SCS-C02 Practice Test 2 — 25 Questions

Question 1

Refer to the exhibit. A security engineer is investigating a potential unauthorized VPC creation. What does the evidence suggest?

Accepted Answer

The user admin created two VPCs, but one was deleted shortly after creation.. The CloudTrail log shows two CreateVpc events by user admin. One VPC exists (vpc-12345678), but the other (vpc-87654321) does not exist, indicating that it was deleted after creation. This could indicate malicious activity where a VPC was created and then deleted to cover tracks.

Answer

The CloudTrail log is incomplete; both VPCs exist.

Answer

Both VPCs were created successfully and still exist.

Answer

The user admin only created one VPC; the second event is a duplicate.

Question 2

A security engineer needs to audit all API calls made in an AWS account for the past 90 days. Which AWS service should the engineer use?

Accepted Answer

AWS CloudTrail. AWS CloudTrail (Option B) is the correct service for auditing all API calls made in an AWS account over the past 90 days. It records API activity and can be configured to store logs for 90 days in the management event history. Option A (Amazon S3 access logs) logs access to S3 objects, not API calls. Option C (AWS Config) tracks resource configuration changes, not API calls. Option D (Amazon CloudWatch Logs) is for monitoring, storing, and accessing log files from various sources, but it is not specifically designed for auditing API calls; CloudTrail is the primary service for that purpose.

Answer

Amazon S3 access logs

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 3

A security engineer is reviewing AWS CloudTrail logs and notices a large number of `DescribeInstances` API calls from a single IAM user in a short period. The engineer suspects a credential compromise. What is the most effective way to automatically revoke the compromised credentials and notify the security team?

Accepted Answer

Create an Amazon EventBridge rule that triggers an AWS Lambda function to revoke the keys and send an SNS notification.. It uses Amazon EventBridge to detect the anomalous DescribeInstances API calls (via CloudTrail as an event source), then triggers an AWS Lambda function to programmatically revoke the IAM user's access keys (using the `deactivate_access_key` or `delete_access_key` API), and sends an SNS notification to the security team. This provides an automated, near-real-time response to a suspected credential compromise without manual intervention.

Answer

Use AWS CloudTrail to automatically disable the IAM user's access keys.

Answer

Create an AWS Config rule that checks for excessive API calls and revokes keys.

Answer

Enable Amazon GuardDuty to automatically revoke compromised credentials.

Question 4

A security engineer is investigating a potential incident where an EC2 instance was compromised. The engineer has access to the following logs: CloudTrail, VPC Flow Logs, and OS-level logs from the instance. Which TWO log sources would be MOST useful to determine the initial attack vector? (Choose TWO.)

Accepted Answer

OS-level authentication and system logs. OS-level authentication and system logs (option B) are critical because they record local login attempts, sudo commands, and process executions that can reveal how an attacker gained initial access—such as via SSH brute force, a compromised user account, or a vulnerable service. CloudTrail logs (option C) are equally important because they capture API calls made to AWS services, including RunInstances, CreateKeyPair, and ModifySecurityGroup, which can show if the attacker launched the instance from a compromised AWS account or modified security groups to allow inbound traffic. Together, these two sources provide the evidence needed to trace the initial compromise vector, whether it originated from within the OS or through AWS API manipulation.

Answer

Amazon CloudWatch Metrics for the instance

Answer

AWS Config configuration history

Answer

VPC Flow Logs

Question 5

Refer to the exhibit. An IAM policy is attached to a group. A user in the group accesses the S3 bucket from an IP address 203.0.113.5 using HTTPS. What will be the result?

Accepted Answer

The user will be denied access because the source IP is not in the allowed ranges.. The IAM policy includes a condition that restricts access to only the IP ranges 192.0.2.0/24 and 198.51.100.0/24. The user's IP address 203.0.113.5 does not fall within these ranges, so access is denied. Option B is incorrect because an Allow with conditions does not grant access by default; all conditions must be satisfied. Option C is incorrect because the policy does explicitly allow the s3:GetObject action, but only under the specified conditions. Option D is incorrect because while SecureTransport is satisfied, the IP condition is not met, and all conditions must be true for the Allow to take effect.

Answer

The user can access objects because an Allow with conditions grants access by default.

Answer

The user will be denied access because the policy does not allow the action explicitly.

Answer

The user can access objects because the condition for SecureTransport is met.

Question 6

A company uses AWS Organizations with multiple accounts. The security team wants to detect and automatically respond to suspicious API calls across all accounts. Which solution is the MOST efficient and scalable?

