SCS-C02 Practice Test 31 — 15 Questions

Question 1

A company uses AWS Lambda functions to process sensitive data. The security team wants to ensure that if a Lambda function is compromised, the attacker cannot use the function's IAM role to access other AWS resources. The team has implemented the principle of least privilege by restricting the IAM role's permissions. However, they are concerned about a scenario where an attacker could use the Lambda function to execute AWS API calls that are not intended by the application. What additional measure should the team implement to reduce the risk of such lateral movement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS IAM Access Analyzer to generate and refine the IAM policy based on actual usage.. AWS IAM Access Analyzer can generate IAM policies based on the actual API calls made by the Lambda function over a specified period. By reviewing and refining the policy to include only those actions, the team can further tighten least privilege beyond manual estimation, reducing the risk that an attacker could abuse unintended API calls. This directly addresses the concern of lateral movement by ensuring the function's role cannot perform actions not observed in normal operation.

Answer

Enable AWS CloudTrail data events for the Lambda function.

Answer

Attach a service control policy (SCP) that denies all actions except those explicitly allowed.

Answer

Place the Lambda function inside a VPC with no internet access.

Question 2

A security engineer needs to ensure that all API calls made to AWS services are logged for auditing. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to AWS services, capturing details such as the identity of the caller, the time of the call, the source IP address, request parameters, and response elements. This provides a complete audit trail of user activity and API usage, which is essential for security auditing and compliance.

Answer

AWS Config

Answer

Amazon VPC Flow Logs

Answer

Amazon CloudWatch Logs

Question 3

A company wants to automate the enforcement of security best practices across all AWS accounts. Which AWS service provides pre-built rules for security compliance?

Accepted Answer

AWS Security Hub. AWS Security Hub is the correct answer because it provides a comprehensive view of security alerts and compliance status across AWS accounts, and it includes pre-built security standards and automated compliance checks based on frameworks such as the AWS Foundational Security Best Practices (FSBP), CIS AWS Foundations Benchmark, and PCI DSS. These pre-built rules allow you to automate the enforcement of security best practices without manual configuration.

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Answer

AWS Config

Question 4

A company wants to detect and alert on suspicious IAM user behavior, such as accessing services that are not typically used. Which AWS service provides prebuilt anomaly detection for IAM users?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is the correct answer because it is a threat detection service that uses machine learning and anomaly detection to identify suspicious IAM user behavior, such as accessing services not typically used. It analyzes AWS CloudTrail management and data events, VPC Flow Logs, and DNS logs to establish baselines and generate findings for unusual API calls or access patterns. This prebuilt capability directly addresses the requirement for detecting atypical IAM activity without manual configuration.

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Answer

Amazon Inspector

Question 5

During an incident response, a security team needs to capture a memory dump of an Amazon EC2 instance running Linux. What is the recommended approach?

Accepted Answer

Use AWS Systems Manager Run Command to run a script that extracts memory using LiME.. AWS Systems Manager Run Command allows you to execute a script on a running EC2 instance without needing SSH access, and LiME (Linux Memory Extractor) is a trusted tool for capturing volatile memory. This approach preserves the memory state for forensic analysis while maintaining the instance's running state, which is critical for incident response.

Answer

Use Amazon Inspector to collect memory dumps.

Answer

Stop the instance and create an EBS snapshot for memory analysis.

Answer

Use the EC2 console to take a screenshot and capture memory from the hypervisor.

Question 6

A security engineer has attached the above IAM policy to a role used by an application to write logs to an S3 bucket. However, the application is unable to write logs. What is the MOST likely reason?

Accepted Answer

The application does not set the x-amz-acl header to bucket-owner-full-control on PutObject requests.. When an IAM policy grants PutObject access to an S3 bucket, the application must also include the `x-amz-acl: bucket-owner-full-control` header in its PutObject requests to ensure the bucket owner retains full control over the uploaded objects. Without this header, the object is owned by the writer (the role), and the bucket owner cannot manage it, causing the write to fail due to access control mismatches, especially in cross-account scenarios or when the bucket policy enforces specific ACLs.

