SCS-C02 Practice Test 4 — 25 Questions

Question 1

A company uses AWS CloudTrail to log all API activity and delivers logs to an S3 bucket with server-side encryption (SSE-S3). The security team needs to ensure that only authorized personnel can access the logs and that any unauthorized access attempts are logged and alerted. Additionally, the team wants to prevent the logs from being deleted for at least one year. Which combination of actions should be taken?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable S3 Object Lock with a retention period of one year; enable S3 server access logs; use a bucket policy with a condition that allows access only from authorized IAM roles or users.. S3 Object Lock with a retention period of one year enforces a write-once-read-many (WORM) model, preventing any deletion or overwrite of log objects for that duration. S3 server access logs capture detailed records of all requests made to the bucket, including unauthorized access attempts, which can be used for alerting. The bucket policy with a condition restricting access to authorized IAM roles or users ensures that only permitted principals can access the logs, meeting the security team's requirements for access control, logging of unauthorized attempts, and deletion prevention.

Answer

Enable S3 default encryption (SSE-S3) on the bucket; enable S3 server access logs; attach an IAM policy that allows only authorized users to access the bucket.

Answer

Enable MFA Delete on the bucket; enable CloudTrail log file validation; use bucket ACLs to restrict access.

Answer

Enable S3 Inventory to track objects; enable CloudTrail to log S3 API calls; use a bucket policy with a deny effect for unauthorized users.

Question 2

A company's security team needs to implement a solution to detect and alert on the creation of IAM users or roles with administrative privileges. The solution must be able to analyze historical account activity and provide real-time alerts. Which combination of AWS services should be used?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Logs with metric filters and alarms. AWS CloudTrail logs IAM CreateUser, CreateRole, and AttachRolePolicy events. Amazon CloudWatch Logs can use metric filters to capture these events and trigger CloudWatch Alarms for real-time alerts. CloudTrail also stores historical logs for analysis. Option A is the correct combination. Option B (GuardDuty and Lambda) is focused on threat detection, not specific IAM administrative privilege creation events. Option C (Trusted Advisor and SES) provides best-practice recommendations and email notifications, not real-time API monitoring. Option D (AWS Config and SNS) evaluates resource configuration compliance but does not monitor API calls in real time.

Answer

Amazon GuardDuty and AWS Lambda

Answer

AWS Trusted Advisor and Amazon SES

Answer

AWS Config with managed rules and Amazon SNS

Question 3

A security team needs to detect unauthorized attempts to access an S3 bucket that contains sensitive data. Which AWS service can automatically analyze S3 access logs and generate findings for suspicious activity?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior across AWS accounts and workloads. It can analyze VPC Flow Logs, AWS CloudTrail event logs, and DNS logs, and when S3 access logging is enabled, GuardDuty can ingest those logs to detect suspicious S3 access patterns, such as anomalous data exfiltration or access from unusual geographies. GuardDuty then generates security findings that can be automated for remediation.

Answer

Amazon Macie

Answer

AWS Trusted Advisor

Answer

Amazon Detective

Question 4

A security engineer is designing a monitoring solution for an AWS Lambda function that processes sensitive data. The function occasionally fails due to timeouts. The engineer needs to be alerted immediately when the function fails and also wants to analyze the error logs. Which combination of services should the engineer use?

Accepted Answer

Amazon CloudWatch Logs and CloudWatch Alarms with Amazon SNS. Amazon CloudWatch Logs captures the Lambda function's execution logs, including timeout errors, and CloudWatch Alarms can monitor specific metrics like `Errors` or `Throttles` for the function. When the alarm state is triggered (e.g., `ALARM`), it publishes a notification to an Amazon SNS topic, which can send immediate alerts via email, SMS, or other endpoints. This combination provides both real-time alerting and log analysis for troubleshooting.

Answer

Amazon CloudWatch Logs and Amazon Kinesis Data Firehose

Answer

AWS CloudTrail and Amazon SNS

Answer

AWS Config and Amazon SNS

Question 5

Refer to the exhibit. A security engineer finds this CloudTrail log entry. What is the most significant security concern indicated by this event?

Accepted Answer

The security group rule allows SSH access from any IP address (0.0.0.0/0).. The CloudTrail log entry shows an `AuthorizeSecurityGroupIngress` API call that adds a rule allowing SSH (port 22) from 0.0.0.0/0. This is a critical security concern because it exposes the EC2 instance to SSH access from any IP address on the internet, creating a high risk of brute-force attacks, unauthorized access, and potential compromise. Security best practices mandate restricting SSH access to specific trusted IP ranges, not the entire internet.

Answer

The event is a normal administrative action and poses no security concern.

