SCS-C02 Practice Test 3 — 30 Questions

Question 1

A company is using Amazon CloudWatch Logs to store application logs. The security team needs to retain logs for 7 years to comply with regulatory requirements. The logs are accessed infrequently after the first 90 days. What is the MOST cost-effective way to meet these retention and access requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Export logs from CloudWatch Logs to an S3 bucket, then use S3 Lifecycle policies to transition logs to S3 Glacier Deep Archive after 90 days.. Exporting logs from CloudWatch Logs to Amazon S3 and using S3 Lifecycle policies to transition them to S3 Glacier Deep Archive after 90 days is the most cost-effective solution. CloudWatch Logs storage costs are higher than S3, and Glacier Deep Archive offers the lowest storage cost for infrequently accessed data that must be retained for 7 years. This approach meets the retention requirement while minimizing costs for logs that are rarely accessed after the initial 90-day period.

Answer

Stream logs to an S3 bucket using Kinesis, then use S3 Lifecycle policies to transition logs to S3 Standard-IA after 90 days.

Answer

Set a retention policy on the CloudWatch Logs log group to 7 years and use CloudWatch Logs Insights for queries.

Answer

Set a retention policy on the CloudWatch Logs log group to 7 years and use CloudWatch Logs lifecycle policies to transition to Amazon S3 Glacier.

Question 2

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The security team wants to inspect all traffic between VPCs using a third-party firewall appliance. Which architecture should be used?

Accepted Answer

Use Transit Gateway with appliance mode and route tables to direct traffic through a firewall appliance in a central VPC.. Transit Gateway with appliance mode enables the firewall appliance in a central VPC to receive traffic from all attached VPCs with symmetric routing, ensuring that both forward and return traffic flows through the same appliance. By configuring route tables to direct inter-VPC traffic to the firewall appliance's elastic network interface (ENI), the security team can inspect all traffic without requiring complex peering or on-premises backhauling.

Answer

Set up AWS Direct Connect and route all traffic through the on-premises firewall.

Answer

Create VPC peering connections between each VPC and the firewall VPC.

Answer

Configure network ACLs in each VPC to block traffic unless it comes from the firewall.

Question 3

During a security review, a security engineer notices that an S3 bucket contains sensitive data but has a bucket policy that allows access from any principal in the account. The engineer needs to identify any unintended cross-account access to this bucket. Which AWS service should be used?

Accepted Answer

AWS IAM Access Analyzer. AWS IAM Access Analyzer helps identify resources that are shared with external principals by analyzing resource-based policies (like S3 bucket policies). In this scenario, the bucket policy allows access from any principal in the account, but IAM Access Analyzer can detect if the policy also grants access to principals outside the AWS account (cross-account access). It generates findings for any policy that allows access from an external entity, making it the correct service to identify unintended cross-account access.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

Amazon Macie

Question 4

A company uses Amazon S3 to store sensitive data. The security team needs to be alerted when an S3 bucket policy is changed to allow public access. Which combination of services should be used to meet this requirement?

Accepted Answer

AWS Config with AWS Lambda and Amazon Simple Notification Service (SNS). AWS Config can monitor S3 bucket policies for changes that grant public access using a managed rule like 's3-bucket-public-read-prohibited' or a custom Lambda function. When a noncompliant change is detected, AWS Config can invoke an AWS Lambda function to evaluate the policy and publish a notification to Amazon SNS, alerting the security team. This combination provides real-time, policy-driven monitoring and alerting for public access changes.

Answer

AWS CloudTrail and Amazon Simple Notification Service (SNS)

Answer

S3 server access logs and Amazon Athena

Answer

AWS Trusted Advisor and Amazon Simple Notification Service (SNS)

Question 5

An organization uses AWS Organizations and wants to centrally manage Amazon GuardDuty across multiple accounts. What is the correct architecture?

Accepted Answer

Designate a delegated administrator account in Organizations and enable GuardDuty in that account.. AWS Organizations allows you to designate a delegated administrator account for Amazon GuardDuty, which can then centrally manage GuardDuty across all member accounts in the organization. This architecture simplifies enabling GuardDuty and managing findings without needing to configure each account individually, as the delegated administrator can enable GuardDuty for all accounts in the organization from a single point.

Answer

Enable GuardDuty only in the master account; it will automatically monitor all member accounts.

