SCS-C02 Practice Test 27 — 15 Questions

Question 1

A company stores sensitive data in an S3 bucket with default encryption (SSE-S3) enabled. A security audit reveals that objects are being accessed by users from unexpected IP addresses. The company wants to enforce that only objects encrypted with a specific KMS key (managed by the security team) can be accessed. Which combination of actions should be taken?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Modify the bucket policy to deny PutObject and GetObject unless the request includes the specific KMS key ID in the 'x-amz-server-side-encryption-aws-kms-key-id' header.. It uses a bucket policy with the 's3:x-amz-server-side-encryption-aws-kms-key-id' condition key to deny requests that do not include the specific KMS key ID in the 'x-amz-server-side-encryption-aws-kms-key-id' header. This enforces that only objects encrypted with the specified KMS key can be accessed. Option A is incorrect because SSE-C uses customer-provided keys and does not integrate with KMS key IDs; distributing a customer key does not enforce the specific KMS key. Option C is incorrect because S3 Block Public Access and AWS WAF do not control access based on encryption key. Option D is incorrect because lifecycle policies do not restrict access based on encryption key.

Answer

Use SSE-C and distribute the customer key to authorized users only.

Answer

Enable S3 Block Public Access and use AWS WAF to filter IP addresses.

Answer

Apply an S3 Lifecycle policy to transition objects to Glacier after 30 days.

Question 2

A company uses AWS Organizations with multiple accounts. They want to centralize logging of all API calls across all accounts and store them in a single S3 bucket. Which configuration should be used?

Accepted Answer

Create an organization trail in the management account. AWS Organizations allows you to create an organization trail in the management account that automatically logs API calls for all member accounts. This centralizes CloudTrail logs into a single S3 bucket without needing to configure individual trails per account, ensuring complete coverage and simplified management.

Answer

Use AWS Config to record API calls across all accounts

Answer

Create a separate CloudTrail trail in each account and aggregate logs using Amazon Athena

Answer

Enable VPC Flow Logs in each account and send to a central S3 bucket

Question 3

A security engineer is designing a multi-tier web application on AWS. The web tier must be accessible from the internet, but the application tier should be accessible only from the web tier. The database tier should be accessible only from the application tier. Which combination of security groups provides the MOST secure configuration?

Accepted Answer

Web SG: allow HTTP/HTTPS from 0.0.0.0/0. App SG: allow HTTP from Web SG security group ID. DB SG: allow MySQL from App SG security group ID.. It uses security group IDs as the source for inbound rules, which allows traffic only from instances associated with the specified security group, regardless of their IP addresses. This provides a dynamic and secure way to control traffic between tiers, as security group IDs are resolved at the instance level and automatically adapt to changes in instance membership. By contrast, using CIDR blocks (as in options A and C) is less secure because it relies on static IP ranges that may not accurately reflect the actual instances in the web or app tiers, and option B is overly permissive by allowing all traffic from the web SG.

Answer

Web SG: allow HTTP/HTTPS from 0.0.0.0/0. App SG: allow HTTP from Web SG CIDR. DB SG: allow MySQL from App SG CIDR.

Answer

Web SG: allow HTTP/HTTPS from 0.0.0.0/0. App SG: allow all traffic from Web SG. DB SG: allow MySQL from App SG.

Answer

Web SG: allow HTTP/HTTPS from 0.0.0.0/0. App SG: allow HTTP from Web SG security group ID. DB SG: allow MySQL from 10.0.0.0/24.

Question 4

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all newly created accounts automatically have AWS CloudTrail enabled, with logs delivered to a centralized S3 bucket. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Create an SCP that denies actions to disable CloudTrail and modify the S3 bucket policy. Use AWS CloudFormation StackSets to deploy a CloudTrail trail in each account.. The correct answer. SCPs cannot enable CloudTrail, but they can prevent disabling it and modifying the S3 bucket policy. To actually enable CloudTrail across all accounts with minimal overhead, AWS CloudFormation StackSets can deploy a CloudTrail trail in each account automatically. Option A is incorrect because SCPs cannot enable services—they only deny or allow actions. Option B is incorrect because AWS Trusted Advisor only checks and alerts; it does not enforce configurations. Option D is incorrect because AWS Config rules with auto-remediation can work but involve more setup and overhead compared to using StackSets, which is purpose-built for deploying resources across multiple accounts. Therefore, C provides the least operational overhead.