Answer

The user did not have MFA enabled when assuming the AdminRole.

Answer

The source IP address (203.0.113.5) is from an unusual location.

Question 6

Refer to the exhibit. An AWS Config rule 's3-bucket-ssl-requests-only' evaluates whether S3 buckets deny HTTP requests. The exhibit shows the evaluation result and the bucket policy. Why is the bucket marked as NON_COMPLIANT despite having a Deny policy for HTTP requests?

Accepted Answer

The bucket policy is missing the 'aws:SecureTransport': 'false' condition for the bucket resource (without /*).. The Config rule likely evaluates the bucket-level policy. The current policy only denies HTTP requests to objects (/*), not to the bucket itself. To be compliant, the bucket must also have a Deny for the bucket resource ARN without the /*.

Answer

The policy uses 'Deny' but the rule expects an 'Allow' statement for HTTPS only.

Answer

The bucket policy only denies HTTP requests to objects, not to the bucket itself.

Answer

The annotation says 'Bucket does not have a policy that denies HTTP requests.' but the policy does have one, so this is a false positive.

Question 7

A security team wants to detect and alert on potential security threats such as compromised instances or malicious activity within their AWS environment. Which TWO AWS services should be used together to provide comprehensive threat detection?

Accepted Answer

AWS Security Hub. Amazon GuardDuty (Option E) is a threat detection service that continuously monitors for malicious activity and unauthorized behavior using machine learning, anomaly detection, and integrated threat intelligence feeds. AWS Security Hub (Option A) aggregates findings from GuardDuty and other services, applies automated compliance checks, and enables centralized alerting and response. Together, they provide comprehensive threat detection by combining GuardDuty's raw threat detection with Security Hub's aggregation and orchestration capabilities.

Answer

AWS CloudTrail

Answer

Amazon Inspector

Answer

AWS Config

Question 8

A company runs a multi-account AWS environment using AWS Organizations. The security team needs to implement centralized logging for all AWS CloudTrail events across all accounts. They create a new trail in the management account with the following configuration: trail name 'central-trail', apply to all accounts in the organization, enable data events for all S3 buckets, and store logs in a centralized S3 bucket. After one week, they notice that some accounts are not delivering CloudTrail logs to the central bucket. The security engineer verifies that the trail is still configured to apply to all accounts and that the S3 bucket policy allows cross-account access. What is the MOST likely reason for the missing logs?

Accepted Answer

Some accounts were added to the organization after the trail was created, and the trail was not updated to include them. When a trail is created in the management account with 'apply to all accounts in the organization', it automatically includes all current member accounts. However, if new accounts are added to the AWS Organization after the trail is created, the trail does not automatically extend to those new accounts. The trail must be updated (e.g., via the CloudTrail console or API) to include the newly added accounts, or the organization trail feature must be re-enabled. This is why logs from accounts added after trail creation are missing.

Answer

The member accounts have not enabled CloudTrail Insights

Answer

The S3 bucket policy does not grant the correct permissions to the member accounts

Answer

The trail is not configured as a multi-region trail

Question 9

A startup is building a web application on AWS and needs to protect sensitive customer data at rest in an Amazon RDS for MySQL database. The compliance team requires that the encryption keys be managed by the company's on-premises hardware security module (HSM) and be rotated every 6 months. Which solution should the startup use?

Accepted Answer

Use AWS CloudHSM to store the encryption keys and enable RDS encryption with CloudHSM.. AWS CloudHSM provides a dedicated hardware security module (HSM) that allows you to manage encryption keys on-premises-style, meeting the requirement for key management on the company's own HSM. When you enable Amazon RDS for MySQL encryption with CloudHSM, the database encryption keys are stored and managed in the CloudHSM cluster, and you can rotate them every 6 months as required. This solution directly satisfies the compliance team's mandate for on-premises HSM key management and periodic rotation.

Answer

Use AWS KMS with a customer master key (CMK) and import key material from the on-premises HSM.

Answer

Store the encryption keys in AWS Secrets Manager and use them to encrypt the database.

Answer

Use AWS KMS with a custom key store backed by AWS CloudHSM.

Question 10

A company needs to protect data at rest in Amazon S3. Which THREE server-side encryption mechanisms can be used to encrypt objects stored in S3?

Accepted Answer

Server-Side Encryption with S3-Managed Keys (SSE-S3). Server-Side Encryption with S3-Managed Keys (SSE-S3), Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS), and Server-Side Encryption with Customer-Provided Keys (SSE-C) are the three server-side encryption mechanisms for Amazon S3. Client-side encryption (option C) encrypts data before upload and is also a valid method to protect data at rest, but it is not a server-side mechanism. Option D (SSE-IAM) is not a real feature. Thus, the correct choices are A, B, and E.