Answer

The Effect is set to Allow, which is too permissive.

Answer

The policy does not allow server-side encryption.

Answer

The resource ARN is incorrect; it should be arn:aws:s3:::my-log-bucket/*.

Question 7

A company is using AWS Systems Manager Session Manager to provide secure shell access to EC2 instances without opening inbound ports. Which of the following is a requirement for this setup?

Accepted Answer

The EC2 instance must have an IAM role that allows SSM actions.. AWS Systems Manager Session Manager establishes a secure shell connection to EC2 instances without requiring inbound ports. The EC2 instance must have an IAM role attached that includes the AWS managed policy AmazonSSMManagedInstanceCore, which grants permissions for the SSM agent to communicate with the Systems Manager service. This IAM role is essential because the SSM agent uses AWS credentials from the instance metadata to authenticate and establish a bidirectional control channel via HTTPS (port 443) to the Systems Manager endpoint, not through traditional SSH.

Answer

The EC2 instance must be in a public subnet.

Answer

The EC2 instance must have a public IP address.

Answer

The security group must allow inbound SSH from 0.0.0.0/0.

Question 8

A company has a VPC with multiple subnets. The security team wants to control traffic between subnets using a stateful firewall that can automatically allow return traffic. Which AWS service should be used?

Accepted Answer

Security groups. Security groups act as a stateful virtual firewall for EC2 instances and other resources at the subnet or instance level. They automatically allow return traffic regardless of inbound or outbound rules, which satisfies the requirement for a stateful firewall that controls traffic between subnets.

Answer

Network ACLs

Answer

AWS Firewall Manager

Answer

AWS WAF

Question 9

A security engineer needs to ensure that an Amazon RDS database instance is not accessible from the internet. Which configuration step will achieve this?

Accepted Answer

Set the DB instance to be not publicly accessible and place it in a private subnet.. Setting a DB instance to be not publicly accessible ensures that it does not receive a public IP address, and placing it in a private subnet (one without a route to an internet gateway) prevents any direct inbound or outbound traffic from the internet. This combination guarantees that the RDS instance is isolated from the public internet, aligning with the security requirement.

Answer

Deploy the DB instance in a multi-AZ configuration.

Answer

Set the DB instance to be publicly accessible and restrict security group inbound rules.

Answer

Use the default VPC security group for the DB instance.

Question 10

A security engineer is configuring Amazon GuardDuty in a multi-account environment using AWS Organizations. What is the MOST efficient way to enable GuardDuty for all accounts?

Accepted Answer

Enable GuardDuty in the management account and designate a delegated administrator to manage GuardDuty. AWS Organizations allows you to enable GuardDuty at the management account level and then designate a delegated administrator to manage GuardDuty across all member accounts. This approach is the most efficient as it eliminates the need for per-account manual or scripted enablement, leveraging the Organizations API to automatically enroll all existing and future accounts.

Answer

Create a Lambda function that uses AWS Organizations API to enable GuardDuty in each account

Answer

Use AWS Service Catalog to provision GuardDuty across accounts

Answer

Manually enable GuardDuty in each member account

Question 11

A company uses AWS Secrets Manager to store database credentials. They need to rotate the secrets automatically every 30 days. Which rotation strategy should they use?

Accepted Answer

Enable automatic rotation in Secrets Manager and specify a Lambda rotation function.. AWS Secrets Manager natively supports automatic rotation of secrets, and you must specify an AWS Lambda function to perform the rotation logic (e.g., updating the database password and storing the new secret). This ensures the secret is rotated on a schedule (every 30 days) without manual intervention, meeting the requirement for automated rotation.

Answer

Use AWS Systems Manager Parameter Store to rotate the secret.

Answer

Manually update the secret every 30 days.

