SCS-C02 Practice Test 29 — 15 Questions

Question 1

A security engineer is investigating a potential data exfiltration incident. They see that an EC2 instance with an IAM role is making API calls to S3 to download objects. The IAM role has an S3 bucket policy that allows access from that role. However, CloudTrail logs show that the calls are being made from an IP address outside the company's network. What is the most likely explanation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The IAM role credentials were stolen and are being used from an external machine.. The CloudTrail logs show the API calls originating from an IP address outside the company's network, which indicates that the IAM role credentials (temporary security credentials from the instance metadata) have been compromised and are being used from an external machine. The S3 bucket policy allows access from the IAM role, but the source IP in the logs is external, confirming the credentials are being used outside the EC2 instance.

Answer

The EC2 instance has a public IP and the calls are originating from the instance itself.

Answer

CloudTrail is logging the IP address of the AWS service endpoint, not the client.

Answer

The S3 bucket policy allows public access.

Question 2

A company is experiencing unauthorized access attempts to an S3 bucket. Which AWS service can be used to detect and alert on such events in real time?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior across AWS accounts and workloads. It uses machine learning, anomaly detection, and integrated threat intelligence to analyze AWS CloudTrail management and data events, VPC Flow Logs, and DNS logs. When it detects unauthorized access attempts to an S3 bucket, such as suspicious API calls or anomalous data access patterns, it generates real-time security findings that can be sent to Amazon CloudWatch Events for alerting and automated response.

Answer

Amazon Macie

Answer

AWS Config

Answer

AWS CloudTrail

Question 3

A company uses AWS Organizations with multiple accounts and has enabled AWS Security Hub in the management account. The security team wants to automatically remediate a specific finding type that appears in Security Hub. Which combination of services should be used to achieve this?

Accepted Answer

Amazon EventBridge and AWS Lambda. Amazon EventBridge can capture Security Hub findings as events using an event rule that matches the specific finding type. When the rule triggers, it invokes an AWS Lambda function that contains the remediation logic, such as modifying security group rules or disabling access keys. This combination provides a serverless, event-driven architecture for automated response to Security Hub findings.

Answer

AWS Config conformance packs and AWS Systems Manager Automation

Answer

Amazon Inspector and AWS Step Functions

Answer

Amazon GuardDuty and AWS Lambda

Question 4

A company wants to receive an alert when an IAM user creates a new access key. Which AWS service should be used to trigger the alert?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Events. AWS CloudTrail captures API calls made by or on behalf of an IAM user, including CreateAccessKey events. These events can be sent to Amazon CloudWatch Events (now part of Amazon EventBridge) using a rule that matches the specific API call, which then triggers an alert (e.g., via SNS or Lambda). This combination enables real-time monitoring and notification for security-sensitive actions like access key creation.

Answer

Amazon CloudWatch Logs

Answer

Amazon GuardDuty

Answer

AWS Config

Question 5

A company has a multi-account strategy and wants to ensure that all API calls from member accounts are logged to a centralized S3 bucket in the security account. Which configuration is required?

Accepted Answer

Create an organization trail in the management account that logs all accounts. AWS Organizations allows you to create an organization trail in the management account that automatically applies to all member accounts. This ensures that CloudTrail logs from every account in the organization are delivered to a single, centralized S3 bucket in the security account without needing per-account configuration. The organization trail uses the management account’s CloudTrail configuration to enable logging across the entire organization, and the S3 bucket policy must grant the necessary permissions for CloudTrail to write logs from all accounts.

Answer

Use Amazon Kinesis Data Streams to stream CloudTrail events from all accounts to the central S3 bucket

Answer

Create a CloudTrail trail in each member account and specify the same S3 bucket

Answer

Enable AWS Security Hub in the security account and configure it to collect CloudTrail logs

Question 6

A company wants to allow a Lambda function to read objects from an S3 bucket in the same account. What should be done?

Accepted Answer

Create an IAM role with an S3 read policy and attach it to the Lambda function.. Lambda functions require an IAM role (execution role) to obtain temporary AWS credentials via the AWS Security Token Service (STS). Attaching a policy with s3:GetObject permissions to this role grants the Lambda function the necessary access to read objects from the S3 bucket without hardcoding long-term credentials.

Answer

Store IAM user access keys in the Lambda function's environment variables.

Answer

Add a bucket policy allowing s3:GetObject for the Lambda service principal.

Answer

Configure the S3 bucket to be public.

Question 7

Which IAM entity can be used to grant temporary access to AWS resources for users from a different AWS account?

Accepted Answer

IAM role. An IAM role is the correct entity because it is specifically designed to grant temporary, cross-account access to AWS resources. When a user from a different AWS account assumes a role, AWS STS (Security Token Service) issues temporary security credentials (access key, secret key, and session token) that are valid for a configurable duration (default 1 hour, max 12 hours). This avoids the need to create permanent IAM users or share long-term credentials across accounts.

Answer

IAM group

Answer

IAM policy

Answer

IAM user

Question 8

A security engineer needs to ensure that any changes to an S3 bucket's public access settings are immediately detected and an alert is sent. Which combination of AWS services should be used?

Accepted Answer

AWS Config and AWS Lambda. AWS Config continuously monitors and records changes to AWS resource configurations, including S3 bucket public access settings. By creating a Config rule that triggers on changes to the `PublicAccessBlockConfiguration` or bucket ACLs, you can invoke an AWS Lambda function via an Amazon SNS topic to send an alert. This combination provides real-time detection and automated response to unauthorized public access changes.