Answer

Create an SCP that enables CloudTrail and enforces log delivery to the centralized S3 bucket.

Answer

Use AWS Trusted Advisor to check CloudTrail status and send alerts to the security team.

Answer

Use AWS Config rules with auto-remediation to enable CloudTrail in each account.

Question 5

Which AWS service can be used to detect and alert on suspicious network traffic patterns within a VPC, such as port scanning or unusual outbound traffic?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors VPC Flow Logs, DNS logs, and CloudTrail events to identify suspicious network traffic patterns such as port scanning, unusual outbound traffic, and other malicious activities. It uses machine learning, anomaly detection, and integrated threat intelligence to generate security alerts without requiring manual rules or signatures.

Answer

AWS WAF

Answer

AWS Network Firewall

Answer

VPC Flow Logs

Question 6

A company runs a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB) in a VPC. The security team uses Amazon GuardDuty and has enabled Amazon Detective. Recently, GuardDuty raised a 'Recon:EC2/PortProbeUnprotectedPort' finding for one of the instances. The security engineer verified that the ALB security group only allows inbound HTTP/HTTPS from the internet. However, the finding indicates that the instance is receiving probes on port 22 (SSH). Further investigation with Detective shows that the probes originate from multiple IP addresses and are reaching the instance's private IP address. The engineer suspects that the SSH port is exposed despite the security group configuration. What is the MOST likely cause of this exposure?

Accepted Answer

The EC2 instance's security group allows inbound SSH from 0.0.0.0/0.. The GuardDuty finding 'Recon:EC2/PortProbeUnprotectedPort' indicates that an EC2 instance is receiving unsolicited probes on a port that should not be publicly accessible. Since the ALB security group only allows HTTP/HTTPS from the internet, but the probes are reaching the instance's private IP on port 22 (SSH), the most likely cause is that the instance's own security group has an inbound rule allowing SSH from 0.0.0.0/0. This bypasses the ALB's security group because the instance's security group is evaluated independently for direct traffic to the instance's private IP, and if it permits SSH from anywhere, the probes will reach the instance.

Answer

VPC Flow Logs are misconfigured and are inadvertently forwarding traffic to the instance.

Answer

AWS Shield Advanced is causing false positives by marking legitimate traffic as probes.

Answer

The ALB security group has an inbound rule that allows SSH from the internet.

Question 7

A company runs a critical application on Amazon EC2 instances in an Auto Scaling group. The security team needs to monitor for unauthorized changes to security groups. They have enabled AWS Config with the security-group-change detection rule. However, they notice that changes are being detected but not all changes trigger a notification. The team wants to ensure that every security group modification (create, delete, or rule change) sends an alert to the security operations center via Amazon SNS. The current setup: AWS Config rules evaluate resources periodically, and SNS notifications are sent only when the rule compliance status changes. What should the team do to achieve real-time alerts for all security group changes?

Accepted Answer

Configure an Amazon EventBridge rule that matches API calls via CloudTrail for security group modifications and sends notifications to an SNS topic.. CloudTrail logs all API calls, including security group modifications, in real time. By creating an Amazon EventBridge rule that matches SecurityGroup events and targets an SNS topic, the team can receive immediate notifications. Option A is incorrect because GuardDuty focuses on threat detection (e.g., suspicious API activity), not on monitoring all security group configuration changes. Option C is incorrect because even with frequent evaluations, AWS Config rules evaluate configuration snapshots periodically and do not provide real-time alerting for each change. Option D is incorrect because VPC Flow Logs monitor network traffic, not security group modifications.

Answer

Deploy Amazon GuardDuty and enable the Security Group Monitoring feature.

Answer

Increase the frequency of AWS Config rule evaluations to every minute to reduce detection latency.

Answer

Enable VPC Flow Logs and set up a metric filter for security group-related traffic anomalies.

