SCS-C02 Practice Test 26 — 15 Questions

Question 1

A company uses AWS IAM Identity Center (AWS SSO) to manage access. A user is assigned to a permission set that grants AdministratorAccess. However, when the user tries to access the AWS console, they receive an error that they are not authorized. What is a possible reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The user is not assigned to the AWS account in Identity Center. In AWS IAM Identity Center, a user must be assigned to both a permission set and an AWS account. The error occurs when the user has the permission set but not the account assignment. Option B is incorrect because MFA is about authentication, not authorization; the user could be authenticated but still lack access to the account. Option C is incorrect because the permission set already includes AdministratorAccess, which provides full permissions; the issue is the account assignment. Option D is incorrect because the error is about accessing the console, not about managing permission sets.

Answer

The user has not set up MFA

Answer

The permission set does not include the necessary policies

Answer

The user does not have permissions to manage permission sets

Question 2

A security engineer notices suspicious API calls from an EC2 instance that has an IAM role attached. The engineer wants to quickly determine if the instance's credentials have been compromised and are being used from an external IP address. What is the most efficient way to detect this?

Accepted Answer

Enable Amazon GuardDuty and look for the finding type 'UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration'.. Amazon GuardDuty's finding type 'UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration' is specifically designed to detect when EC2 instance credentials (from an IAM role) are being used from an external IP address. GuardDuty analyzes CloudTrail management events, VPC Flow Logs, and DNS logs to identify anomalous API calls where the source IP is outside the VPC, indicating credential exfiltration. This is the most efficient method as it provides a pre-built, automated detection without manual log analysis.

Answer

Check VPC Flow Logs for traffic from the instance to unusual destinations.

Answer

Review AWS CloudTrail logs for the instance's IAM role and look for source IP addresses outside the VPC.

Answer

Use IAM Access Analyzer to review the trust policy of the instance's IAM role.

Question 3

A security engineer notices that an S3 bucket containing sensitive data has been accessed from an IP address outside the allowed range. CloudTrail logs show the access was made using temporary credentials from an assumed role. What additional logging is needed to trace the access back to the original IAM user who assumed the role?

Accepted Answer

Enable AWS Config to record S3 bucket policies.. The information needed to trace the access back to the original IAM user who assumed the role is already available in CloudTrail management events, which are enabled by default. The AssumeRole API call is logged as a management event and includes the ARN of the IAM user or role that performed the assumption. Therefore, no additional logging is required to identify the original user. Options A, B, C, D, and E do not provide this specific information: A and D log the S3 access but show only the assumed role; B and C are unrelated; E records configuration changes but not the specific AssumeRole call.

Answer

Enable CloudTrail to log data events for the S3 bucket.

Answer

Enable VPC Flow Logs for the VPC where the request originated.

Answer

Configure CloudWatch Logs to capture the EC2 instance's system logs.

Answer

Enable S3 server access logging for the bucket.

Question 4

Refer to the exhibit. A security engineer runs the above AWS CLI command to encrypt a secret file. The command succeeds and returns a base64-encoded ciphertext. Which of the following statements is correct?

Accepted Answer

The command returns a base64-encoded ciphertext that can be decrypted with the same KMS key.. The command encrypts the plaintext file using the specified KMS key and returns the ciphertext as base64-encoded output. Option A is wrong because the command does not specify an encryption context; it's optional. Option B is wrong because the command uses fileb:// which reads binary data; it will succeed if the file exists. Option D is wrong because the output is the ciphertext, not a data key.

Answer

The command returns a plaintext data key and an encrypted copy.

Answer

The command will fail because fileb:// is not a valid prefix.

Answer

The command will fail because encryption context is required.

Question 5

Which TWO of the following are valid methods to protect data in transit between an on-premises data center and AWS? (Choose two.)

Accepted Answer

AWS Site-to-Site VPN. Options B and E are correct. AWS Site-to-Site VPN creates an encrypted tunnel over the internet, protecting data in transit. AWS Direct Connect with MACsec provides encryption over a private physical connection. Option A is incorrect because CloudFront with HTTPS only encrypts between viewer and edge locations, not necessarily between the origin and edge, and it is not a method to connect on-premises directly to AWS. Option C is incorrect because VPC Peering does not encrypt traffic; it only routes between VPCs. Option D is incorrect because S3 Transfer Acceleration only speeds up transfers using edge locations but does not provide encryption.

