SCS-C02 Practice Test 5 — 25 Questions

Question 1

A company is using AWS Organizations with multiple accounts. The security team needs to centrally monitor all root user API activity across all accounts and receive alerts within minutes. What is the MOST efficient solution?

Accepted Answer

Create an organization trail in CloudTrail that logs all accounts. Use CloudWatch Logs metric filters and alarms to detect root login events.. Option A is correct because an organization trail in AWS CloudTrail logs API activity for all accounts in AWS Organizations from a single point, eliminating the need to manage per-account trails. By sending these logs to CloudWatch Logs, you can create metric filters to detect root user login events (e.g., the 'RootLogin' event) and configure CloudWatch Alarms to trigger SNS notifications within minutes, meeting the requirement for centralized monitoring and rapid alerts.

Answer

Enable CloudTrail in each account and aggregate logs to a centralized S3 bucket. Use Athena queries to detect root activity and send alerts via SNS.

Answer

Use AWS Lambda functions in each account to poll CloudTrail logs and send root activity to a central SQS queue.

Answer

Enable AWS Config rules in each account to detect root user activity and send notifications to a central SNS topic.

Question 2

A security engineer wants to receive real-time notifications when an AWS API call is made to delete an S3 bucket. Which service should be used to capture and forward these events to an Amazon SNS topic?

Accepted Answer

AWS CloudTrail with CloudWatch Events. AWS CloudTrail captures all API calls made to S3, including DeleteBucket. By sending these CloudTrail events to Amazon CloudWatch Events (now part of Amazon EventBridge), you can create a rule that matches the specific API call and forwards it to an SNS topic for real-time notification. This combination provides the exact event-driven pipeline needed for immediate alerting on S3 bucket deletions.

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Answer

AWS Config

Question 3

A security engineer is designing a monitoring solution for a multi-account AWS environment using AWS Organizations. The solution must provide a centralized view of all API activities and send alerts for suspicious events. Which TWO services together can achieve this? (Choose TWO.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail is correct because it records all API activity across an AWS environment, and when integrated with AWS Organizations, it can deliver a centralized view of API calls from all accounts into a single CloudTrail trail. Amazon CloudWatch Logs is correct because it can ingest CloudTrail logs from a centralized logging account, allowing the security engineer to create metric filters and alarms that trigger alerts for suspicious events based on specific API patterns.

Answer

Amazon GuardDuty

Answer

AWS Lambda

Answer

AWS Config

Question 4

Match each AWS service to its primary security function.

Accepted Answer

AWS WAF: Web application firewall that protects against common web exploits.. These are core AWS security services with distinct purposes.

Answer

AWS WAF: Managed DDoS protection service.

Answer

AWS Shield: Threat detection service.

Question 5

Which TWO AWS services can be used to detect anomalous API activity in an AWS account? (Choose two.)

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that uses machine learning and anomaly detection to identify suspicious API activity. AWS CloudTrail, with the CloudTrail Insights feature, provides continuous monitoring and detection of anomalous API activity by analyzing management events and generating insights. Additionally, CloudTrail logs can be used with Amazon CloudWatch to set up metric filters and alarms for detecting unusual patterns. Therefore, both GuardDuty and CloudTrail are valid services for detecting anomalous API activity.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

Amazon Inspector

Question 6

A developer has created an S3 bucket policy that grants public read access. The security team wants to prevent any S3 bucket from becoming public. Which AWS service can enforce this restriction across all accounts?

Accepted Answer

A service control policy (SCP) denying s3:PutBucketPolicy. A service control policy (SCP) is the correct choice because it operates at the AWS Organizations level to centrally restrict permissions across all accounts. By creating an SCP that denies the s3:PutBucketPolicy action, you prevent any account in the organization from modifying bucket policies to grant public access, regardless of individual account settings. This enforces a guardrail that cannot be overridden by account administrators.

Answer

AWS CloudTrail with a metric filter

Answer

S3 Block Public Access settings on each account

Answer

IAM permissions boundary

Question 7

Refer to the exhibit. A security engineer is reviewing this CloudFormation template. What security risk is present in this configuration?

Accepted Answer

SSH access is allowed from a large internal CIDR block (10.0.0.0/8) which could expose the instance to unnecessary internal threats.. Option C is correct because allowing SSH (TCP port 22) from the entire 10.0.0.0/8 CIDR block is overly permissive. This range encompasses all RFC 1918 private addresses in the 10.x.x.x space, which could include many internal subnets, VPNs, or peered VPCs that do not require administrative access. Unnecessarily broad internal access increases the attack surface and violates the principle of least privilege.

