SCS-C02 Practice Test 3 — 25 Questions

Question 1

A Security Engineer needs to block SSH traffic (port 22) from the internet to all EC2 instances in a VPC. Which approach is the most secure and scalable?

Accepted Answer

Add a network ACL rule to deny inbound traffic on port 22 from 0.0.0.0/0 at the subnet level.. Network ACLs (NACLs) are stateless and operate at the subnet level, allowing you to explicitly deny inbound SSH traffic from 0.0.0.0/0. This approach is more secure and scalable than security group rules because NACLs can block traffic before it reaches the instance, and they support explicit deny rules, which security groups do not. Security groups only support allow rules, so you cannot add a deny rule to block SSH traffic; you must omit the allow rule, which is less explicit and can be accidentally overridden.

Answer

Add a security group rule to deny inbound traffic on port 22 from 0.0.0.0/0.

Answer

Add a network ACL rule to allow inbound traffic on port 22 from 0.0.0.0/0 and then add a deny rule for the same traffic.

Answer

Add a security group rule to block inbound traffic on port 22 from 0.0.0.0/0 at the VPC level.

Question 2

A security engineer notices that an Amazon S3 bucket has been accessed from an IP address outside the company's allowed range. The engineer needs to identify the IAM user who made the request. Which AWS service should be used to find this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to AWS services, including S3 operations, and captures the identity of the IAM user or role that made the request. By examining CloudTrail logs, the security engineer can find the specific IAM user associated with the source IP address that accessed the bucket, as CloudTrail logs include both the user identity and the source IP address for each event.

Answer

S3 server access logs

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Question 3

During an incident, a security engineer needs to isolate a compromised Amazon EC2 instance without losing the ability to capture forensic data from its EBS volumes. What is the best course of action?

Accepted Answer

Take a snapshot of the EBS volumes, then detach the instance from the Auto Scaling group and modify the security group to deny all traffic.. Taking a snapshot of the EBS volumes preserves the forensic data before any changes occur, while detaching the instance from the Auto Scaling group prevents automatic replacement, and modifying the security group to deny all traffic isolates the instance without losing the running state or the ability to capture additional volatile data. This approach balances isolation with forensic preservation, ensuring the instance remains available for further analysis if needed.

Answer

Terminate the instance immediately and take a snapshot after termination.

Answer

Stop the instance, detach the volumes, and attach them to a forensic instance.

Answer

Change the security group to restrict traffic to only the forensic team's IP addresses.

Question 4

A security engineer is configuring a new VPC with public and private subnets. The application servers in the private subnet need to download patches from the internet. Which component is required?

Accepted Answer

NAT gateway. A NAT gateway is required to allow instances in a private subnet to initiate outbound traffic to the internet (e.g., to download patches) while preventing the internet from initiating inbound connections to those instances. The NAT gateway resides in a public subnet with an attached Internet Gateway, and it translates the private IP addresses of the application servers to the NAT gateway's Elastic IP address for outbound traffic.

Answer

VPC endpoint

Answer

Direct Connect

Answer

Internet gateway

Question 5

Which TWO steps should a security engineer take when responding to a confirmed security incident involving a compromised EC2 instance? (Choose 2.)

Accepted Answer

Isolate the instance by changing its security group to deny all traffic. Isolating the compromised EC2 instance by changing its security group to deny all traffic immediately stops the attack in progress and prevents lateral movement to other resources, while preserving the instance for forensic analysis. This aligns with the AWS incident response best practice of containment before eradication, as the instance remains intact for investigation.

Answer

Reimage the instance from a clean AMI immediately

Answer

Delete all CloudTrail logs related to the instance

Answer

Immediately terminate the instance to stop the attack

Question 6

A security engineer is designing an incident response plan for a containerized application running on Amazon ECS with Fargate. The engineer needs to ensure that if a container is compromised, the incident response team can capture a memory dump and disk snapshot for forensic analysis. The containers are stateless and use ephemeral storage. Which approach provides the necessary forensic data?