Question 8

A security engineer is setting up a new VPC with public and private subnets. The VPC has an Internet Gateway attached. The public subnet's route table has a default route (0.0.0.0/0) pointing to the Internet Gateway. The private subnet's route table has a default route pointing to a NAT gateway. The engineer launches an EC2 instance in the private subnet and assigns it a public IP address. However, the instance cannot access the internet. What should the engineer do to resolve this issue?

Accepted Answer

Remove the public IP address from the instance and ensure the private subnet has a route to the NAT gateway.. An EC2 instance in a private subnet cannot use a public IP address for internet access, as the private subnet's route table directs default traffic to a NAT gateway, not an internet gateway. The public IP is irrelevant because the instance's traffic must traverse the NAT gateway, which requires the instance to have no public IP and the private subnet route to point to the NAT gateway. Removing the public IP ensures the instance uses the NAT gateway's Elastic IP for outbound traffic, resolving the internet access issue.

Answer

Attach an Elastic IP to the instance.

Answer

Update the private subnet's route table to point 0.0.0.0/0 to the Internet Gateway.

Answer

Allow outbound traffic in the instance's security group.

Question 9

A company uses AWS Organizations with multiple accounts. The security team wants to detect suspicious API activity across all accounts in real time. They have enabled AWS CloudTrail in all accounts and are sending logs to a centralized S3 bucket. However, they are receiving alerts only after a significant delay. What should the security team do to reduce the latency of threat detection?

Accepted Answer

Set up Amazon EventBridge rules in each account to send specific CloudTrail events to a centralized event bus for immediate processing.. Amazon EventBridge can be configured with rules in each account to forward specific CloudTrail events to a centralized event bus in near real time, bypassing the latency introduced by CloudTrail log delivery to S3 (which can be up to 15 minutes). This allows the security team to process and alert on suspicious API activity immediately as events occur, rather than waiting for log files to be delivered and processed.

Answer

Enable Amazon GuardDuty in each account and configure it to send findings to a centralized S3 bucket.

Answer

Configure CloudTrail to deliver logs to a single S3 bucket and use S3 Event Notifications to trigger a Lambda function.

Answer

Use Amazon CloudWatch Logs Insights to query CloudTrail logs across accounts in real time.

Question 10

A security engineer reviews the above IAM policy attached to an IAM user. The user reports that they cannot download objects from the S3 bucket 'example-bucket' when connected from the office network (IP range 10.0.0.0/16). What is the most likely cause?

Accepted Answer

The source IP condition does not match the user's actual IP address. The IAM policy includes a `Condition` block using `aws:SourceIp` that restricts allowed IP addresses to the range 10.0.0.0/16. If the user's actual office network IP address falls outside this range (e.g., due to NAT or a different subnet), the condition fails, and the `s3:GetObject` action is denied, even though the user has the necessary permissions in the `Action` field.

Answer

The bucket policy overrides the IAM policy

Answer

The policy does not allow the s3:GetObject action

Answer

The user is not assuming the correct IAM role

Question 11

A security engineer wants to capture all DNS queries made by EC2 instances to detect potential data exfiltration. Which AWS service should be used to log the DNS requests?

Accepted Answer

Use Route 53 Resolver DNS Firewall with query logging. Route 53 Resolver DNS Firewall with query logging is the correct choice because it is specifically designed to log all DNS queries made by EC2 instances that use the Route 53 Resolver. This service captures the domain names being queried, the source IP, and the response, enabling detection of DNS-based data exfiltration (e.g., DNS tunneling). It integrates directly with the VPC's DNS resolver, ensuring all outbound DNS traffic from EC2 instances is logged without additional agents.

Answer

Use Amazon GuardDuty

Answer

Enable VPC Flow Logs

Answer

Enable AWS CloudTrail

Question 12

A security engineer is investigating a potential compromise. An EC2 instance running Amazon Linux 2 is sending outbound traffic to a known malicious IP address. The engineer needs to capture the network traffic for analysis without alerting the attacker. Which solution meets these requirements?