Answer

The template does not associate the security group with the instance, so the instance has no security group.

Answer

HTTP access is allowed from all IP addresses (0.0.0.0/0) which is a security risk.

Answer

The template uses SecurityGroups property instead of SecurityGroupIds, which is deprecated.

Question 8

A company wants to encrypt data at rest in an Amazon S3 bucket. Which AWS service can centrally manage the encryption keys?

Accepted Answer

AWS Key Management Service (AWS KMS). AWS Key Management Service (AWS KMS) is the correct service because it is a fully managed, centralized service that allows you to create, manage, and control the encryption keys used to encrypt data at rest in Amazon S3. S3 integrates directly with KMS via Server-Side Encryption with AWS KMS (SSE-KMS), enabling you to use customer managed keys (CMKs) or AWS managed keys to enforce granular access control and audit key usage through AWS CloudTrail.

Answer

AWS CloudHSM

Answer

AWS Certificate Manager (ACM)

Answer

AWS Secrets Manager

Question 9

A security engineer must ensure that cross-account access to an S3 bucket is restricted to only accounts that are part of a specific AWS organization. Which IAM policy condition key should be used in the bucket policy?

Accepted Answer

aws:PrincipalOrgID. Option C is correct because the `aws:PrincipalOrgID` condition key allows you to restrict access to only principals (accounts) that belong to a specific AWS organization. By specifying the organization ID in the bucket policy, you ensure that only accounts within that organization can access the S3 bucket, regardless of whether they are from the same account or cross-account. This key is evaluated against the organization ID of the principal's account, making it ideal for cross-account access control based on organizational membership.

Answer

aws:SourceIp

Answer

aws:MultiFactorAuthPresent

Answer

aws:SourceVpce

Question 10

Match each AWS security control to its category.

Accepted Answer

Security Group: A stateful firewall that controls inbound and outbound traffic at the instance level.. Security Groups are stateful instance-level firewalls, Network ACLs are stateless subnet-level firewalls. Common confusions involve mixing statefulness and level of operation.

Answer

Security Group: A stateless firewall that controls traffic at the subnet level.

Answer

AWS WAF: A stateful firewall that controls traffic at the instance level.

Question 11

Match each AWS CloudHSM feature to its description.

Accepted Answer

Dedicated HSM: Each customer gets exclusive access to a hardware security module.. CloudHSM provides dedicated hardware security modules that are FIPS 140-2 Level 3 validated and support automatic key replication across clusters. Common confusions include mistaking single-tenant as multi-tenant or assuming a software emulator is used.

Answer

Multi-tenant: Multiple customers share the same HSM.

Answer

HSM client: CloudHSM provides a software-based HSM emulator.

Question 12

Match each AWS IAM policy type to its description.

Accepted Answer

Identity-based policy: Attached to an IAM user, group, or role to define permissions. The correct matches are: Identity-based policies are attached to users, groups, or roles; Resource-based policies are attached to resources; Permissions boundaries limit maximum permissions; Session policies are passed during role assumption. Common confusions include swapping identity-based and resource-based definitions.

Answer

Identity-based policy: Attached to a resource and defines which principals can access it

Answer

Resource-based policy: Attached to an IAM user, group, or role

Question 13

Match each AWS security tool to its purpose.

Accepted Answer

AWS Shield: Protects against DDoS attacks. Correct matches: AWS Shield protects against DDoS, AWS WAF filters web traffic, and GuardDuty provides threat detection. Common confusions include swapping Shield with WAF and Inspector with Macie.

Answer

AWS Inspector: Protects against DDoS attacks

Answer

AWS Macie: Automates vulnerability assessments

Question 14

A security team suspects that an attacker has compromised an EC2 instance and is using it to launch outbound DDoS attacks. The team needs to quickly isolate the instance while preserving forensic data. Which combination of actions should the team take? (Choose TWO.)

Accepted Answer

Apply a restrictive security group that blocks all outbound traffic.. Option A is correct because applying a restrictive security group that blocks all outbound traffic immediately stops the EC2 instance from sending any network packets, including DDoS traffic, without terminating the instance. This preserves the running state and allows forensic data collection from the instance's memory and disk. Security groups act as a stateful virtual firewall at the instance level, so blocking outbound traffic effectively isolates the instance from the network.

Answer

Modify the network ACL for the subnet to deny all outbound traffic.

Answer

Detach the instance from the Auto Scaling group.

Answer

Terminate the EC2 instance immediately.

Question 15

An IAM user needs to rotate their own access keys. Which IAM policy action should be allowed?

