SCS-C02 Practice Test 26 — 15 Questions

Question 1

A security engineer is implementing a data classification policy for an S3 bucket that contains sensitive customer data. The policy requires that all objects be encrypted at rest using AWS KMS and that any attempt to upload an unencrypted object be denied. Which THREE steps should the engineer take to enforce this policy? (Choose THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a customer managed KMS key.. To enforce encryption at rest using AWS KMS for all objects uploaded to an S3 bucket, the security engineer should: 
- Create a customer managed KMS key (option B) to have full control over the key, including rotation, access policies, and auditing. 
- Add a bucket policy that denies PutObject if the `s3:x-amz-server-side-encryption` header is not set to `aws:kms` (option D). This ensures any upload without KMS encryption is denied. 
- Enable S3 default encryption with the KMS key (option E) to automatically encrypt objects even if the upload request does not include encryption headers.

Option A (enabling bucket keys) is wrong because it reduces KMS API calls for already KMS-encrypted objects, but does not enforce encryption. Option C (enforcing SSL) addresses encryption in transit, not at rest, and thus does not meet the policy requirement.

Answer

Enable S3 bucket keys to reduce KMS API calls.

Answer

Enable bucket policy to enforce SSL (aws:SecureTransport).

Question 2

A security engineer notices that an IAM role has a trust policy allowing any AWS account to assume it. Which attack is this misconfiguration most likely to enable?

Accepted Answer

Unauthorized access by an external attacker. An IAM role trust policy that allows any AWS account (i.e., `"Principal": {"AWS": "*"}`) to assume the role means that any user or service in any AWS account can call the STS `AssumeRole` API to obtain temporary credentials for the role. This directly enables unauthorized access by an external attacker who can discover the role ARN and assume it, gaining all permissions attached to the role.

Answer

Logging bypass via CloudTrail

Answer

Cross-service confused deputy attack

Answer

Privilege escalation by attaching additional policies

Question 3

A company is designing a VPC with public and private subnets. The application servers in the private subnets need to download patches from the internet. Which architecture provides the highest security while allowing internet access?

Accepted Answer

Place a NAT Gateway in the public subnet and configure the private subnet route table to send 0.0.0.0/0 traffic to the NAT Gateway. A NAT Gateway in a public subnet allows instances in private subnets to initiate outbound traffic to the internet (e.g., for patch downloads) while preventing any unsolicited inbound traffic from the internet. The private subnet route table sends 0.0.0.0/0 traffic to the NAT Gateway, which then forwards it through the Internet Gateway (IGW) attached to the VPC. This provides the highest security because the private instances remain unreachable from the internet, unlike using an IGW directly or a bastion host for routing.

Answer

Create a VPC endpoint for Amazon S3 and route traffic through it

Answer

Attach an internet gateway to the private subnet and configure the route table to send 0.0.0.0/0 traffic to the internet gateway

Answer

Place a bastion host in the public subnet and configure the private instances to route internet traffic through it

Question 4

A company uses an AWS Transit Gateway to connect multiple VPCs and on-premises networks. A security engineer needs to ensure that traffic between VPCs is inspected by a third-party firewall appliance. Which architecture should be used?

Accepted Answer

Attach the firewall appliance to a dedicated inspection VPC and route traffic from other VPCs through the inspection VPC using transit gateway route tables.. It uses a dedicated inspection VPC as a central point for traffic inspection. By attaching the third-party firewall appliance to this inspection VPC and manipulating transit gateway route tables, you can force all inter-VPC traffic to be routed through the firewall for inspection. This architecture leverages the transit gateway's ability to route traffic between attachments based on route table entries, enabling centralized security enforcement without modifying individual VPC routing.

Answer

Configure security groups on the transit gateway to inspect traffic.

Answer

Create VPC endpoints for each VPC to route traffic through the firewall.

Answer

Use network ACLs on the transit gateway to filter traffic.

Question 5

A company uses AWS Organizations with multiple accounts. The security team wants to prevent all users in the production account from disabling AWS CloudTrail or modifying its configuration. What is the MOST effective way to achieve this?

Accepted Answer

Create an SCP in AWS Organizations that denies cloudtrail:StopLogging, cloudtrail:DeleteTrail, cloudtrail:UpdateTrail, and similar actions.. An SCP applied to the production account can deny specific CloudTrail actions across all principals in the account, including the root user. Option A is insufficient because denying only cloudtrail:DeleteTrail still allows other modifications like cloudtrail:StopLogging or cloudtrail:UpdateTrail. Option B is detective, not preventive, and does not stop users from making changes. Option D, IAM permissions boundaries, are attached to IAM entities but do not apply to all users (e.g., the root user) and can be overridden by an explicit allow; SCPs provide stronger account-wide enforcement.

