SCS-C02 Practice Test 27 — 15 Questions

Question 1

Drag and drop the steps to configure AWS WAF with rate-based rules in the correct order.

Accepted Answer

Create a web ACL, then add a rate-based rule to it, then associate the web ACL with an AWS resource, then test the rate-based rule, then monitor metrics and adjust thresholds.. Rate-based rules require creating a web ACL first, then adding the rule, associating with a resource, testing, and monitoring.

Answer

Add a rate-based rule to a web ACL first, then create the web ACL, then associate with a resource, then test, then monitor.

Answer

Create a web ACL, then associate it with a resource, then add a rate-based rule, then test, then monitor.

Answer

Create a web ACL, then add a rate-based rule, then test the rule, then associate the ACL with a resource, then monitor.

Question 2

A security engineer needs to ensure that all API calls made to AWS are logged and retained for at least 7 years for compliance. Which AWS service should be enabled to meet this requirement?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to AWS, including the identity of the caller, the time of the call, the source IP address, and the request parameters. CloudTrail logs can be stored in an S3 bucket with lifecycle policies to retain logs for exactly 7 years, meeting the compliance requirement for long-term retention.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

Amazon Inspector

Question 3

A company wants to allow users from its corporate Active Directory to access AWS resources. The company has set up an IAM identity provider for SAML. What must be created in IAM to map users to permissions?

Accepted Answer

An IAM role with a trust policy for the SAML provider. A is correct because when using SAML-based federation, IAM roles are the mechanism to grant permissions to federated users. The role must have a trust policy that specifies the SAML identity provider as the principal, allowing users authenticated by the corporate Active Directory to assume the role and obtain temporary AWS credentials. This maps the SAML assertion attributes (such as the user's group or role) to IAM permissions via the role's permissions policy.

Answer

An OIDC identity provider

Answer

An IAM user for each Active Directory user

Answer

A federation role type

Question 4

A company wants to encrypt data at rest for an Amazon S3 bucket. Which action should be taken?

Accepted Answer

Enable default encryption on the S3 bucket.. Enabling default encryption on the S3 bucket ensures that all objects stored in the bucket are automatically encrypted at rest using server-side encryption (SSE-S3, SSE-KMS, or SSE-C). This meets the requirement for encrypting data at rest without requiring any client-side changes, as the encryption is applied by S3 upon write.

Answer

Use client-side encryption before uploading objects.

Answer

Enable SSL/TLS for the bucket.

Answer

Use AWS CloudHSM to encrypt the bucket.

Question 5

A security engineer is configuring automated incident response for Amazon GuardDuty findings. The engineer wants to isolate a compromised EC2 instance by changing its security group and stopping the instance. Which THREE services should the engineer use together to achieve this? (Choose THREE.)

Accepted Answer

AWS Systems Manager. AWS Systems Manager (SSM) is correct because it provides the Automation runbook capability that can be used to stop an EC2 instance and modify its security groups as part of an incident response workflow. SSM Automation can be triggered by an EventBridge rule and can invoke Lambda functions or run commands directly on the instance to isolate it. This allows the security engineer to automate the isolation and stopping of the compromised instance without manual intervention.

Answer

Amazon EC2

Answer

AWS Config

Question 6

A company is running a critical application on EC2 instances behind an Application Load Balancer. The security team wants to ensure that only traffic from the ALB reaches the EC2 instances. How can this be achieved?

Accepted Answer

Reference the ALB's security group in the EC2 security group inbound rule.. You can reference the ALB's security group as the source in the EC2 instance's security group inbound rule. This allows traffic only from the ALB, regardless of the ALB's IP addresses (which can change if the ALB scales). The security group reference is resolved dynamically by AWS, ensuring that only traffic originating from the ALB's elastic network interfaces (ENIs) is permitted.

Answer

Use the ALB's private IP address in the EC2 security group.

Answer

Configure a Network ACL to allow only the ALB's subnet.

Answer

Use the ALB's public IP address in the EC2 security group.

Question 7

Drag and drop the steps to set up a secure S3 bucket with encryption and access control in the correct order.

Accepted Answer

Enable default encryption → Block public access → Attach bucket policy → Enable versioning → Enable access logging. Secure S3 bucket requires encryption, public access block, bucket policy, versioning, and access logging.

Answer

Block public access → Enable default encryption → Attach bucket policy → Enable versioning → Enable access logging

Answer

Enable default encryption → Block public access → Enable versioning → Attach bucket policy → Enable access logging

Answer

Enable default encryption → Enable versioning → Block public access → Attach bucket policy → Enable access logging

Question 8

A company uses Amazon S3 to store confidential documents. The security team wants to ensure that all objects are encrypted at rest using server-side encryption with AES-256. Which S3 encryption option should be used?

Accepted Answer

SSE-S3. SSE-S3 applies server-side encryption with AES-256 using keys fully managed by Amazon S3, meeting the requirement for AES-256 encryption at rest without customer key management overhead. It is the default and simplest S3-managed encryption option, automatically encrypting every object with strong AES-256 and requiring no additional configuration or key infrastructure. This directly satisfies the stated requirement.

Answer

SSE-C

Answer

SSE-KMS

Answer

Client-side encryption

Question 9

An organization wants to enforce multi-factor authentication (MFA) for all IAM users accessing the AWS Management Console. Which policy should be used?