Accepted Answer

iam:UpdateAccessKey. Option B is correct because IAM:UpdateAccessKey is used to rotate access keys (e.g., changing the status from Active to Inactive). Option A is incorrect because IAM:DeleteAccessKey removes a key entirely, not part of rotation. Option C is incorrect because IAM:CreateAccessKey creates a new key but does not handle the deactivation step. Option D is incorrect because IAM:ChangePassword is for password changes, not access keys.

Answer

iam:DeleteAccessKey

Answer

iam:CreateAccessKey

Answer

iam:ChangePassword

Question 16

A security engineer needs to detect and alert on suspicious API calls made from a compromised EC2 instance. The instance is associated with an IAM role that has permissions to call various AWS APIs. Which AWS service should the engineer use to monitor API calls and trigger alerts?

Accepted Answer

AWS CloudTrail combined with Amazon CloudWatch Events. AWS CloudTrail records all API calls made by or on behalf of the EC2 instance's IAM role. By sending these logs to Amazon CloudWatch Events (now Amazon EventBridge), you can create rules that match specific API actions (e.g., 'ec2:TerminateInstances') and trigger alerts via SNS, Lambda, or other targets. This combination provides real-time monitoring and alerting for suspicious API activity from a compromised instance.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

VPC Flow Logs

Question 17

A company uses Amazon GuardDuty and receives a finding of type 'Backdoor:EC2/C&CActivity.B!DNS' for an EC2 instance. What does this finding indicate?

Accepted Answer

The instance is communicating with a known command and control server.. The finding 'Backdoor:EC2/C&CActivity.B!DNS' indicates that GuardDuty has detected DNS queries from the EC2 instance to a domain associated with known command and control (C&C) infrastructure. This is based on GuardDuty's threat intelligence feeds that map DNS request patterns to known malicious domains, signaling that the instance may be compromised and communicating with an attacker's server.

Answer

The instance is being targeted by an SSH brute force attack.

Answer

The instance is exfiltrating data to an S3 bucket.

Answer

The instance is being used in a DDoS attack.

Question 18

A security engineer needs to analyze large volumes of VPC Flow Logs stored in Amazon S3 to identify anomalous traffic patterns. Which approach is MOST cost-effective and scalable?

Accepted Answer

Use Amazon Athena with partitioned data in S3.. Amazon Athena is the most cost-effective and scalable solution for querying large volumes of VPC Flow Logs stored in S3 because it uses a serverless, pay-per-query model with no infrastructure to manage. By partitioning the data (e.g., by date or region), Athena minimizes the amount of data scanned per query, directly reducing costs while enabling complex SQL-based analysis for anomaly detection.

Answer

Use AWS Glue to catalog and query the logs.

Answer

Download the logs to an EC2 instance and use grep commands.

Answer

Use Amazon QuickSight to directly query the logs.

Question 19

A security engineer suspects that an EC2 instance is communicating with a known malicious IP address. The engineer needs to capture the full network packets for analysis. Which approach should be taken?

Accepted Answer

Use VPC Traffic Mirroring to mirror the instance's ENI to a monitoring appliance.. VPC Traffic Mirroring captures and copies all network traffic from an EC2 instance's Elastic Network Interface (ENI) and forwards it to a monitoring appliance (e.g., a security appliance or packet analyzer) for full packet-level analysis. This is the only option that provides raw, full network packets (including headers and payloads) without impacting the instance's performance or requiring software installation on the instance itself.

Answer

Enable AWS Security Hub to detect and capture malicious traffic.

Answer

Install the Amazon CloudWatch agent on the instance to capture network logs.

Answer

Enable VPC Flow Logs on the subnet and analyze the logs.

Question 20

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all CloudTrail trails are enabled and logging to a central S3 bucket. They need to detect any account that disables or modifies its CloudTrail trail. Which approach meets these requirements with the least operational overhead?

Accepted Answer

Use AWS Config rules with an aggregator in the management account to evaluate CloudTrail configuration across all accounts.. AWS Config rules with an aggregator in the management account can evaluate CloudTrail configuration across all accounts in AWS Organizations without deploying per-account resources. The aggregator collects configuration snapshots and changes from member accounts, allowing a single managed rule (e.g., cloud-trail-enabled) to detect when a trail is disabled or modified. This approach minimizes operational overhead because it uses native AWS services with no custom code or cross-account IAM roles to manage.

Answer

Enable CloudTrail Insights in all accounts to detect unusual activity.

Answer

Enable IAM Access Analyzer in each account to monitor CloudTrail changes.

Answer

Create a Lambda function that periodically checks CloudTrail status in each account via the API.