Accepted Answer

Use ECS Exec to access the container and capture a memory dump; snapshot the task's ephemeral storage.. ECS Exec allows interactive access to a running container without stopping it, enabling the capture of a memory dump (e.g., via `gcore` or `/proc/kcore`). Additionally, the task's ephemeral storage can be snapshotted while the container is still running, preserving disk state for forensic analysis. This approach aligns with incident response best practices for stateless containers on Fargate, where traditional host-level forensics are unavailable.

Answer

Configure the container to stream /dev/mem to CloudWatch Logs.

Answer

Enable ECS task memory dumps to CloudWatch Logs.

Answer

Stop the task and create a new task from the same image.

Question 7

During an incident response, a security engineer needs to preserve the state of an EC2 instance for forensic analysis. The instance is running a production workload that cannot be interrupted. Which of the following actions should the engineer take FIRST to ensure data integrity?

Accepted Answer

Use AWS Systems Manager Run Command to create a memory dump and store it in S3.. During an incident response, preserving volatile data (such as memory contents) is critical before any other action that might alter the system state. AWS Systems Manager Run Command can execute a command (e.g., using `dd` or `LiME`) to capture a memory dump and store it in Amazon S3 without interrupting the production workload. This ensures that forensic artifacts like running processes, network connections, and encryption keys are preserved before any disk-level operations that could overwrite or modify evidence.

Answer

Run the dd command to clone the root volume to another EBS volume.

Answer

Create an AMI from the instance while it is running.

Answer

Take a snapshot of the attached EBS volumes while the instance is running.

Question 8

A security engineer is reviewing a CloudTrail log entry (exhibit). What is the most immediate security concern indicated by this event?

Accepted Answer

A security group rule was added allowing SSH access from any IP address.. The CloudTrail log shows an AuthorizeSecurityGroupIngress API call that added a security group rule with the CIDR 0.0.0.0/0 for port 22 (SSH). This effectively opens SSH access to the entire internet, creating a severe exposure that could allow any attacker to attempt brute-force or credential-stuffing attacks against any EC2 instance associated with that security group. This is the most immediate security concern because it directly introduces a wide-open attack surface.

Answer

The source IP address 203.0.113.5 is from a known malicious IP range.

Answer

The API call was made from the AWS CLI, which may indicate a compromised access key.

Answer

The user JohnDoe did not use multi-factor authentication (MFA) for this API call.

Question 9

A security engineer needs to detect and alert on suspicious API calls made from a compromised EC2 instance. The instance is associated with an IAM role that has permissions to call various AWS APIs. Which AWS service should the engineer use to monitor API calls and trigger alerts?

Accepted Answer

AWS CloudTrail combined with Amazon CloudWatch Events. AWS CloudTrail records all API calls made by or on behalf of the EC2 instance's IAM role. By sending these logs to Amazon CloudWatch Events (now Amazon EventBridge), you can create rules that match specific API actions (e.g., 'ec2:TerminateInstances') and trigger alerts via SNS, Lambda, or other targets. This combination provides real-time monitoring and alerting for suspicious API activity from a compromised instance.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

VPC Flow Logs

Question 10

A company uses Amazon Detective to investigate security findings. The security team is analyzing a GuardDuty finding of type 'Backdoor:EC2/C&CActivity.B!DNS' for an EC2 instance. The team wants to use Detective to understand the full scope of the incident, including which other resources the instance communicated with and any IAM roles used. However, when the team opens the finding in Detective, they see no network activity data for the instance. The instance is in a VPC with VPC Flow Logs enabled, and Flow Logs are being published to CloudWatch Logs. What should the team do to enable Detective to display the network activity?

Accepted Answer

Ensure that VPC Flow Logs are enabled for the VPC and are being published to Amazon CloudWatch Logs in the same account and Region as Detective.. Amazon Detective ingests VPC Flow Logs from CloudWatch Logs to generate network activity visualizations for EC2 instances. Even though VPC Flow Logs are enabled and published to CloudWatch Logs, Detective requires that the logs are in the same AWS account and Region as the Detective behavior graph. If the logs are in a different account or Region, Detective cannot access them, resulting in no network activity data being displayed for the instance.