Accepted Answer

Use VPC Traffic Mirroring to mirror the EC2 instance's ENI traffic to a monitoring appliance in a separate VPC.. VPC Traffic Mirroring captures all network traffic at the packet level from the EC2 instance's Elastic Network Interface (ENI) and forwards it to a monitoring appliance without any inline processing or modification of the traffic. This allows the security engineer to perform deep packet analysis while remaining completely transparent to the attacker, as the mirrored traffic is a copy and does not affect the original flow. Unlike other options, Traffic Mirroring provides full packet capture (including headers and payloads) for forensic analysis, which is essential for investigating a compromise.

Answer

Enable VPC Flow Logs on the ENI and stream to Amazon S3 for analysis.

Answer

Attach a security group to the instance that logs all traffic to CloudWatch Logs.

Answer

Enable AWS Network Firewall on the VPC and configure a rule to log all traffic to the malicious IP.

Question 13

Refer to the exhibit. An administrator applies this bucket policy to an S3 bucket. Which of the following statements describes the effect of this policy?

Accepted Answer

The policy denies all PutObject requests that do not specify SSE-KMS.. The bucket policy contains two Deny statements: the first denies PutObject when the `x-amz-server-side-encryption` header is not `aws:kms`, and the second denies PutObject when the header is absent (null). Together, they ensure that any upload without SSE-KMS is denied, effectively requiring SSE-KMS for all PutObject requests. Options B, C, and D are incorrect because the policy does not allow any unencrypted uploads or uploads with SSE-S3; it only allows uploads with SSE-KMS.

Answer

The policy allows uploads without encryption but denies uploads with SSE-KMS.

Answer

The policy allows unencrypted uploads but denies uploads with SSE-KMS.

Answer

The policy allows uploads with SSE-S3 but denies uploads with SSE-KMS.

Question 14

A company wants to restrict access to an S3 bucket so that only objects with specific tags can be accessed by a certain IAM role. Which THREE steps are required to implement this?

Accepted Answer

Attach an IAM policy to the role that uses the s3:ExistingObjectTag condition.. To restrict the IAM role to only access objects with specific tags, three steps are necessary. First, attach an IAM policy to the role using the s3:ExistingObjectTag condition key (option C). This alone, however, can be overridden by a bucket policy that grants broader access. Second, create a bucket policy that explicitly allows the role to access objects only when they have the required tag (option D). Third, create a bucket policy that denies the role access to objects that do not have the required tag (option E). The combination of IAM and bucket policies ensures tag-based access control is enforced, as IAM provides identity-based restrictions and bucket policies add resource-based checks, including an explicit deny for non-compliant objects.

Answer

Use S3 Inventory to list objects and their tags.

Answer

Enable S3 object-level logging in CloudTrail.

Question 15

A security engineer is responsible for monitoring AWS account activity. The engineer needs to receive real-time notifications when specific API calls are made, such as 'DeleteTrail' or 'UpdateTrail'. The engineer wants to use AWS services to achieve this with minimal latency. Which combination of services should the engineer use?

Accepted Answer

CloudTrail -> CloudWatch Logs -> CloudWatch metric filter -> CloudWatch alarm -> Amazon SNS. The correct solution is to send CloudTrail logs to CloudWatch Logs, create a metric filter to match the specific API calls (e.g., 'DeleteTrail', 'UpdateTrail'), and set up a CloudWatch alarm on that metric that publishes to an SNS topic. This provides near-real-time alerts. Option D is correct. Option A is incorrect because while CloudTrail can send events to EventBridge, the event delivery is not as immediate as CloudWatch Logs metric filter approach for this use case. Option B is incorrect because S3 event notifications are for object-level events and not suitable for monitoring CloudTrail API calls. Option C is incorrect because CloudWatch Logs subscription filters are for streaming logs to other destinations, not for directly triggering alarms.

Answer

CloudTrail -> Amazon EventBridge -> Amazon SNS

Answer

CloudTrail -> Amazon S3 -> S3 event notification -> AWS Lambda -> Amazon SNS

Answer

CloudTrail -> CloudWatch Logs -> CloudWatch Logs subscription filter -> AWS Lambda -> Amazon SNS