Accepted Answer

A policy that denies all actions unless aws:MultiFactorAuthPresent is true.. It uses an IAM policy with a Deny effect on all actions when `aws:MultiFactorAuthPresent` is false (or not true). This ensures that any IAM user attempting to perform any action, including ConsoleLogin, must have authenticated with MFA; otherwise, the request is denied. This is the standard approach to enforce MFA for all AWS Management Console access.

Answer

A policy that allows all actions and denies when aws:MultiFactorAuthPresent is true.

Answer

A policy that allows all actions except ConsoleLogin unless MFA is present.

Answer

A policy that allows all actions when aws:MultiFactorAuthPresent is true.

Question 10

Refer to the exhibit. An IAM policy is attached to an IAM user. The user reports that they can upload objects to the S3 bucket but cannot list the contents of the bucket. Which statement explains this behavior?

Accepted Answer

The policy does not include the s3:ListBucket action.. The IAM policy grants the s3:PutObject action, which allows the user to upload objects, but it does not include the s3:ListBucket action. The s3:ListBucket action is required to list the contents of an S3 bucket (e.g., via the ListObjects API call). Without this permission, the user can upload but cannot see the bucket's object listing.

Answer

The policy includes s3:ListBucket but is missing the bucket ARN.

Answer

The policy denies the s3:ListBucket action.

Answer

The policy explicitly denies s3:ListBucket.

Question 11

A company's security team is implementing controls to meet PCI DSS compliance. The environment includes Amazon EC2, RDS, and S3. Which THREE controls should be implemented to address logging and monitoring requirements?

Accepted Answer

Enable AWS Config to track resource configuration changes.. AWS Config is correct because it tracks resource configuration changes and records them as configuration items, which is essential for PCI DSS Requirement 10.5.2 that mandates logging of all actions taken by any individual with root or administrative privileges. By monitoring changes to EC2, RDS, and S3 configurations, AWS Config provides an audit trail of who made changes, what changed, and when, directly supporting logging and monitoring compliance.

Answer

Deploy Amazon CloudWatch Application Insights.

Answer

Enable detailed billing reports.

Question 12

A company wants to allow a user to assume a role in another AWS account to access resources. Which AWS service should be used to create and manage the trust relationship between the accounts?

Accepted Answer

IAM roles with a trust policy that allows the external account.. IAM roles with a trust policy that explicitly allows the external AWS account to assume the role is the correct mechanism for establishing a cross-account trust relationship. The trust policy defines which principal (the external account) is allowed to assume the role, and the permissions policy attached to the role controls what actions the assumed role can perform. This is the foundational AWS service for delegating access across accounts.

Answer

AWS Security Token Service (STS) to generate tokens.

Answer

IAM users in the source account with cross-account permissions.

Answer

AWS Organizations service control policies.

Question 13

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. The security team wants to inspect all traffic between VPCs before it reaches its destination. Which architecture should be used?

Accepted Answer

Use a Transit Gateway with a central inspection VPC that hosts security appliances and route all inter-VPC traffic through it.. AWS Transit Gateway can route inter-VPC traffic through a central inspection VPC that hosts security appliances (e.g., firewalls, IDS/IPS). By attaching the Transit Gateway to the inspection VPC and configuring route tables to force all traffic between VPCs to pass through the inspection VPC, the security team can inspect all traffic before it reaches its destination. This architecture provides centralized, scalable traffic inspection without requiring traffic to leave the AWS network.

Answer

Use a VPN CloudHub to connect VPCs and inspect traffic at the VPN endpoint.

Answer

Use AWS Direct Connect to connect VPCs and inspect traffic on-premises.

Answer

Use VPC Peering and configure security groups on each VPC to allow only necessary traffic.

Question 14

A company uses AWS Config to track resource changes. They notice that a weekly compliance report shows an S3 bucket as non-compliant with a rule that checks for server-side encryption. However, the bucket has default encryption enabled. What is the MOST likely reason for this discrepancy?

Accepted Answer

The Config rule checks for SSE on objects, not default bucket encryption.. The AWS Config managed rule `s3-bucket-server-side-encryption-enabled` specifically checks whether the bucket policy enforces server-side encryption on objects uploaded to the bucket, not whether the bucket has default encryption configured. Default encryption only applies to objects that do not have an encryption setting at the time of upload, but the rule evaluates the bucket's policy for a condition that requires SSE for all PUT requests. Therefore, a bucket with default encryption enabled but without a policy enforcing SSE will be reported as non-compliant.

Answer

The Config rule was deleted and recreated without re-evaluating existing resources.

Answer

The Config rule is only evaluating resources in a single AWS Region.

Answer

The S3 bucket is not tagged with a required tag for the Config rule.

Question 15

A company has an AWS Lambda function that processes sensitive data. The security team wants to ensure that any errors or suspicious behavior are immediately investigated. Which combination of services should be used to send real-time notifications for anomalous function executions?

Accepted Answer

CloudWatch Logs and SNS. CloudWatch Logs can capture Lambda function execution logs, and a CloudWatch Logs metric filter can be configured to detect patterns indicative of errors or suspicious behavior (e.g., 'ERROR', 'Exception', or custom anomaly patterns). When the metric filter triggers a CloudWatch alarm, it can publish a message directly to an Amazon SNS topic, which then sends real-time notifications (e.g., email, SMS, or HTTP endpoint) to the security team for immediate investigation.

Answer

CloudTrail and SNS

Answer

AWS Config and SQS

Answer

Amazon Detective and SES