Answer

Use IAM policies to deny only cloudtrail:DeleteTrail for all users.

Answer

Enable CloudTrail log file validation and use AWS Config to detect changes.

Answer

Attach an IAM permissions boundary to all IAM roles in the production account that denies CloudTrail modifications.

Question 6

A company has an S3 bucket that stores sensitive data. The bucket policy allows access only from a specific VPC endpoint. The security engineer tests the configuration and finds that requests from the VPC endpoint are being denied. The bucket policy contains the following condition: "Condition": { "StringEquals": { "aws:SourceVpce": "vpce-12345678" } }. The VPC endpoint ID is correct. The engineer also confirms that the VPC endpoint policy allows the necessary S3 actions. What is the most likely reason for the denial?

Accepted Answer

The request is not being routed through the VPC endpoint; the EC2 instance is using a public S3 endpoint.. The bucket policy condition aws:SourceVpce only appears in requests that are routed through the specified VPC endpoint. If the EC2 instance accesses S3 via the public internet (using the public S3 endpoint), the request does not include the condition key, and the condition fails, causing denial. Option A correctly identifies this misrouting. Options B, C, and D are not the primary cause: IAM roles are not the issue here because the bucket policy is denying based on the condition; cross-region access is allowed via endpoints; and the condition key is correctly spelled.

Answer

The EC2 instance does not have an IAM role that allows s3:GetObject.

Answer

The VPC endpoint is in a different region than the S3 bucket.

Answer

The condition key is misspelled; it should be aws:SourceVpce (no 'e' at the end).

Question 7

A company wants to restrict access to an RDS database to only EC2 instances that have a specific tag 'Environment: Production'. Which TWO steps should be taken?

Accepted Answer

Attach an IAM policy to the EC2 instance role that allows rds:Connect only if the request originates from the VPC Endpoint.. To restrict access to an RDS database to only EC2 instances with a specific tag, options A and E are correct. Option A: Attach an IAM policy to the EC2 instance role that allows rds:Connect only if the request originates from a VPC Endpoint. This ensures that only instances that can reach the VPC Endpoint (which requires proper routing and security) can connect. Option E: Create a VPC Endpoint for RDS and attach an IAM policy that uses the condition 'ec2:ResourceTag/Environment' : 'Production'. This uses IAM conditions to allow access only from instances with the specified tag. Option B is incorrect because resource-based policies are not supported for RDS instances. Options C and D are incorrect because security groups do not support tag-based rules; they only filter based on IP addresses, ports, and other security groups.

Answer

Create a resource-based policy on the RDS instance.

Answer

Use the RDS instance's security group to allow traffic only from the EC2 instance's security group.

Answer

Create a security group rule that references the EC2 instance's security group.

Question 8

A company uses an Application Load Balancer (ALB) to distribute traffic to a fleet of EC2 instances in private subnets. The security team wants to ensure that only the ALB can communicate with the EC2 instances. Which security group configuration should be applied to the EC2 instances?

Accepted Answer

Allow inbound HTTP traffic from the ALB's security group. Security groups can reference other security groups as a source, allowing traffic only from resources associated with that security group. By specifying the ALB's security group as the source for inbound HTTP traffic, the EC2 instances will only accept traffic originating from the ALB, effectively restricting all other inbound traffic. This is a best practice for securing backend instances behind a load balancer.

Answer

Allow inbound HTTP traffic from the EC2 instances' own security group

Answer

Allow inbound HTTP traffic from 0.0.0.0/0

Answer

Allow inbound HTTP traffic from the VPC CIDR block

Question 9

A company wants to ensure that all API calls in their AWS account are logged and immutable. Which TWO actions should be taken? (Choose TWO.)

Accepted Answer

Enable S3 Object Lock on the CloudTrail S3 bucket. Enabling S3 Object Lock on the CloudTrail S3 bucket ensures that log files are immutable and cannot be overwritten or deleted by any user, including root. This is achieved through a write-once-read-many (WORM) model, which is essential for maintaining a tamper-proof audit trail of all API calls.

Answer

Enable MFA delete on the S3 bucket

Answer

Use AWS Config rules to monitor CloudTrail configuration

Answer

Encrypt the S3 bucket with AWS KMS

Question 10

A security engineer needs to ensure that all EC2 instances launched in an account have a specific tag (e.g., CostCenter) applied. If an instance is launched without the tag, it should be automatically terminated. Which solution meets these requirements with minimal effort?