Answer

Use an AWS Config rule to trigger rotation.

Question 12

A company uses AWS CloudFormation to deploy infrastructure. The security team wants to ensure that all CloudFormation stacks include a specific tag "Environment" with a value of "Production" or "Development". Which approach should be used?

Accepted Answer

Use AWS CloudFormation Guard to validate that the template includes the required tag with allowed values.. AWS CloudFormation Guard (cfn-guard) is a policy-as-code tool that allows you to define rules to validate CloudFormation templates before they are used to create or update stacks. By writing a Guard rule that checks for the 'Environment' tag with allowed values of 'Production' or 'Development', you can enforce this requirement at the template level, preventing non-compliant stacks from being deployed. This approach is proactive, catching violations during the authoring or CI/CD pipeline stage rather than after deployment.

Answer

Apply an IAM policy that requires the tag on all CloudFormation actions.

Answer

Use AWS Config to detect and automatically remediate non-compliant stacks.

Answer

Create an SCP to deny CloudFormation stacks that do not have the required tag.

Question 13

A security engineer is designing a VPC with public and private subnets in two Availability Zones. The company requires that all outbound traffic from private subnets to the internet must go through a single, centrally managed NAT gateway. Which combination of resources and route table entries should be used?

Accepted Answer

A single NAT gateway in a public subnet, and a default route (0.0.0.0/0) in each private subnet route table pointing to that NAT gateway.. A single NAT gateway placed in a public subnet (with an Internet Gateway route) can be used by multiple private subnets across different Availability Zones. Each private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway's elastic network interface (ENI) or NAT Gateway ID, ensuring all outbound traffic from private instances is source-NATed through that single, centrally managed device.

Answer

A single NAT gateway in a private subnet, and a default route in each private subnet pointing to the NAT gateway.

Answer

One NAT gateway per private subnet, each with a route to an internet gateway.

Answer

One NAT gateway per Availability Zone, with routes to the internet gateway.

Question 14

A company uses AWS CloudTrail to log all API activity. The security team wants to be alerted when an IAM user creates a new access key. They have created a CloudWatch metric filter on the CloudTrail log group for the event name 'CreateAccessKey' and set up a CloudWatch alarm that sends an email via Amazon SNS. However, the alarm is not triggering even though the team knows that access keys have been created. The metric filter has been tested and shows data points in CloudWatch. What should the security team check next?

Accepted Answer

Review the CloudWatch alarm configuration, including the period and threshold.. The metric filter is producing data points, which means logs are being ingested and the filter is matching events. The most likely issue is that the CloudWatch alarm's period or threshold is misconfigured—for example, the evaluation period might be too long or the threshold too high, causing the alarm to not transition to ALARM state despite the metric having values. The security team should verify the alarm's settings, such as the period (e.g., 5 minutes) and the threshold (e.g., >= 1), to ensure they align with the expected frequency of access key creation events.

Answer

Ensure that the CloudTrail trail is delivering logs to the correct CloudWatch Logs log group.

Answer

Verify that the CloudTrail trail is logging data events.

Answer

Check that the IAM user has permissions to create access keys.

Question 15

A company uses AWS CloudTrail to log all API calls in their AWS account. They need to ensure that log files are not tampered with after they are delivered to the S3 bucket. Which feature should be enabled to provide integrity validation?

Accepted Answer

Enable CloudTrail log file integrity validation.. CloudTrail log file integrity validation uses a SHA-256 hash chain to detect if log files have been modified, deleted, or tampered with after delivery to S3. When enabled, CloudTrail delivers a digest file that contains hashes of the log files, allowing you to verify that no unauthorized changes have occurred. This is the only feature specifically designed for integrity validation of CloudTrail logs.

Answer

Enable S3 Versioning on the CloudTrail bucket.

Answer

Enable S3 server-side encryption with SSE-S3.

Answer

Enable S3 Object Lock on the CloudTrail bucket.