SCS-C02 Practice Test 32 — 15 Questions

Question 1

A company wants to allow its employees to authenticate to the AWS Management Console using their existing corporate credentials. Which AWS service should be used to integrate with the company's identity provider?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS IAM Identity Center (AWS SSO). AWS IAM Identity Center (formerly AWS SSO) is the correct service because it is specifically designed to enable single sign-on (SSO) from an external identity provider (IdP) to AWS accounts and business applications. It supports federation via SAML 2.0 or OIDC, allowing employees to authenticate using their existing corporate credentials and then access the AWS Management Console without needing separate IAM users.

Answer

AWS Secrets Manager

Answer

AWS Directory Service for Microsoft Active Directory

Answer

AWS Certificate Manager

Question 2

A company has a multi-account AWS environment using AWS Organizations. The security team wants to centrally manage VPC security group rules across all accounts. Which solution should be used?

Accepted Answer

Use AWS Firewall Manager to define security group policies and enforce them across accounts.. AWS Firewall Manager is the correct choice because it provides centralized management of security group rules across multiple accounts in an AWS Organization. It allows the security team to define a common security group policy and automatically enforce it across all member accounts, ensuring consistent security posture without manual intervention.

Answer

Use AWS Organizations Service Control Policies to restrict security group modifications.

Answer

Use AWS Config rules to automatically remediate non-compliant security groups.

Answer

Use AWS Network Firewall to inspect traffic and block unauthorized connections.

Question 3

A security engineer is designing a governance framework for a multi-account AWS environment. The engineer needs to ensure that all accounts comply with the principle of least privilege for IAM roles and that any non-compliant resources are automatically reported. Which two AWS services should the engineer use together to achieve this? (Choose TWO.)

Accepted Answer

AWS Security Hub. AWS Security Hub is correct because it provides a comprehensive view of security alerts and compliance status across multiple AWS accounts, aggregating findings from various AWS services and third-party tools. AWS Config is correct because it continuously monitors and records AWS resource configurations, enabling you to define rules (e.g., IAM least privilege policies) and automatically evaluate resource compliance, triggering notifications or remediation actions for non-compliant resources. Together, Security Hub can ingest AWS Config rule compliance results as findings, allowing centralized reporting and automated response to IAM role violations.

Answer

AWS Service Catalog

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Question 4

During a security incident, a forensic investigator needs to capture the memory of a running EC2 instance without shutting it down. Which AWS feature should be used?

Accepted Answer

EC2 Rescue for Linux or Systems Manager Run Command with a memory dump script. EC2 Rescue for Linux (via Systems Manager Run Command) includes a built-in script that can capture a full memory dump from a running EC2 instance without requiring a shutdown. This is essential for forensic analysis to preserve volatile data like running processes, network connections, and kernel structures. The script leverages the Linux 'vmcore' or 'LiME' (Linux Memory Extractor) tool to safely extract memory contents while the instance remains operational.

Answer

Amazon CloudWatch agent

Answer

AWS CloudTrail

Answer

Amazon EBS snapshot

Question 5

A company needs to monitor for root account usage and receive immediate notifications. Which combination of AWS services should be used?

Accepted Answer

AWS CloudTrail, Amazon CloudWatch Logs, and Amazon SNS. AWS CloudTrail captures all root account API calls, CloudWatch Logs can monitor those events for root activity using a metric filter, and Amazon SNS delivers immediate notifications when the filter triggers. This combination provides the logging, monitoring, and alerting pipeline required for real-time root account usage detection.

Answer

AWS Config and AWS Lambda

Answer

Amazon GuardDuty and AWS Lambda

Answer

S3 server access logs and Amazon Inspector

Question 6

A company wants to implement least privilege access for a data analytics team that uses Amazon Athena to query data in S3. Which THREE steps should be taken?

Accepted Answer

Grant write access to an S3 bucket for query results. Athena requires a dedicated S3 bucket to store query results, and granting write access to that specific bucket ensures the service can write output without exposing other data. This aligns with least privilege by limiting write permissions to only the necessary location.

Answer

Grant full S3 access to all buckets

Answer

Grant access to Amazon Redshift

Question 7

A company uses AWS Direct Connect to connect its on-premises data center to a VPC. The security team wants to encrypt all traffic between on-premises and the VPC. Which solution should be used?

Accepted Answer

Set up an IPsec VPN over the Direct Connect connection. Direct Connect does not natively encrypt traffic; it provides a private, low-latency connection but the data traverses it in cleartext. By establishing an IPsec VPN tunnel over the Direct Connect link (often called a 'Direct Connect VPN' or using a virtual private gateway with a VPN attachment), you encrypt all traffic between on-premises and the VPC at the network layer, meeting the security team's requirement for encryption.

Answer

Enable encryption on the Direct Connect virtual interface

Answer

Use VPC Peering with encryption

Answer

Configure TLS on all applications

Question 8

A company uses AWS Direct Connect to connect its on-premises data center to AWS. The connection is set up with a private VIF to a VPC using a virtual private gateway. The security team wants to encrypt all traffic between on-premises and the VPC. Which solution should be implemented?