Answer

Re-enable the GuardDuty finding in Amazon Detective.

Answer

Enable GuardDuty EKS Audit Logs monitoring.

Answer

Install the Amazon Detective agent on the EC2 instance.

Question 11

A company is using Amazon CloudWatch Logs to store application logs. The security team needs to retain logs for 7 years to comply with regulatory requirements. The logs are accessed infrequently after the first 90 days. What is the MOST cost-effective way to meet these retention and access requirements?

Accepted Answer

Export logs from CloudWatch Logs to an S3 bucket, then use S3 Lifecycle policies to transition logs to S3 Glacier Deep Archive after 90 days.. Exporting logs from CloudWatch Logs to Amazon S3 and using S3 Lifecycle policies to transition them to S3 Glacier Deep Archive after 90 days is the most cost-effective solution. CloudWatch Logs storage costs are higher than S3, and Glacier Deep Archive offers the lowest storage cost for infrequently accessed data that must be retained for 7 years. This approach meets the retention requirement while minimizing costs for logs that are rarely accessed after the initial 90-day period.

Answer

Stream logs to an S3 bucket using Kinesis, then use S3 Lifecycle policies to transition logs to S3 Standard-IA after 90 days.

Answer

Set a retention policy on the CloudWatch Logs log group to 7 years and use CloudWatch Logs Insights for queries.

Answer

Set a retention policy on the CloudWatch Logs log group to 7 years and use CloudWatch Logs lifecycle policies to transition to Amazon S3 Glacier.

Question 12

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The security team wants to inspect all traffic between VPCs using a third-party firewall appliance. Which architecture should be used?

Accepted Answer

Use Transit Gateway with appliance mode and route tables to direct traffic through a firewall appliance in a central VPC.. Transit Gateway with appliance mode enables the firewall appliance in a central VPC to receive traffic from all attached VPCs with symmetric routing, ensuring that both forward and return traffic flows through the same appliance. By configuring route tables to direct inter-VPC traffic to the firewall appliance's elastic network interface (ENI), the security team can inspect all traffic without requiring complex peering or on-premises backhauling.

Answer

Set up AWS Direct Connect and route all traffic through the on-premises firewall.

Answer

Create VPC peering connections between each VPC and the firewall VPC.

Answer

Configure network ACLs in each VPC to block traffic unless it comes from the firewall.

Question 13

During a security review, a security engineer notices that an S3 bucket contains sensitive data but has a bucket policy that allows access from any principal in the account. The engineer needs to identify any unintended cross-account access to this bucket. Which AWS service should be used?

Accepted Answer

AWS IAM Access Analyzer. AWS IAM Access Analyzer helps identify resources that are shared with external principals by analyzing resource-based policies (like S3 bucket policies). In this scenario, the bucket policy allows access from any principal in the account, but IAM Access Analyzer can detect if the policy also grants access to principals outside the AWS account (cross-account access). It generates findings for any policy that allows access from an external entity, making it the correct service to identify unintended cross-account access.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

Amazon Macie

Question 14

A company uses Amazon S3 to store sensitive data. The security team needs to be alerted when an S3 bucket policy is changed to allow public access. Which combination of services should be used to meet this requirement?

Accepted Answer

AWS Config with AWS Lambda and Amazon Simple Notification Service (SNS). AWS Config can monitor S3 bucket policies for changes that grant public access using a managed rule like 's3-bucket-public-read-prohibited' or a custom Lambda function. When a noncompliant change is detected, AWS Config can invoke an AWS Lambda function to evaluate the policy and publish a notification to Amazon SNS, alerting the security team. This combination provides real-time, policy-driven monitoring and alerting for public access changes.

Answer

AWS CloudTrail and Amazon Simple Notification Service (SNS)

Answer

S3 server access logs and Amazon Athena

Answer

AWS Trusted Advisor and Amazon Simple Notification Service (SNS)

Question 15

An organization uses AWS Organizations and wants to centrally manage Amazon GuardDuty across multiple accounts. What is the correct architecture?

