SCS-C02 Practice Test 30 — 15 Questions

Question 1

A company is designing a network architecture for a multi-tier web application. The application consists of a public-facing ALB, web servers in private subnets, and an RDS database in isolated subnets. The security team requires that the web servers have no direct internet access. Which VPC configuration meets this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Private subnets with a NAT Gateway in a public subnet.. Placing web servers in private subnets with a NAT Gateway in a public subnet allows them to initiate outbound connections to the internet (e.g., for software updates) while preventing any inbound internet traffic from reaching them directly. The NAT Gateway translates private IPs to the public IP of the gateway, and the private subnets' route table points 0.0.0.0/0 to the NAT Gateway, not an Internet Gateway, ensuring no direct internet access.

Answer

Public subnets with an Internet Gateway.

Answer

Isolated subnets with no route to the internet.

Answer

Private subnets with a VPN connection to the corporate network.

Question 2

A security engineer notices that S3 server access logs are not being delivered to the specified destination bucket. The source bucket has a bucket policy that grants s3:PutObject permission to the Log Delivery group. The destination bucket is in the same AWS account but a different region. What is the most likely cause of the failure?

Accepted Answer

The destination bucket is in a different AWS region.. S3 server access logs are delivered by the Log Delivery group, which is a special AWS service principal. When the destination bucket is in a different AWS region, the Log Delivery group cannot write logs cross-region because S3 server access logging only supports delivering logs to a bucket in the same region as the source bucket. This is a hard limitation of the S3 service, not a permission or configuration issue.

Answer

The destination bucket does not have versioning enabled.

Answer

The destination bucket is in a different AWS account.

Answer

The Log Delivery group does not have an IAM role assigned.

Question 3

A security engineer is reviewing an IAM policy attached to a user. The policy is intended to allow all EC2 actions except deleting volumes in the Production environment. However, the user reports being able to delete volumes that are tagged with Environment=Production. What is the reason for this behavior?

Accepted Answer

The condition in the Deny statement uses StringNotEquals, which denies deletion for non-Production volumes, not Production volumes.. The Deny statement uses the StringNotEquals condition operator with ec2:ResourceTag/Environment=Production. This means the Deny applies when the tag value is NOT equal to Production, so it denies deletion for non-Production volumes but allows deletion for Production volumes. To deny deletion of Production volumes, the policy should use StringEquals instead of StringNotEquals.

Answer

The policy is not attached to the correct IAM entity.

Answer

The Deny statement should use iam:ResourceTag instead of ec2:ResourceTag.

Answer

The Allow statement uses a wildcard for the action, which overrides the Deny statement.

Question 4

A security engineer is investigating a potential security incident involving an EC2 instance. The engineer needs to determine if any unauthorized SSH keys were added to the instance's authorized_keys file. Which AWS service should be used to detect this change?

Accepted Answer

AWS Config. AWS Config is the correct service because it can be used to monitor configuration changes to EC2 instances, including changes to the authorized_keys file when integrated with AWS Systems Manager. While AWS Config does not natively track guest OS file changes, you can create a custom AWS Config rule that invokes a Lambda function to check the instance's Systems Manager inventory or run a command to verify the file contents. CloudTrail tracks API calls but does not monitor internal OS changes. Amazon Inspector and GuardDuty focus on vulnerabilities and threats, not configuration changes. Therefore, AWS Config, with appropriate custom rules, is the best choice among the options.

Answer

Amazon Inspector

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Question 5

A company has a security requirement to capture all DNS queries made by EC2 instances for threat analysis. Which AWS service can provide this capability with minimal configuration?

Accepted Answer

Amazon Route 53 Resolver DNS Firewall. Amazon Route 53 Resolver DNS Firewall can capture and log all DNS queries made by EC2 instances by enabling DNS query logging to Amazon S3 or CloudWatch Logs. This requires minimal configuration because it integrates directly with the VPC's DNS resolver, automatically capturing outbound DNS traffic without needing agents or changes to instance configurations.

Answer

VPC Flow Logs

Answer

Amazon Inspector

Answer

AWS CloudTrail

Question 6

A company has a security group that allows inbound SSH from a specific IP range. A security engineer notices that the security group rule is not being applied to a newly launched EC2 instance. What is the most likely cause?