Accepted Answer

Set up an IPsec VPN over the Direct Connect private VIF. Direct Connect private VIFs do not natively encrypt traffic; they provide a private, dedicated network connection but the data traverses it in cleartext. By establishing an IPsec VPN tunnel over the private VIF, you encrypt all traffic between the on-premises network and the VPC, meeting the security team's requirement for encryption while still leveraging the low latency and reliability of Direct Connect.

Answer

Configure TLS on the applications

Answer

Use a site-to-site VPN over the internet instead of Direct Connect

Answer

Enable encryption on the Direct Connect private VIF

Question 9

A security team notices that an S3 bucket containing sensitive data has been repeatedly accessed from an IP address outside the company's network. They need to set up a real-time alert when such access occurs. Which combination of services should they use?

Accepted Answer

Amazon GuardDuty and Amazon EventBridge. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity, including unusual API calls and unauthorized access patterns from external IPs. When GuardDuty detects such access to an S3 bucket, it can generate findings that are sent to Amazon EventBridge, which then triggers a real-time alert (e.g., via SNS or Lambda). This combination provides immediate, automated notification of the suspicious access without requiring custom log parsing.

Answer

VPC Flow Logs and Amazon QuickSight

Answer

AWS Config and Amazon SNS

Answer

CloudWatch Logs Insights and Amazon SES

Question 10

A company uses AWS Organizations and has enabled GuardDuty in the management account. The security team wants to view GuardDuty findings for all member accounts from a single delegated administrator account. Which configuration step is required?

Accepted Answer

Designate a delegated administrator account in Organizations, then enable GuardDuty in that account. GuardDuty will automatically aggregate findings from member accounts.. AWS Organizations allows you to designate a delegated administrator account for GuardDuty, which can then manage and view findings from all member accounts without needing to enable GuardDuty individually in each account. Once the delegated administrator is set up, GuardDuty automatically aggregates findings from all member accounts in the organization, providing a single-pane-of-glass view for the security team.

Answer

Enable GuardDuty in each member account and configure cross-account IAM roles to aggregate findings in the management account.

Answer

Enable GuardDuty only in the management account and share findings via CloudWatch Logs cross-account subscription.

Answer

Enable GuardDuty in the management account and use CloudWatch cross-account dashboard to view findings from member accounts.

Question 11

Which of the following is a best practice for securing an AWS account root user?

Accepted Answer

Enable multi-factor authentication (MFA) and avoid using the root user.. The AWS root user has unrestricted access to all AWS resources and services, making it a high-value target. Enabling multi-factor authentication (MFA) adds an extra layer of security beyond the password, and AWS best practices dictate that the root user should only be used for a limited set of tasks (e.g., changing account settings) and never for daily operations. This minimizes the attack surface and reduces the risk of compromise.

Answer

Create access keys for the root user and use them for API calls.

Answer

Use the root user for daily administrative tasks.

Answer

Share the root user password with the IT team for emergency access.

Question 12

A company's security policy requires that all S3 bucket access logs be delivered to a central S3 bucket in the security account. A security engineer notices that some buckets are not delivering logs. The engineer needs to identify which buckets are not logging and ensure compliance. Which service should the engineer use to continuously monitor and report on S3 bucket logging?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides continuous monitoring and evaluation of AWS resource configurations against desired policies. By using an AWS Config managed rule like `s3-bucket-logging-enabled`, the security engineer can automatically detect S3 buckets that do not have logging enabled and receive compliance notifications, ensuring ongoing adherence to the security policy.

Answer

Amazon Macie

Answer

Amazon S3 Inventory

Answer

AWS CloudTrail

Question 13

A security engineer needs to ensure that all S3 buckets in an AWS account have server access logging enabled. Which AWS service should be used to continuously monitor for compliance?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides continuous monitoring and evaluation of your AWS resource configurations against desired policies. You can create an AWS Config rule, such as the managed rule 's3-bucket-server-access-logging-enabled', which will automatically check all S3 buckets in your account and report any that do not have server access logging enabled, flagging them as noncompliant. This allows for ongoing, automated compliance auditing without manual intervention.

Answer

Amazon GuardDuty

Answer

AWS IAM Access Analyzer

Answer

AWS CloudTrail

Question 14

A company is using AWS CloudTrail to log API calls. The security team needs to ensure that log files are not tampered with and can be used to verify integrity. Which feature should be enabled?

Accepted Answer

Enable log file integrity validation in CloudTrail.. CloudTrail log file integrity validation uses a hash chain (SHA-256) to create a digest file that proves log files have not been modified, deleted, or tampered with since delivery. This feature allows you to verify that CloudTrail log files have remained unchanged, meeting the security team's requirement for integrity verification.

Answer

Enable MFA delete on the log bucket.

Answer

Enable server-side encryption with AWS KMS on the log bucket.

Answer

Enable S3 versioning on the log bucket.

Question 15

A developer needs to grant an IAM user read-only access to an S3 bucket named 'my-bucket'. Which policy should be attached to the IAM user?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::my-bucket/*"}]}. Option D grants s3:GetObject, which allows the IAM user to read (download) objects from the bucket. Although full read-only access typically includes s3:ListBucket to list objects, the question asks for read access, and s3:GetObject is the essential read action. Option A only allows listing, not reading object data. Option B grants full access, and option C grants write access. Thus, D is the best choice for read-only access.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::my-bucket"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:*","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:PutObject","Resource":"arn:aws:s3:::my-bucket/*"}]}