Answer

Use AWS CloudFormation StackSets to deploy GuardDuty in all accounts and regions.

Answer

Enable GuardDuty in each region separately and use cross-region aggregation.

Question 6

A security engineer is designing a VPC with public and private subnets. The private subnets will host databases that should not have direct internet access. Which three components are required to provide outbound internet access for these databases? (Choose THREE.)

Accepted Answer

An internet gateway attached to the VPC.. An internet gateway (IGW) is required to enable outbound internet access for resources in a VPC. The NAT gateway, which resides in a public subnet, uses the IGW to translate private IP addresses to the public IP of the NAT gateway, allowing instances in private subnets to initiate outbound traffic to the internet while preventing inbound connections from the internet.

Answer

AWS WAF attached to the NAT gateway.

Answer

A VPC gateway endpoint for S3.

Question 7

During an incident response, a security engineer needs to preserve the state of an EC2 instance's root volume for forensic analysis. The instance is still running. Which action should be taken to ensure the data is preserved without altering it?

Accepted Answer

Create a snapshot of the root volume.. Creating a snapshot of the root volume is the correct action because it captures a point-in-time, crash-consistent copy of the volume's data without requiring the instance to be stopped or the volume to be detached. This preserves the current state of the running instance for forensic analysis while ensuring the data is not altered by the snapshot process itself, as AWS snapshots are read-only and do not modify the source volume.

Answer

Stop the instance and then create an AMI.

Answer

Use dd if=/dev/xvda over SSH to copy the volume.

Answer

Detach the root volume and attach it to a forensics instance.

Question 8

A security engineer needs to automatically detect and respond to unauthorized API calls in an AWS account. Which two services should be used together?

Accepted Answer

AWS CloudTrail and Amazon EventBridge. CloudTrail logs API calls, and Amazon EventBridge can trigger automated responses based on those logs. Option A is correct. Option B (GuardDuty + SNS) provides threat detection alerts but not automated response. Option C (Config + Lambda) is for configuration compliance, not API call detection. Option D (Inspector + S3) is for vulnerability assessment, not API monitoring.

Answer

Amazon GuardDuty and Amazon SNS

Answer

AWS Config and AWS Lambda

Answer

Amazon Inspector and Amazon S3

Question 9

A security engineer runs the above AWS CLI command. The engineer notices that the security group has no outbound rules. What is the implication of this configuration?

Accepted Answer

The EC2 instances in this security group cannot initiate outbound connections. A security group without outbound rules will block all outbound traffic by default (since security groups are stateful and default deny egress). Option B is wrong because security groups are stateful; the inbound rule allows return traffic. Option C is wrong because the inbound rule allows HTTP from anywhere, but outbound is missing. Option D is wrong because the security group does allow inbound HTTP.

Answer

The EC2 instances cannot receive inbound HTTP traffic

Answer

The security group allows all outbound traffic by default

Answer

Outbound traffic is allowed because security groups are stateful

Question 10

A company is implementing a security monitoring solution for its AWS environment. Which TWO services can be used to detect and alert on suspicious API activity? (Choose TWO.)

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious or unauthorized behavior, including suspicious API activity. It analyzes AWS CloudTrail management and data events, VPC Flow Logs, and DNS logs to generate security findings and alerts. GuardDuty uses machine learning and anomaly detection to identify patterns such as unusual API calls, credential compromise, or reconnaissance attempts, making it a correct choice for detecting and alerting on suspicious API activity.

Answer

Amazon Inspector

Answer

AWS Config

Answer

VPC Flow Logs

Question 11

A company is designing a secure data sharing solution with a third party. The company needs to share sensitive files stored in an S3 bucket with the third party, ensuring that the files are encrypted at rest and in transit, and that the third party can only access specific files. The company also wants to rotate the access credentials every 30 days. Which TWO actions should the company take? (Select TWO.)