Accepted Answer

Enable AWS CloudTrail organization trail and use Amazon EventBridge to invoke automated responses. Enabling an AWS CloudTrail organization trail centrally logs all API calls from every account in the AWS Organization into a single Amazon S3 bucket and CloudWatch Logs log group. Amazon EventBridge can then be used to create event rules that match specific suspicious API calls (e.g., IAM DeleteRolePolicy) and automatically invoke target actions like AWS Lambda functions or AWS Systems Manager Automation, providing a scalable, centralized, and efficient detection and response mechanism without per-account management overhead.

Answer

Use AWS Config rules to detect API calls and trigger Lambda functions

Answer

Deploy Amazon GuardDuty and use its automated response feature

Answer

Create a CloudTrail trail in each account and aggregate logs via cross-account S3 bucket

Question 7

Which TWO AWS services can be used to centrally manage and audit permissions across multiple AWS accounts? (Choose two.)

Accepted Answer

AWS Organizations. AWS Organizations provides a central view of all accounts and can apply SCPs. IAM Access Analyzer analyzes resource policies across accounts to identify public or cross-account access. AWS Config evaluates resource configurations but does not centrally manage permissions. AWS CloudTrail logs API calls but does not manage permissions. AWS SSO manages user access but not resource permissions.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

AWS Single Sign-On

Question 8

A security engineer runs the above CloudTrail lookup command to investigate a change to the S3 bucket policy. The command only returns one event, but the engineer knows that the bucket policy was changed multiple times. What is the most likely reason?

Accepted Answer

The command is limiting results to one event.. The command uses --max-results 1, limiting output to one event. Option A is wrong because changes through the AWS Management Console are logged by CloudTrail. Option B is wrong because PutBucketPolicy is supported by CloudTrail and the event shown confirms it. Option C is wrong because filtering by ResourceName is not the issue; the --max-results parameter is the cause.

Answer

The bucket policy changes were made through the AWS Management Console, which is not logged.

Answer

The event is not logged because PutBucketPolicy is not supported by CloudTrail.

Answer

The command is filtering by the wrong attribute.

Question 9

A company is using AWS KMS to encrypt S3 objects. The security team wants to ensure that only a specific IAM role can decrypt objects in a particular S3 bucket. Which KMS key policy configuration should be used?

Accepted Answer

Add a condition that allows decrypt only when kms:ViaService is s3.amazonaws.com and the caller role matches the specific role ARN.. A KMS key policy with a condition restricting kms:Decrypt to the specific IAM role ARN and kms:ViaService set to s3.amazonaws.com ensures only that role, acting through S3, can decrypt objects. This is the authoritative control because KMS key policies govern all access to the CMK, and the ViaService condition prevents the role from using the key directly outside S3.

Answer

Use an S3 bucket policy that denies decrypt for all principals except the specific IAM user.

Answer

Configure the IAM role with a policy that allows kms:Decrypt for the specific KMS key.

Answer

Attach a resource-based policy to the S3 bucket that grants decrypt permission to the IAM role.

Question 10

A company uses AWS Organizations with all features enabled. The security team needs to ensure that no member account can disable AWS CloudTrail logging or delete CloudTrail logs stored in S3. Which combination of preventive controls should be implemented?

Accepted Answer

Apply a service control policy (SCP) at the root OU to deny CloudTrail and S3 delete actions, and enable CloudTrail organizational trail.. The most effective preventive controls are applying a Service Control Policy (SCP) at the root OU to deny CloudTrail stop/delete and S3 delete actions, combined with enabling an organizational trail in CloudTrail. SCPs enforce guardrails across all member accounts, preventing even account administrators from disabling logging or deleting logs, while the organizational trail ensures centralized logging to a protected S3 bucket.

Answer

Set up CloudWatch alarms to notify when CloudTrail is modified or logs are deleted.

Answer

Use IAM policies in each member account to deny CloudTrail and S3 delete actions.

Answer

Apply an S3 bucket policy denying delete actions, and enable CloudTrail organizational trail.

Question 11

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that no resources can be created in a specific AWS Region except for the us-east-1 Region. Which policy type should the security team use?

Accepted Answer

Service control policy (SCP). Service control policies (SCPs) are the correct choice because they allow you to centrally control the maximum available permissions for all accounts in an AWS Organization. By applying an SCP that denies all actions in a specific region (except us-east-1), the security team can enforce a region restriction across all member accounts, regardless of any IAM policies attached to users or roles. SCPs do not grant permissions themselves but act as a guardrail that limits what IAM policies can allow.