Answer

Client-Side Encryption

Answer

Server-Side Encryption with IAM-Managed Keys (SSE-IAM)

Question 11

A company has a critical application that stores sensitive data in Amazon DynamoDB. The security team requires that all data stored in DynamoDB is encrypted at rest using a customer-managed KMS key. Additionally, they want to ensure that the key can be rotated automatically every year. Which combination of actions should be taken?

Accepted Answer

Use a customer-managed KMS key and enable automatic key rotation. DynamoDB supports encryption at rest with a customer-managed KMS key, and KMS supports automatic annual rotation for customer-managed keys. Option A is wrong because DynamoDB does not use CloudHSM. Option C is wrong because automatic rotation is not available for AWS managed keys (which DynamoDB uses by default). Option D is wrong because you cannot enable encryption on a table created without encryption except by recreating it.

Answer

Use a CloudHSM key store and enable automatic rotation

Answer

Use an AWS managed KMS key and enable automatic key rotation

Answer

Enable encryption on the existing DynamoDB table and use a customer-managed KMS key

Question 12

A large enterprise uses AWS Organizations to manage multiple accounts. The security team has implemented a Service Control Policy (SCP) at the root level that denies all actions unless the request originates from the corporate IP range (10.0.0.0/8). Recently, a developer in a member account tried to launch an EC2 instance from the AWS Management Console while connected via a VPN that provides an IP address within the corporate range. However, the launch failed with an 'AccessDenied' error. The developer is using an IAM user with full EC2 permissions (ec2:*). The SCP is as follows: {"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"*","Resource":"*","Condition":{"NotIpAddress":{"aws:SourceIp":"10.0.0.0/8"}}}]}. What is the MOST likely reason for the failure?

Accepted Answer

The aws:SourceIp condition key does not work correctly for requests made via the AWS Management Console because the console may use a different IP.. The SCP uses the aws:SourceIp condition, but when accessing the Management Console, the IP address seen by AWS is the console's IP, which may not be the same as the developer's VPN IP if the console uses a proxy or if the VPN is configured incorrectly. Option A is wrong because SCPs affect all principals, including the root user. Option B is wrong because the SCP denies actions, not allows them; an explicit deny overrides allows. Option D is wrong because the SCP denies all actions, so even if the developer has permissions, the SCP denies them.

Answer

The SCP allows actions only from the specified IP range, but the developer's IP is not in that range.

Answer

The SCP does not apply to IAM users in member accounts; it only applies to the root user.

Answer

The IAM user does not have the necessary permissions because the SCP explicitly denies all actions.

Question 13

Which THREE actions should be taken when preserving forensic evidence from an EC2 instance during an incident? (Select THREE.)

Accepted Answer

Create an EBS snapshot of all volumes.. Creating an EBS snapshot preserves the exact state of the volume at the time of the incident, including any malicious files, logs, or artifacts. This snapshot can be used for offline forensic analysis without altering the original evidence. AWS recommends this as a first step in forensic acquisition to maintain chain of custody.

Answer

Reboot the instance to clear any malicious processes.

Answer

Terminate the instance to prevent further compromise.

Question 14

A security engineer applies the bucket policy shown in the exhibit to an S3 bucket. What is the effect of this policy?

Accepted Answer

Allows uploads only if they use SSE-KMS.. The bucket policy includes a Deny statement that restricts uploads based on encryption headers. Specifically, it denies requests where the x-amz-server-side-encryption header is not set to 'aws:kms' or where the x-amz-server-side-encryption-aws-kms-key-id is missing. This effectively allows only uploads that use SSE-KMS. Therefore, Option D is correct.

Answer

Allows uploads only if they use SSE-S3.

Answer

Allows uploads without encryption.

Answer

Allows uploads with any server-side encryption.

Question 15

A security engineer notices that an IAM role used by an EC2 instance is generating a large number of API calls to an S3 bucket that is not part of the company's account. Which AWS service should be used to detect and alert on this suspicious activity?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is the correct service because it uses machine learning and anomaly detection to analyze AWS CloudTrail management and data events, VPC Flow Logs, and DNS logs. It can detect unusual API calls, such as an EC2 instance role making a high volume of requests to an S3 bucket outside the company's account, which is a classic indicator of compromised credentials or data exfiltration. GuardDuty generates findings and can integrate with Amazon CloudWatch Events to trigger alerts or automated remediation.

Answer

AWS CloudTrail

Answer

Amazon Inspector

Answer

AWS Config

Question 16

A company uses AWS Organizations with multiple accounts. The security team wants to centralize security logs (CloudTrail, VPC Flow Logs, AWS Config) from all accounts into a single S3 bucket for analysis. What is the MOST secure way to set up this centralized logging?