Accepted Answer

Configure an S3 bucket policy that denies access unless the request includes a specific KMS key ID.. Options C and E are correct. Option C uses an S3 bucket policy with a condition requiring requests to include a specific KMS key ID, ensuring that only requests using that key can access the objects. This enforces encryption at rest (objects encrypted with that key) and in transit (HTTPS with KMS). Option E grants the third party's AWS account permission to use that KMS key for decrypt operations, allowing them to decrypt the files. Together, they provide encryption key control and the ability to rotate the key or its policy every 30 days. Option A (cross-account IAM role) does not enforce encryption key control and requires the third party to assume a role, but credential rotation is managed via role trust policy, not directly. Option B (S3 Cross-Region Replication) replicates objects but does not enforce key-specific access or encryption at rest in the destination. Option D (presigned URLs) provides time-limited access but does not enforce encryption key control and cannot be easily rotated every 30 days without regenerating URLs.

Answer

Create an IAM role in the company's account that the third party can assume, and attach a policy that grants access to the specific files.

Answer

Use S3 Cross-Region Replication to replicate the files to a bucket in the third party's account.

Answer

Generate presigned URLs for the specific files and email them to the third party.

Question 12

A company is using AWS Organizations with multiple accounts. The security team needs to centrally monitor all root user API activity across all accounts and receive alerts within minutes. What is the MOST efficient solution?

Accepted Answer

Create an organization trail in CloudTrail that logs all accounts. Use CloudWatch Logs metric filters and alarms to detect root login events.. An organization trail in AWS CloudTrail logs API activity for all accounts in AWS Organizations from a single point, eliminating the need to manage per-account trails. By sending these logs to CloudWatch Logs, you can create metric filters to detect root user login events (e.g., the 'RootLogin' event) and configure CloudWatch Alarms to trigger SNS notifications within minutes, meeting the requirement for centralized monitoring and rapid alerts.

Answer

Enable CloudTrail in each account and aggregate logs to a centralized S3 bucket. Use Athena queries to detect root activity and send alerts via SNS.

Answer

Use AWS Lambda functions in each account to poll CloudTrail logs and send root activity to a central SQS queue.

Answer

Enable AWS Config rules in each account to detect root user activity and send notifications to a central SNS topic.

Question 13

A company needs to protect data in Amazon S3 by ensuring that only authorized users can access objects, and all access is logged. Which TWO services should be used together? (Choose TWO.)

Accepted Answer

AWS Identity and Access Management (IAM). AWS Identity and Access Management (IAM) is correct because it enables you to define granular permissions for S3 objects, ensuring that only authorized users or roles can access them via IAM policies or S3 bucket policies. AWS CloudTrail is correct because it logs all API calls made to S3, including object-level operations like GetObject and PutObject, providing an audit trail for access. Together, they satisfy the requirement of controlling access and logging all access.

Answer

AWS KMS

Answer

AWS WAF

Answer

Amazon CloudWatch

Question 14

A developer wants to allow an IAM role to be assumed by an EC2 instance that is part of an Auto Scaling group. Which TWO AWS services or features are required? (Choose TWO.)

Accepted Answer

Instance profile. An instance profile is required to attach an IAM role to an EC2 instance. When an EC2 instance is launched with an instance profile, the AWS credentials provider on the instance can retrieve temporary security credentials from the IAM role via the instance metadata service (IMDS). This allows the instance to assume the role and perform authorized API actions without embedding long-term credentials.

Answer

AWS Config

Answer

AWS CloudFormation

Answer

AWS Single Sign-On (SSO)

Question 15

Which TWO AWS services provide native integration with Amazon CloudWatch Logs for real-time monitoring of application logs? (Choose TWO.)

Accepted Answer

Amazon EC2. Amazon EC2 is correct because it can be configured to send application logs to CloudWatch Logs via the CloudWatch Logs agent or unified CloudWatch agent, enabling real-time monitoring, search, and alerting on log data. AWS Lambda is correct because it natively integrates with CloudWatch Logs: every Lambda function execution automatically streams its logs to a CloudWatch Logs group, providing real-time visibility into function output and errors.

Answer

Amazon S3

Answer

Amazon Route 53

Answer

AWS CloudTrail

Question 16

A company uses AWS CloudTrail to log all API activity and delivers logs to an S3 bucket with server-side encryption (SSE-S3). The security team needs to ensure that only authorized personnel can access the logs and that any unauthorized access attempts are logged and alerted. Additionally, the team wants to prevent the logs from being deleted for at least one year. Which combination of actions should be taken?