Accepted Answer

Use AWS Config rules with an automatic remediation action that invokes a Lambda function to terminate the instance.. AWS Config rules can detect EC2 instances that are missing the required tag and trigger an automatic remediation action via a Lambda function to terminate them, providing a fully automated solution with minimal effort. Option A is wrong because SCPs cannot enforce tagging on individual EC2 instances at launch time; they can only deny actions based on conditions, but tagging conditions are not supported for ec2:RunInstances. Option B is wrong because AWS Organizations Tag Policies enforce tagging on resources but do not automatically remediate non-compliant resources; they only prevent creation of resources without tags if applied at the service level, which is not the case here. Option D is wrong because CloudTrail logs events but cannot automatically terminate instances; it would require manual intervention or additional automation.

Answer

Use an SCP to deny ec2:RunInstances if the request does not include the required tag.

Answer

Use AWS Organizations Tag Policies to enforce the tag.

Answer

Use AWS CloudTrail to detect RunInstances events and send alerts to the security team.

Question 11

A company has enabled AWS CloudTrail and wants to receive real-time notifications when specific API calls, such as DeleteTrail, are made. Which service should be used to trigger an alert based on CloudTrail log events?

Accepted Answer

Amazon CloudWatch Events / Amazon EventBridge. Amazon CloudWatch Events (now part of Amazon EventBridge) is the correct service to trigger real-time alerts based on CloudTrail log events. You can create a rule that matches specific API calls, such as DeleteTrail, and route the event to a target like an SNS topic or Lambda function for immediate notification. CloudTrail delivers log events to CloudWatch Logs, and EventBridge can directly consume those events for pattern matching and alerting.

Answer

AWS CloudTrail console notifications

Answer

Amazon VPC Flow Logs

Answer

Amazon S3 event notifications

Question 12

Refer to the exhibit. A CloudWatch Logs metric filter is configured. Which log event will trigger the filter to create a metric?

Accepted Answer

"ERROR: Connection refused". The metric filter pattern is configured to match log events that begin with the string 'ERROR:'. Option B starts with 'ERROR:', so it triggers the metric filter. Options A, C, and D start with a timestamp and do not match the pattern.

Answer

"2023-01-01 12:00:00 ERROR Connection refused"

Answer

"2023-01-01 12:00:00 WARNING Disk full"

Answer

"2023-01-01 12:00:00 INFO Starting process"

Question 13

The above condition is added to an S3 bucket policy to restrict access to a specific VPC endpoint. An EC2 instance in the same VPC is unable to access the bucket. What is the most likely reason?

Accepted Answer

The resource ARN in the policy is for EC2, not for S3. The resource ARN in the policy must reference the S3 bucket (e.g., arn:aws:s3:::bucket-name/*), not an EC2 resource. If the ARN is for EC2, the policy will not apply to S3 operations, causing the EC2 instance to be denied access regardless of the VPC endpoint condition. S3 bucket policies only take effect when the Resource element specifies the S3 bucket ARN.

Answer

The condition should use aws:SourceVpc instead of aws:SourceVpce

Answer

The EC2 instance does not have a public IP address

Answer

The VPC endpoint policy does not allow the s3:GetObject action

Question 14

A company has an incident response (IR) process that includes isolating compromised EC2 instances. During a security incident, the IR team needs to block all traffic to and from a compromised instance while preserving the instance for forensic analysis. Which approach should the team take?

Accepted Answer

Modify the security group associated with the instance to remove all inbound and outbound rules.. Modifying the security group to remove all inbound and outbound rules effectively blocks all traffic to and from the EC2 instance because security groups act as a stateful virtual firewall at the instance level. This approach preserves the instance in its current running state, allowing the IR team to perform forensic analysis without the risk of the instance being tampered with or communicating with external systems.

Answer

Detach the instance from the Auto Scaling group and stop it.

Answer

Update the network ACL for the subnet to deny all traffic.

Answer

Terminate the instance immediately.

Question 15

A company uses AWS Organizations with multiple accounts. The security team wants to centrally collect and analyze CloudTrail logs from all accounts in a single S3 bucket. What is the most efficient way to achieve this?

Accepted Answer

Create a single organization trail in the management account that logs all accounts.. AWS Organizations supports creating a single organization trail in the management account that automatically logs CloudTrail events for all accounts in the organization. This centralizes log collection into one S3 bucket without needing to configure trails per account, making it the most efficient and scalable approach for multi-account environments.

Answer

Create a CloudTrail trail in each account and configure the same S3 bucket as the destination.

Answer

Use CloudWatch Logs subscription filter to send logs from each account to a central account.

Answer

Use S3 cross-region replication to copy logs from each account's bucket to a central bucket.