Answer

Amazon CloudFront with HTTPS-only viewer protocol policy

Answer

VPC Peering

Answer

S3 Transfer Acceleration

Question 6

A company wants to automate the detection of sensitive data in an S3 bucket. Which AWS service should be used?

Accepted Answer

Amazon Macie. Amazon Macie uses machine learning to discover and classify sensitive data, making it the correct choice for automated detection of sensitive data in S3. AWS Artifact provides compliance reports, Amazon Inspector assesses vulnerabilities, and Amazon GuardDuty detects threats—none specifically focus on sensitive data detection.

Answer

AWS Artifact

Answer

Amazon Inspector

Answer

Amazon GuardDuty

Question 7

An organization has a production AWS account and a development AWS account. Developers need to access the production account from the development account using IAM roles. What is the MOST secure way to set this up?

Accepted Answer

Create an IAM role in the production account with a trust policy allowing the development account to assume it.. It uses cross-account IAM roles, allowing developers in the development account to assume a role in the production account using AWS Security Token Service (STS). This provides temporary, least-privilege credentials without sharing long-term access keys. Option B is insecure because sharing access keys creates long-term credentials that are hard to rotate and manage. Option C is incorrect: a VPN provides network connectivity but does not grant IAM access. Option D is incorrect because IAM users are account-specific; duplicating users across accounts does not enable cross-account access.

Answer

Create IAM users in the production account and share access keys with developers.

Answer

Establish a VPN connection between the accounts and use directory credentials.

Answer

Create the same IAM users in both accounts with identical permissions.

Question 8

A company is using Amazon CloudWatch Logs to store application logs. The security team needs to ensure that logs are encrypted at rest using a customer-managed KMS key (CMK). What configuration is required?

Accepted Answer

Associate the CMK with the CloudWatch Logs log group by specifying the key ARN in the log group's encryption configuration.. CloudWatch Logs supports server-side encryption with a customer-managed KMS key (CMK) by associating the key ARN with the log group. This is done via the CloudWatch Logs console, AWS CLI, or SDK using the `associate-kms-key` operation, which encrypts all log data at rest within that log group. The KMS key policy must also grant the CloudWatch Logs service principal (`logs.region.amazonaws.com`) permission to use the key, but the core configuration step is associating the key with the log group.

Answer

Add a KMS key policy that allows CloudWatch Logs to use the key.

Answer

Enable default encryption on the S3 bucket used for log export with a CMK.

Answer

Configure the S3 bucket policy to require SSE-KMS for log delivery.

Question 9

An IAM policy attached to a user contains the above statements. The user attempts to download an object from 'example-bucket/confidential/report.pdf'. What is the result?

Accepted Answer

The download fails because the deny statement applies to the object.. The explicit Deny statement in the IAM policy takes precedence over any Allow statement, so even though the first statement allows s3:GetObject, the deny on the confidential prefix blocks the download. AWS evaluates all applicable policies and any explicit Deny wins. Therefore the download fails because the deny statement applies to the object.

Answer

The download fails because the user is not an administrator.

Answer

The download succeeds because the user can access other objects.

Answer

The download succeeds because the first statement allows GetObject.

Question 10

A company wants to ensure that all data sent to an S3 bucket is encrypted in transit. Which policy statement should be added to the bucket policy?

Accepted Answer

Deny if aws:SecureTransport is false. Deny if aws:SecureTransport is false. The aws:SecureTransport condition key evaluates to true when the request is made over HTTPS (TLS) and false when made over HTTP. To enforce encryption in transit, you must explicitly deny requests where aws:SecureTransport is false, ensuring that any unencrypted HTTP request is rejected. This is the standard pattern for S3 bucket policies to enforce TLS-only access.

Answer

Allow if aws:SecureTransport is false

Answer

Deny unless aws:SecureTransport is false

Answer

Allow if aws:SecureTransport is true

Question 11

Which THREE actions should be taken when preparing an incident response plan for AWS?