Accepted Answer

Create a dedicated S3 bucket in the security account with a bucket policy that grants write access to the logging services of all accounts and enforces encryption in transit and at rest.. It uses a dedicated S3 bucket in a security account (not the management account) with a bucket policy that explicitly grants write access to the logging services (CloudTrail, VPC Flow Logs, AWS Config) from all accounts, while enforcing encryption in transit (aws:SecureTransport) and at rest (default SSE-S3 or SSE-KMS). This follows the security best practice of isolating logs in a separate account and using resource-based policies to restrict access, preventing accidental deletion or modification by other accounts.

Answer

Create a dedicated S3 bucket in the management account, enable S3 default encryption, and configure service delivery for each account.

Answer

Configure each account to deliver logs to the same S3 bucket used for other data.

Answer

Create an S3 bucket in each account and use S3 replication to copy logs to a central bucket.

Question 17

A company has a multi-account AWS environment using AWS Organizations. The security team wants to centralize all CloudTrail logs from all accounts into a single S3 bucket in the management account. The bucket policy allows cross-account access. However, logs from member accounts are not being delivered. What is the most likely cause?

Accepted Answer

The S3 bucket policy does not grant `s3:PutObject` permission to the member accounts.. The S3 bucket policy must explicitly grant the `s3:PutObject` permission to the IAM roles or users from the member accounts that CloudTrail uses to deliver logs. Without this permission, CloudTrail in the member accounts cannot write log files to the central bucket, even if the bucket is configured for cross-account access. The bucket policy must also include a condition that the object ownership is set to the bucket owner (via `s3:x-amz-acl: bucket-owner-full-control`) to ensure the management account retains control.

Answer

CloudTrail cannot deliver logs to a bucket in a different account.

Answer

The S3 bucket is not configured with a CloudTrail prefix.

Answer

CloudTrail is not enabled in the member accounts.

Question 18

A company uses Amazon GuardDuty and receives a finding of type 'Backdoor:EC2/C&CActivity.B!DNS' for an EC2 instance. What does this finding indicate?

Accepted Answer

The instance is communicating with a known command and control server.. The finding 'Backdoor:EC2/C&CActivity.B!DNS' indicates that GuardDuty has detected DNS queries from the EC2 instance to a domain associated with known command and control (C&C) infrastructure. This is based on GuardDuty's threat intelligence feeds that map DNS request patterns to known malicious domains, signaling that the instance may be compromised and communicating with an attacker's server.

Answer

The instance is being targeted by an SSH brute force attack.

Answer

The instance is exfiltrating data to an S3 bucket.

Answer

The instance is being used in a DDoS attack.

Question 19

Refer to the exhibit. A security engineer is troubleshooting why an IAM user (Alice) cannot encrypt data using a KMS key. Alice has full S3 and KMS permissions via an IAM policy. The key policy is shown. Which statement explains the issue?

Accepted Answer

The key policy does not allow the IAM user to use the key for any action. The key policy does not grant Alice any permissions, and it does not enable IAM policies to allow access (no statement allowing root account to delegate via IAM). Since KMS requires explicit key policy authorization unless the key policy enables IAM policies, Alice cannot encrypt data even with full IAM permissions. Option D correctly identifies this. Option A is wrong because the key policy does not need a separate statement to allow IAM policies unless it explicitly enables IAM policy delegation. Option B is wrong because Alice has kms:Encrypt via IAM policy, but the key policy is restrictive. Option C is wrong because the root account is included (the Root principal).

Answer

The key policy is missing a statement to allow the IAM user to use the key via IAM policies

Answer

The IAM user does not have the kms:Encrypt permission in their IAM policy

Answer

The key policy does not include the root account principal

Question 20

A security engineer is investigating a potential breach. The engineer notices that an EC2 instance's security group allows inbound SSH (port 22) from 0.0.0.0/0. The instance is in a public subnet and has a public IP address. However, the engineer finds that SSH access is only possible from a specific IP address. What is the most likely explanation?

Accepted Answer

The network ACL denies inbound SSH from all IPs except the specific IP. A network ACL (NACL) can override security group rules if it denies inbound traffic. Option A is wrong because if the NACL allowed SSH from anywhere, then the restriction to a specific IP would not occur. Option B is wrong because if the NACL allowed traffic, it wouldn't explain the restriction. Option C is wrong because security group rules are evaluated; the rule allowing all traffic would still apply.

Answer

The network ACL allows inbound SSH from 0.0.0.0/0

Answer

The security group rule is being overridden by a more restrictive security group attached to the same instance

Answer

The security group rule is being evaluated but the instance's operating system firewall is blocking SSH