Answer

IAM permissions boundary

Answer

IAM policy applied to the root user

Answer

Resource-based policy

Question 12

A company has an EC2 instance that needs to access an S3 bucket. The security team wants to use the principle of least privilege. Which method should be used to grant access?

Accepted Answer

Create an IAM role with an S3 access policy and attach it to the EC2 instance profile.. It follows the principle of least privilege by using an IAM role with a scoped S3 access policy, which is then attached to the EC2 instance profile. This allows the EC2 instance to obtain temporary security credentials from the AWS STS service, avoiding long-term access keys and ensuring permissions are granted only as needed.

Answer

Use a security group to allow outbound traffic to S3.

Answer

Store AWS access keys on the instance and use them in the application.

Answer

Create a bucket policy that grants access to the EC2 instance ID.

Question 13

A security engineer is investigating a potential security incident and needs to determine if an EC2 instance was launched with a specific AMI ID. Which AWS log should be examined?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records all API calls made within an AWS account, including the RunInstances API call that launches an EC2 instance. The CloudTrail event for RunInstances contains the AMI ID in the request parameters, allowing you to determine if a specific AMI was used. This makes CloudTrail the correct log to examine for this investigation.

Answer

AWS Config timeline

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs (EC2 agent logs)

Question 14

A security engineer notices that an S3 bucket containing sensitive logs is publicly accessible. Which service should be used to automatically remediate this by applying a bucket policy?

Accepted Answer

AWS Config. AWS Config is the correct service because it can continuously monitor S3 bucket configurations and automatically remediate non-compliant resources using AWS Config Rules and AWS Systems Manager Automation documents. When a rule detects that an S3 bucket is publicly accessible, it can trigger an automatic remediation action, such as applying a bucket policy that denies all public access, without manual intervention.

Answer

Amazon GuardDuty

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Question 15

A company wants to ensure that all API calls made to their AWS account are logged and immutable. They have enabled AWS CloudTrail and are delivering logs to an S3 bucket. The security team requires that logs cannot be deleted or modified by anyone, including the root user. What should they do?

Accepted Answer

Enable S3 Object Lock with Compliance retention mode on the bucket.. S3 Object Lock in Compliance mode prevents any principal — including the root user and AWS itself — from deleting or overwriting an object version until its retention period expires. This is the only option that provides true WORM (write once, read many) immutability for CloudTrail logs. It satisfies the requirement that logs cannot be deleted or modified by anyone, including root.

Answer

Enable MFA Delete on the S3 bucket.

Answer

Enable S3 Versioning on the bucket.

Answer

Add a bucket policy that denies s3:DeleteObject for all principals.

Question 16

Refer to the exhibit. A security engineer reviews this CloudFormation template. The bucket is intended to be private. What is the security issue in the configuration?

Accepted Answer

The PublicAccessBlock configuration is missing the BlockPublicPolicy setting.. The PublicAccessBlock configuration in the template is missing the BlockPublicPolicy setting. Without BlockPublicPolicy enabled, a bucket policy that grants public read access (Effect: Allow, Principal: *, Action: s3:GetObject) can be applied to the bucket, overriding the intended private configuration. The other PublicAccessBlock settings (BlockPublicAcls, IgnorePublicAcls, RestrictPublicBuckets) do not block bucket policies; only BlockPublicPolicy does. The security issue is that the bucket policy, though present, would be blocked if BlockPublicPolicy were enabled, but since it is missing, the bucket becomes publicly accessible.

Answer

The bucket does not have versioning enabled.

Answer

The bucket policy grants public read access to the bucket, which overrides the PublicAccessBlock configuration.

Answer

The bucket policy uses an incorrect resource ARN.

Question 17

A security engineer is configuring a VPC for a highly sensitive application. The VPC must not have a route to the internet, but the application needs to periodically download security patches from a specific domain (patches.example.com). Which solution meets these requirements with minimal operational overhead?

Accepted Answer

Use a VPC endpoint for Amazon S3 and DynamoDB to download patches.. It uses VPC endpoints for Amazon S3 (and optionally DynamoDB) to provide private connectivity to AWS services without requiring an internet gateway. By storing the security patches in an S3 bucket with a custom domain alias (e.g., patches.example.com), the application can download patches through the VPC endpoint, meeting the requirement of no internet route and minimizing operational overhead. Options A and D require an internet gateway, which creates a route to the internet. Option C does not provide access to an external domain like patches.example.com.

Answer

Launch a proxy server in a public subnet and configure the application to use the proxy.

Answer

Create a VPC interface endpoint for AWS Systems Manager and use Systems Manager Patch Manager to apply patches.