Accepted Answer

Enable AWS CloudTrail in all regions.. AWS CloudTrail must be enabled in all regions to ensure that all API calls across the entire AWS infrastructure are logged. This provides a comprehensive audit trail essential for forensic investigation and identifying the scope of a security incident. Without multi-region CloudTrail, an attacker could operate in an unmonitored region, leaving no trace for incident responders.

Answer

Share the AWS account root user password with the incident response team.

Answer

Disable VPC Flow Logs to reduce log volume.

Question 12

Which TWO of the following are valid options for encrypting data at rest in Amazon EBS? (Choose two.)

Accepted Answer

Enable EBS encryption by default using the AWS managed key for EBS.. Option A is correct because Amazon EBS supports account-level and Region-level encryption by default, which automatically encrypts new volumes and snapshots using the AWS managed key for EBS (aws/ebs) unless you specify a different key. Option B is correct because EBS encryption can be configured to use a customer managed KMS key, giving you control over key policies, rotation, and grants while still using the native EBS/KMS encryption mechanism. Option C is not a valid EBS at-rest encryption option because running an encryption script inside the EC2 instance is application-level or OS-level encryption, not native EBS volume encryption. Option D is not correct because CloudHSM is a separate HSM service and is not the mechanism used to generate or store EBS encryption keys; EBS encryption keys are managed through AWS KMS. Option E is not correct because S3 server-side encryption protects objects stored in S3, not EBS volumes or EBS snapshots.

Answer

Use an encryption script on the EC2 instance to encrypt the volume.

Answer

Use AWS CloudHSM to generate and store the encryption key.

Answer

Use S3 server-side encryption to encrypt the EBS snapshot.

Question 13

A company wants to monitor for unauthorized API calls in real-time. The solution must meet the following requirements: - Detect calls that fail authentication (AccessDenied). - Detect calls that use a revoked IAM role. - Provide a centralized view across multiple accounts. Which THREE services should be used together to implement this solution? (Choose three.)

Accepted Answer

AWS Organizations. AWS Organizations is correct because it enables centralized management of multiple AWS accounts, allowing the solution to aggregate CloudTrail logs from all accounts into a single CloudWatch Logs group. This centralization is essential for real-time monitoring of unauthorized API calls across the entire organization, as CloudTrail logs record all API activity including AccessDenied errors and actions taken by revoked IAM roles.

Answer

AWS IAM Access Analyzer

Answer

AWS Config

Question 14

A security engineer needs to ensure that all S3 object-level API calls (e.g., GetObject, PutObject) on the bucket 'my-bucket' are logged. The current CloudTrail configuration is as shown in the exhibit. What change should the engineer make?

Accepted Answer

Change the data resource value to 'arn:aws:s3:::my-bucket/' to cover all objects.. To log all S3 object-level API calls (GetObject, PutObject, etc.) on the bucket 'my-bucket', the DataResources value must specify the bucket's ARN with a trailing slash (arn:aws:s3:::my-bucket/) to indicate all objects within the bucket. Without the trailing slash, CloudTrail interprets the ARN as referring to the bucket itself, not its objects, and thus object-level events are not captured. The trailing slash ensures the selector applies to all object keys under that bucket.

Answer

Remove the DataResources section and add an AdvancedEventSelector for S3.

Answer

Change the bucket ARN to 'arn:aws:s3:::my-bucket' without a trailing slash.

Answer

Enable management events by setting IncludeManagementEvents to true.

Question 15

A security administrator discovers that an IAM user has been deleted accidentally. What is the correct way to restore the user's access?

Accepted Answer

Create a new IAM user with the same name and attach the same policies. IAM does not support undeletion or restoration of deleted users. When an IAM user is deleted, all associated credentials, permissions, and metadata are permanently removed. The only way to restore access is to create a new IAM user with the same name and manually reattach the same policies, groups, and tags, and then regenerate access keys and passwords as needed.

Answer

Contact AWS Support to undo the deletion

Answer

Use the AWS IAM console to undelete the user

Answer

Restore the user from a backup of IAM