Accepted Answer

The new EC2 instance was not launched with the correct security group. The most likely cause is that the new EC2 instance was not launched with the correct security group. Security groups act as virtual firewalls for instances, and an instance can only be associated with security groups at launch time. If the engineer launched the instance without explicitly selecting the security group that allows inbound SSH from the specific IP range, the instance would default to the VPC's default security group, which typically does not have the same custom SSH rule. This is a common operational oversight when automating or manually launching instances.

Answer

The security group is using the default VPC security group

Answer

The security group is configured as stateless

Answer

The network ACL is blocking SSH traffic to the subnet

Question 7

A security engineer needs to detect when an EC2 instance is terminated in an AWS account. The solution must provide near-real-time notification. Which combination of services should be used?

Accepted Answer

AWS CloudTrail and Amazon EventBridge. AWS CloudTrail captures API calls, including TerminateInstances, as management events. Amazon EventBridge can filter these events in near real-time and trigger a notification action (e.g., via SNS or Lambda). This combination provides immediate detection of EC2 termination without polling or delays.

Answer

VPC Flow Logs and Amazon CloudWatch Logs

Answer

AWS Config and Amazon SNS

Answer

Amazon CloudWatch Alarms and Amazon SNS

Question 8

Refer to the exhibit. A security engineer has attached this IAM policy to a user. What is the effect of this policy?

Accepted Answer

Allows uploads with KMS encryption or without encryption.. The IAM policy uses a `Deny` effect with a `NotPrincipal` condition that denies uploads unless the request includes the `s3:x-amz-server-side-encryption` header with value `aws:kms`. However, the `Condition` block uses `StringNotEquals`, which means any request that does NOT have the encryption header set to `aws:kms` is denied. This effectively allows uploads with KMS encryption (header matches) or without encryption (no header present, because `StringNotEquals` does not match a missing header — the condition evaluates to false, so the Deny does not apply). Therefore, uploads without encryption are allowed by default (since there is no explicit Allow), and uploads with KMS encryption are also allowed.

Answer

Allows uploads only when encryption is not specified.

Answer

Denies uploads when encryption is not provided.

Answer

Allows uploads only when using KMS encryption.

Question 9

Drag and drop the steps to set up AWS Shield Advanced with automatic application layer DDoS mitigation in the correct order.

Accepted Answer

Step 1: Subscribe to AWS Shield Advanced. Step 2: Add protection to AWS resources. Step 3: Integrate with AWS WAF and create a mitigation rule. Step 4: Enable health-based detection.. Shield Advanced requires subscription first, then resource protection, WAF integration, mitigation rule, and health-based detection.

Answer

Step 1: Add protection to AWS resources. Step 2: Subscribe to AWS Shield Advanced. Step 3: Integrate with AWS WAF and create a mitigation rule. Step 4: Enable health-based detection.

Answer

Step 1: Subscribe to AWS Shield Advanced. Step 2: Integrate with AWS WAF and create a mitigation rule. Step 3: Add protection to AWS resources. Step 4: Enable health-based detection.

Answer

Step 1: Subscribe to AWS Shield Advanced. Step 2: Add protection to AWS resources. Step 3: Enable health-based detection. Step 4: Integrate with AWS WAF and create a mitigation rule.

Question 10

A company's security team discovers that an Amazon EC2 instance has been compromised and is sending outbound traffic to a known malicious IP address. The instance is in a VPC with a security group that allows all outbound traffic. What is the FASTEST way to stop the outbound traffic without affecting other instances?

Accepted Answer

Modify the security group attached to the instance to revoke all outbound rules.. Security groups are stateful and act as a virtual firewall at the instance level. By revoking all outbound rules in the security group attached to the compromised EC2 instance, you immediately block all outbound traffic from that specific instance without affecting any other instances in the VPC. This is the fastest and most targeted action because it requires no changes to subnet-level configurations or instance termination.

Answer

Modify the network ACL of the subnet to deny outbound traffic to the malicious IP.

Answer

Change the route table of the subnet to route traffic to a blackhole.

Answer

Terminate the compromised EC2 instance immediately.