Answer

Deploy a NAT gateway in a public subnet and add a route to the NAT gateway for the private subnet.

Question 18

A company runs a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application processes sensitive customer data. The Security team has enabled VPC Flow Logs, CloudTrail, and GuardDuty. Recently, the team received a GuardDuty finding indicating a potential SSH brute force attack originating from an external IP address 203.0.113.50 targeting one of the EC2 instances. The Security Engineer needs to automatically isolate the affected instance and capture forensic evidence for analysis. The company has strict requirements: the instance must be isolated immediately, and a snapshot of the EBS volume must be taken before any remediation actions are taken. The instance is part of an Auto Scaling group, and the Security Engineer wants to minimize manual intervention. The Security Engineer has access to AWS Systems Manager and AWS Lambda. Which combination of steps should the Security Engineer implement to meet the requirements?

Accepted Answer

Configure Amazon EventBridge to detect the GuardDuty finding and invoke an AWS Lambda function. The Lambda function first calls the EC2 CreateSnapshot API to capture a forensic snapshot of the instance's EBS volume. Then, it uses AWS Systems Manager Automation to run a pre-defined automation document that isolates the instance by modifying the instance's security group to only allow traffic from a trusted management IP, and then stops the instance.. It uses EventBridge to directly detect the GuardDuty finding, which triggers a Lambda function that first takes an EBS snapshot (forensic capture) via the CreateSnapshot API before any remediation. Then it uses Systems Manager Automation to isolate the instance by modifying the security group to allow only a trusted management IP and stops the instance, ensuring isolation without destroying the instance. This sequence satisfies the strict requirement that a snapshot must be taken before any remediation actions, and it minimizes manual intervention by automating the entire response.

Answer

Use AWS Systems Manager to automatically connect to the instance via EC2 Instance Connect, run commands to capture forensic data, and then modify the security group to deny all inbound traffic.

Answer

Create a CloudWatch Logs metric filter on the VPC Flow Logs for the attacker IP. When the metric breaches a threshold, trigger an SNS topic that runs an AWS Systems Manager Automation document to isolate the instance and take an EBS snapshot.

Answer

Configure a CloudWatch Events rule to detect the GuardDuty finding and invoke an AWS Lambda function. The Lambda function terminates the EC2 instance and then takes a snapshot of the EBS volume for forensic analysis.

Question 19

A company is designing a VPC with public and private subnets. The web servers in the public subnets must be accessible from the internet on port 443, but the database servers in the private subnets should only be accessible from the web servers on port 3306. Which combination of security group rules and network ACL rules should be used to meet these requirements with the least administrative overhead?

Accepted Answer

Use security groups for all tiers; add an inbound rule to the database security group allowing traffic from the web security group on port 3306.. Security groups are stateful and support referencing other security groups as a source, which allows you to permit traffic from the web security group to the database security group on port 3306 without needing to specify IP addresses. This approach minimizes administrative overhead as security group rules are automatically applied to all instances associated with the group, and changes propagate without updating network ACLs or CIDR ranges. The web security group can have an inbound rule allowing HTTPS (port 443) from the internet (0.0.0.0/0), while the database security group only allows inbound MySQL/Aurora (port 3306) from the web security group, meeting the access requirements precisely.

Answer

Use security groups for all tiers; add an inbound rule to the web security group allowing internet traffic on port 443, and add an outbound rule to the web security group allowing traffic to the database security group on port 3306.

Answer

Use security groups for the web tier and network ACLs for the database tier; add an inbound rule to the database network ACL allowing traffic from the web subnet CIDR on port 3306.

Answer

Use security groups for the web tier and network ACLs for the database tier; add an inbound rule to the database network ACL allowing all traffic from the web security group.

Question 20

A security engineer is investigating a potential data exfiltration incident. The engineer needs to determine whether an IAM user in account A accessed an S3 bucket in account B. The engineer has access to both accounts. Which combination of steps should the engineer take to identify the cross-account access?

Accepted Answer

Enable CloudTrail in account B and check the S3 event history for the bucket.. To identify cross-account access to an S3 bucket, enable CloudTrail in the account that owns the bucket (account B) and configure a trail with data events for S3 object-level operations. This captures the IAM user ARN from account A in the CloudTrail event. S3 server access logging (Option A) can also provide similar details, but CloudTrail is the recommended approach for auditing API calls. Ensure data events are enabled for the bucket.

Answer

Enable S3 server access logging on the bucket in account B and check the logs.

Answer

Enable CloudTrail in account A and check the S3 event history.

Answer

Enable CloudWatch Logs in account A and check the S3 access logs.