Accepted Answer

Designate a delegated administrator account in Organizations and enable GuardDuty in that account.. AWS Organizations allows you to designate a delegated administrator account for Amazon GuardDuty, which can then centrally manage GuardDuty across all member accounts in the organization. This architecture simplifies enabling GuardDuty and managing findings without needing to configure each account individually, as the delegated administrator can enable GuardDuty for all accounts in the organization from a single point.

Answer

Enable GuardDuty only in the master account; it will automatically monitor all member accounts.

Answer

Use AWS CloudFormation StackSets to deploy GuardDuty in all accounts and regions.

Answer

Enable GuardDuty in each region separately and use cross-region aggregation.

Question 16

A security engineer is designing a VPC with public and private subnets. The private subnets will host databases that should not have direct internet access. Which three components are required to provide outbound internet access for these databases? (Choose THREE.)

Accepted Answer

An internet gateway attached to the VPC.. An internet gateway (IGW) is required to enable outbound internet access for resources in a VPC. The NAT gateway, which resides in a public subnet, uses the IGW to translate private IP addresses to the public IP of the NAT gateway, allowing instances in private subnets to initiate outbound traffic to the internet while preventing inbound connections from the internet.

Answer

AWS WAF attached to the NAT gateway.

Answer

A VPC gateway endpoint for S3.

Question 17

During an incident response, a security engineer needs to preserve the state of an EC2 instance's root volume for forensic analysis. The instance is still running. Which action should be taken to ensure the data is preserved without altering it?

Accepted Answer

Create a snapshot of the root volume.. Creating a snapshot of the root volume is the correct action because it captures a point-in-time, crash-consistent copy of the volume's data without requiring the instance to be stopped or the volume to be detached. This preserves the current state of the running instance for forensic analysis while ensuring the data is not altered by the snapshot process itself, as AWS snapshots are read-only and do not modify the source volume.

Answer

Stop the instance and then create an AMI.

Answer

Use dd if=/dev/xvda over SSH to copy the volume.

Answer

Detach the root volume and attach it to a forensics instance.

Question 18

A security engineer needs to automatically detect and respond to unauthorized API calls in an AWS account. Which two services should be used together?

Accepted Answer

AWS CloudTrail and Amazon EventBridge. CloudTrail logs API calls, and Amazon EventBridge can trigger automated responses based on those logs. Option A is correct. Option B (GuardDuty + SNS) provides threat detection alerts but not automated response. Option C (Config + Lambda) is for configuration compliance, not API call detection. Option D (Inspector + S3) is for vulnerability assessment, not API monitoring.

Answer

Amazon GuardDuty and Amazon SNS

Answer

AWS Config and AWS Lambda

Answer

Amazon Inspector and Amazon S3

Question 19

A security engineer runs the above AWS CLI command. The engineer notices that the security group has no outbound rules. What is the implication of this configuration?

Accepted Answer

The EC2 instances in this security group cannot initiate outbound connections. A security group without outbound rules will block all outbound traffic by default (since security groups are stateful and default deny egress). Option B is wrong because security groups are stateful; the inbound rule allows return traffic. Option C is wrong because the inbound rule allows HTTP from anywhere, but outbound is missing. Option D is wrong because the security group does allow inbound HTTP.

Answer

The EC2 instances cannot receive inbound HTTP traffic

Answer

The security group allows all outbound traffic by default

Answer

Outbound traffic is allowed because security groups are stateful

Question 20

A company is implementing a security monitoring solution for its AWS environment. Which TWO services can be used to detect and alert on suspicious API activity? (Choose TWO.)

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious or unauthorized behavior, including suspicious API activity. It analyzes AWS CloudTrail management and data events, VPC Flow Logs, and DNS logs to generate security findings and alerts. GuardDuty uses machine learning and anomaly detection to identify patterns such as unusual API calls, credential compromise, or reconnaissance attempts, making it a correct choice for detecting and alerting on suspicious API activity.

Answer

Amazon Inspector

Answer

AWS Config

Answer

VPC Flow Logs