrong because GuardDuty detects threats, not API logging.

Answer

Amazon GuardDuty

Answer

VPC Flow Logs

Answer

AWS Config

Question 10

A security engineer is implementing centralized logging across multiple AWS accounts. Which TWO actions should the engineer take to ensure logs are securely stored and immutable? (Choose TWO.)

Accepted Answer

Use AWS KMS with a customer managed key for encryption. Option A is correct because enabling S3 Object Lock prevents log files from being deleted or overwritten. Option C is correct because using AWS KMS with a customer managed key provides encryption and fine-grained access control. Option B is wrong because CloudTrail log file validation ensures integrity but does not prevent deletion. Option D is wrong because S3 Transfer Acceleration is for speed, not security. Option E is wrong because MFA Delete requires additional authentication but does not provide immutability; Object Lock is more appropriate.

Answer

Enable S3 Transfer Acceleration on the bucket

Answer

Enable CloudTrail log file validation

Answer

Enable MFA Delete on the bucket

Question 11

A company has enabled AWS Config to record resource changes. The security team needs to be notified when a security group is modified to allow inbound SSH from 0.0.0.0/0. Which AWS service should be used to evaluate the Config rules and trigger notifications?

Accepted Answer

AWS Config with a custom rule that triggers an SNS notification. Option B is correct because AWS Config rules evaluate resource configurations and can trigger SNS notifications. Option A is wrong because CloudTrail logs API calls but does not evaluate rules. Option C is wrong because Lambda can be used as a remediation action but not the trigger itself. Option D is wrong because GuardDuty is for threat detection. Option E is wrong because Security Hub centralizes findings but does not directly evaluate Config rules.

Answer

AWS Lambda

Answer

AWS Security Hub

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Question 12

A security engineer needs to ensure that all changes to IAM policies in an AWS account are logged and that the logs are immutable and cannot be deleted by any user, including the root user. Which actions should the engineer take? (Choose two.)

Accepted Answer

Enable AWS CloudTrail to log IAM events.. Correct options: A (CloudTrail) and D (S3 Object Lock). CloudTrail logs IAM policy changes. S3 Object Lock prevents log deletion. Option B is wrong because MFA does not prevent deletion. Option C is wrong because S3 versioning alone does not prevent deletion. Option E is wrong because KMS encryption does not prevent deletion.

Answer

Enable default encryption with AWS KMS on the bucket.

Answer

Enable S3 Versioning on the bucket.

Answer

Enable multi-factor authentication (MFA) delete on the S3 bucket.

Question 13

Refer to the exhibit. An IAM policy is attached to an IAM user. The user reports that they can upload objects to the S3 bucket but cannot list the contents of the bucket. Which statement explains this behavior?

Accepted Answer

The policy does not include the s3:ListBucket action.. Option A is correct because the policy only grants s3:PutObject and s3:GetObject actions, but does not grant s3:ListBucket. The ListBucket action is required to list objects in the bucket. Option B is wrong because the policy allows PutObject and GetObject, not Deny. Option C is wrong because the policy does not include s3:ListBucket. Option D is wrong because the policy does not explicitly deny ListBucket; it just does not allow it.

Answer

The policy includes s3:ListBucket but is missing the bucket ARN.

Answer

The policy denies the s3:ListBucket action.

Answer

The policy explicitly denies s3:ListBucket.

Question 14

A security engineer needs to monitor AWS API calls for potential unauthorized access. The engineer wants to be alerted when a specific IAM user performs a high-risk action like deleting a CloudTrail trail. What is the MOST efficient way to achieve this?

Accepted Answer

Create a CloudWatch Events rule that matches the API call and sends an SNS notification.. Option A is correct because CloudWatch Events can filter for specific API calls and trigger an SNS notification. Option B is wrong because CloudTrail does not have built-in alerting. Option C is wrong because Athena is for querying logs, not real-time alerting. Option D is wrong because GuardDuty does not monitor for specific API calls by a user. Option E is wrong because VPC Flow Logs are for network traffic.

Answer

Configure CloudTrail to send logs to CloudWatch Logs and create a metric filter with an alarm.

Answer

Enable VPC Flow Logs and analyze with Elasticsearch.

Answer

Use Amazon Athena to query CloudTrail logs daily for the action.

Answer

Enable Amazon GuardDuty with a custom threat list.

Question 15

A security engineer is configuring an Amazon S3 bucket to store CloudTrail logs. The engineer must ensure that the logs are encrypted at rest using an AWS KMS customer managed key (CMK) and that only the CloudTrail service has permission to decrypt the logs. Which bucket policy statement should the engineer add?

Accepted Answer

{"Effect":"Allow","Principal":{"Service":"cloudtrail.amazonaws.com"},"Action":"kms:Decrypt","Resource":"*"}. Option A is correct because it grants the CloudTrail service principal the necessary decrypt permission. Option B is wrong because the root user is not the CloudTrail service. Option C is wrong because it grants decrypt to all principals, which is too permissive. Option D is wrong because the CMK key policy, not bucket policy, controls KMS permissions.

Answer

{"Effect":"Allow","Principal":{"Service":"cloudtrail.amazonaws.com"},"Action":"kms:Encrypt","Resource":"*"}

Answer

{"Effect":"Allow","Principal":"*","Action":"kms:Decrypt","Resource":"*"}

Answer

{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:root"},"Action":"kms:Decrypt","Resource":"*"}

SCS-C02 Practice Test 25 — 15 Questions

Exhibit

SCS-C02 Practice Test 25 — 15 Questions

Exhibit