Question 11

A company uses AWS Organizations with multiple accounts. The security team wants to centrally collect and analyze VPC Flow Logs from all accounts. The team has set up a central logging account with an S3 bucket that has a bucket policy allowing cross-account writes. However, VPC Flow Logs from member accounts are not appearing. What is the most likely cause?

Accepted Answer

VPC Flow Logs cannot be published directly to an S3 bucket in a different account. The logs must be published to a bucket in the same account as the VPC, and then replicated to the central account.. VPC Flow Logs cannot be published directly to an S3 bucket in a different AWS account. The destination S3 bucket must reside in the same account as the VPC from which the logs are generated. To centralize logs, you must first publish them to a bucket in the same account as the VPC, then use S3 cross-region replication or a similar mechanism to copy them to the central logging account. This is a fundamental limitation of the VPC Flow Logs service.

Answer

AWS CloudTrail is not enabled in the member accounts.

Answer

The VPC Flow Logs must be delivered to CloudWatch Logs first, then exported to S3.

Answer

The S3 bucket policy does not allow the s3:PutObject action for the member accounts.

Question 12

An organization has a multi-account AWS environment using AWS Organizations. The security team needs to ensure that no Amazon EC2 instances are launched without an IAM instance profile that includes a specific role. Which preventive control should be implemented?

Accepted Answer

Create an SCP that denies ec2:RunInstances when the condition iam:InstanceProfile is not set to the required profile ARN.. AWS Organizations Service Control Policies (SCPs) can be applied to all accounts in the organization to prevent actions across all principals. By using the `iam:InstanceProfile` condition key with the `ec2:RunInstances` action, the SCP denies the launch of any EC2 instance that does not have the required IAM instance profile attached. This is a preventive control that blocks the action before it occurs, ensuring compliance across the entire multi-account environment.

Answer

Attach an IAM policy to all users that denies ec2:RunInstances unless an instance profile is specified.

Answer

Create an SCP that denies ec2:RunInstances when the condition ec2:InstanceProfile is not set.

Answer

Use AWS Config rule ec2-instance-profile-attached to detect non-compliant instances and automatically terminate them.

Question 13

A security team needs to detect unauthorized API calls made from a compromised IAM user. Which AWS service should be used to monitor and alert on specific API activities?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to the AWS environment, including those from IAM users, and delivers event history for auditing. By enabling CloudTrail trails with management event logging and configuring Amazon CloudWatch alarms or EventBridge rules on specific API actions (e.g., `iam:CreateUser`, `ec2:AuthorizeSecurityGroupIngress`), the security team can detect and alert on unauthorized API activities from a compromised IAM user.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

VPC Flow Logs

Question 14

A company wants to encrypt data stored in Amazon S3 using server-side encryption with customer-provided keys (SSE-C). Which statement is correct regarding SSE-C?

Accepted Answer

The customer provides the encryption key in each request to S3.. SSE-C requires the customer to provide the encryption key and its MD5 digest in every PUT or GET request to Amazon S3. S3 uses the key to encrypt the object at rest and then discards the key; it is never stored by AWS. This ensures the customer retains full control over the encryption key material.

Answer

AWS manages the encryption keys.

Answer

The same encryption key is used for all objects in the bucket.

Answer

The encryption key is stored in AWS KMS.

Question 15

A security engineer is configuring Amazon Inspector to assess EC2 instances for software vulnerabilities. The engineer has installed the SSM Agent on all instances and ensured that the instances have internet access. However, Amazon Inspector shows the instances as 'Unmanaged'. What is the MOST likely cause?

Accepted Answer

The SSM Agent is not running or is not registered with AWS Systems Manager.. Amazon Inspector requires EC2 instances to be managed by AWS Systems Manager (SSM) to install the SSM Agent and register it with the Systems Manager service. If the SSM Agent is not running or not registered, the instance cannot communicate with Systems Manager, and Inspector will report it as 'Unmanaged'. Even with internet access and the agent installed, the agent must be actively running and registered for the instance to be properly managed.

Answer

The IAM role attached to the EC2 instance does not have permissions to publish metrics to CloudWatch.

Answer

The security group attached to the instance blocks outbound traffic to the Amazon Inspector service.

Answer

The instance does not have the EC2 instance metadata service enabled.