Answer

Amazon GuardDuty and AWS Lambda

Answer

Amazon CloudWatch Logs and Amazon SNS

Answer

AWS CloudTrail and Amazon CloudWatch Logs

Question 9

A company wants to centrally manage IAM users and allow them to access multiple AWS accounts using a single set of credentials. Which AWS service should be used?

Accepted Answer

AWS IAM Identity Center (AWS SSO). AWS IAM Identity Center (formerly AWS SSO) is the correct service because it provides a centralized identity source that allows users to sign in once with a single set of credentials and then access multiple AWS accounts and business applications. It integrates with AWS Organizations to automatically manage permissions across accounts, eliminating the need for separate IAM users in each account.

Answer

IAM roles with cross-account trust

Answer

AWS Organizations consolidated billing

Answer

Amazon Cognito user pools

Question 10

A company uses AWS CloudTrail to log all API calls. The security team notices that some PutObject API calls are not appearing in the CloudTrail logs. The S3 bucket in question has server access logging enabled. What is the MOST likely reason for the missing CloudTrail events?

Accepted Answer

CloudTrail was not configured to log data events for S3.. CloudTrail logs are categorized into management events and data events. By default, CloudTrail only logs management events (e.g., CreateBucket, DeleteBucket). Data events, such as S3 object-level operations like PutObject, must be explicitly enabled in the CloudTrail trail configuration. Since the security team sees missing PutObject calls, the most likely cause is that CloudTrail was not configured to log S3 data events.

Answer

Server access logs are interfering with CloudTrail.

Answer

The PutObject calls were made via the AWS Management Console.

Answer

The S3 bucket policy denies CloudTrail from logging.

Question 11

A company uses Amazon S3 to store sensitive data. The security team wants to detect and alert on public read access to S3 buckets. Which combination of AWS services is MOST appropriate?

Accepted Answer

Amazon Macie with automated discovery jobs and Amazon CloudWatch Events to send alerts.. Amazon Macie is purpose-built for discovering and protecting sensitive data in S3, and its automated discovery jobs can detect public read access to buckets. By integrating with Amazon CloudWatch Events, Macie can trigger alerts in real-time when such access is identified, making it the most appropriate choice for this detection and alerting requirement.

Answer

AWS CloudTrail and Amazon CloudWatch Logs with metric filters for `PutBucketPolicy` events.

Answer

Amazon GuardDuty and AWS Lambda.

Answer

AWS Config with managed rules like `s3-bucket-public-read-prohibited` and Amazon SNS.

Question 12

A company has an S3 bucket that contains sensitive data. The security team wants to ensure that all access to the bucket is encrypted in transit. Which policy should be attached to the bucket to enforce this?

Accepted Answer

Attach a bucket policy that denies requests when aws:SecureTransport is false.. The `aws:SecureTransport` condition key in an S3 bucket policy evaluates whether the request was sent over HTTPS (TLS). By attaching a bucket policy that denies access when `aws:SecureTransport` is false, the security team enforces that all access to the bucket must be encrypted in transit, blocking any HTTP requests.

Answer

Configure a bucket policy that denies requests that do not include the x-amz-server-side-encryption header.

Answer

Enable default encryption on the bucket using SSE-S3.

Answer

Use Amazon CloudFront to serve the content and require HTTPS.

Question 13

A company is using Amazon Route 53 and wants to log DNS queries for investigative purposes. The logs must be stored in a centralized S3 bucket in the security account. What is the MOST efficient way to achieve this?

Accepted Answer

Configure Route 53 Resolver query logging to deliver to the central S3 bucket.. Route 53 Resolver query logging natively supports delivering DNS query logs directly to an S3 bucket, including cross-account S3 buckets, without requiring any intermediate services. This is the most efficient method because it eliminates the need for additional compute resources or manual polling, and it directly satisfies the requirement for centralized logging in the security account.

Answer

Enable VPC Flow Logs and analyze DNS traffic.

Answer

Enable CloudWatch Logs for Route 53 and stream to a Lambda function that writes to S3.

Answer

Use a custom Lambda function to poll Route 53 logs and write to S3.

Question 14

A company wants to restrict access to an S3 bucket so that only requests from a specific VPC are allowed. Which policy should be used?

Accepted Answer

S3 bucket policy with aws:SourceVpc condition. S3 bucket policies support the `aws:SourceVpc` condition key, which allows you to restrict access to requests originating from a specific VPC. This works by evaluating the VPC ID from which the request was made, using the source VPC information that AWS automatically includes in requests from VPC endpoints. No other mechanism (security groups, IAM source IP conditions, or network ACLs) can directly enforce VPC-level access control on S3.

Answer

Security group assigned to the S3 bucket

Answer

IAM policy with aws:SourceIp condition

Answer

Network ACL attached to the S3 bucket

Question 15

During an incident investigation, a security analyst finds that an IAM user 'JohnDoe' has been using an access key that was last rotated over 2 years ago. The analyst needs to determine if this key has been compromised. Which approach provides the MOST definitive evidence?

Accepted Answer

Use AWS CloudTrail LookupEvents to find API calls made by the key, focusing on unusual IP addresses or times. AWS CloudTrail LookupEvents allows you to filter API calls by user identity (such as the access key ID) and examine attributes like source IP address, user agent, and timestamp. Unusual IP addresses or times of day are strong indicators of compromise, as they suggest the key is being used from locations or at hours inconsistent with the legitimate user's behavior. This provides the most definitive evidence because it directly correlates the key's usage with anomalous patterns, rather than relying on indirect indicators like data downloads or permission changes.

Answer

Check the S3 access logs to see if the key was used to download sensitive data

Answer

Review the IAM password policy to see if the key was created before the current policy

Answer

Use AWS Config to see if the key's permissions have changed