Accepted Answer

Enable S3 Object Lock with a retention period of one year; enable S3 server access logs; use a bucket policy with a condition that allows access only from authorized IAM roles or users.. S3 Object Lock with a retention period of one year enforces a write-once-read-many (WORM) model, preventing any deletion or overwrite of log objects for that duration. S3 server access logs capture detailed records of all requests made to the bucket, including unauthorized access attempts, which can be used for alerting. The bucket policy with a condition restricting access to authorized IAM roles or users ensures that only permitted principals can access the logs, meeting the security team's requirements for access control, logging of unauthorized attempts, and deletion prevention.

Answer

Enable S3 default encryption (SSE-S3) on the bucket; enable S3 server access logs; attach an IAM policy that allows only authorized users to access the bucket.

Answer

Enable MFA Delete on the bucket; enable CloudTrail log file validation; use bucket ACLs to restrict access.

Answer

Enable S3 Inventory to track objects; enable CloudTrail to log S3 API calls; use a bucket policy with a deny effect for unauthorized users.

Question 17

A company's security team needs to implement a solution to detect and alert on the creation of IAM users or roles with administrative privileges. The solution must be able to analyze historical account activity and provide real-time alerts. Which combination of AWS services should be used?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Logs with metric filters and alarms. AWS CloudTrail logs IAM CreateUser, CreateRole, and AttachRolePolicy events. Amazon CloudWatch Logs can use metric filters to capture these events and trigger CloudWatch Alarms for real-time alerts. CloudTrail also stores historical logs for analysis. Option A is the correct combination. Option B (GuardDuty and Lambda) is focused on threat detection, not specific IAM administrative privilege creation events. Option C (Trusted Advisor and SES) provides best-practice recommendations and email notifications, not real-time API monitoring. Option D (AWS Config and SNS) evaluates resource configuration compliance but does not monitor API calls in real time.

Answer

Amazon GuardDuty and AWS Lambda

Answer

AWS Trusted Advisor and Amazon SES

Answer

AWS Config with managed rules and Amazon SNS

Question 18

A security team needs to detect unauthorized attempts to access an S3 bucket that contains sensitive data. Which AWS service can automatically analyze S3 access logs and generate findings for suspicious activity?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior across AWS accounts and workloads. It can analyze VPC Flow Logs, AWS CloudTrail event logs, and DNS logs, and when S3 access logging is enabled, GuardDuty can ingest those logs to detect suspicious S3 access patterns, such as anomalous data exfiltration or access from unusual geographies. GuardDuty then generates security findings that can be automated for remediation.

Answer

Amazon Macie

Answer

AWS Trusted Advisor

Answer

Amazon Detective

Question 19

A security engineer is designing a monitoring solution for an AWS Lambda function that processes sensitive data. The function occasionally fails due to timeouts. The engineer needs to be alerted immediately when the function fails and also wants to analyze the error logs. Which combination of services should the engineer use?

Accepted Answer

Amazon CloudWatch Logs and CloudWatch Alarms with Amazon SNS. Amazon CloudWatch Logs captures the Lambda function's execution logs, including timeout errors, and CloudWatch Alarms can monitor specific metrics like `Errors` or `Throttles` for the function. When the alarm state is triggered (e.g., `ALARM`), it publishes a notification to an Amazon SNS topic, which can send immediate alerts via email, SMS, or other endpoints. This combination provides both real-time alerting and log analysis for troubleshooting.

Answer

Amazon CloudWatch Logs and Amazon Kinesis Data Firehose

Answer

AWS CloudTrail and Amazon SNS

Answer

AWS Config and Amazon SNS

Question 20

Refer to the exhibit. A security engineer finds this CloudTrail log entry. What is the most significant security concern indicated by this event?

Accepted Answer

The security group rule allows SSH access from any IP address (0.0.0.0/0).. The CloudTrail log entry shows an `AuthorizeSecurityGroupIngress` API call that adds a rule allowing SSH (port 22) from 0.0.0.0/0. This is a critical security concern because it exposes the EC2 instance to SSH access from any IP address on the internet, creating a high risk of brute-force attacks, unauthorized access, and potential compromise. Security best practices mandate restricting SSH access to specific trusted IP ranges, not the entire internet.

Answer

The event is a normal administrative action and poses no security concern.

Answer

The user did not have MFA enabled when assuming the AdminRole.

Answer

The source IP address (203.0.113.5) is from an unusual location.