SCS-C02 Practice Test 33 — 15 Questions

Question 1

A company uses AWS CloudTrail to log all API activity. The security team wants to ensure that logs are immutable after they are delivered to Amazon S3. Which combination of actions should be taken to meet this requirement? (Choose the best single answer that includes all necessary steps.)

Accepted Answer

Enable S3 Object Lock in governance mode on the bucket.. Enabling S3 Object Lock in governance mode provides immutability for logs against deletion or overwrite. Option A is correct. Option B is wrong because MFA Delete alone does not prevent overwrites. Option C is wrong because bucket policies do not prevent deletion by authorized users. Option D is wrong because enabling versioning alone does not prevent deletion of all versions.

Answer

Enable MFA Delete on the bucket.

Answer

Enable versioning on the bucket.

Answer

Create a bucket policy that denies s3:DeleteObject actions.

Question 2

A security engineer is troubleshooting why CloudTrail is not delivering logs to an S3 bucket. The bucket policy allows CloudTrail to write objects, and the trail is configured with the correct bucket name. However, no log files appear. What is the most likely cause?

Accepted Answer

The S3 bucket uses AWS KMS server-side encryption (SSE-KMS) and the KMS key policy does not grant CloudTrail permission to use the key.. CloudTrail requires specific permissions to write to S3, including s3:PutObject and s3:GetBucketAcl. If the KMS key policy does not allow CloudTrail to use it, log delivery fails silently.

Answer

The S3 bucket has an S3 Object Lock configuration that prevents writes.

Answer

The S3 bucket is in a different AWS Region from the trail.

Answer

CloudTrail is not enabled in the AWS Region where the S3 bucket resides.

Question 3

A security engineer is configuring Amazon GuardDuty in a multi-account environment. The engineer wants to enable GuardDuty in the management account and automatically enable it for all member accounts. Which THREE steps are required?

Accepted Answer

Configure GuardDuty to automatically enable for all accounts in the organization via the Organizations integration.. GuardDuty must be enabled in the management account first. Then, using Organizations, GuardDuty can be automatically enabled for all existing and new accounts. Member accounts must also accept the invitation to join the GuardDuty administrator account.

Answer

Have each member account manually enable GuardDuty.

Answer

Create an S3 bucket for GuardDuty findings in each member account.

Question 4

An organization wants to detect and alert on the use of root user credentials in their AWS accounts. They have multiple accounts managed via AWS Organizations. What is the most efficient way to centralize this monitoring?

Accepted Answer

Enable Amazon GuardDuty in the management account and use the delegated administrator feature.. Amazon GuardDuty has a built-in finding type for root user activity (RootCredentialUsage). Enabling GuardDuty in the management account and delegating an administrator allows centralized monitoring across all accounts. Option D is correct. Option A is wrong because CloudTrail trails must be created in each account individually, which is less efficient. Option B is wrong because AWS Config rules are per account and require custom logic. Option C is wrong because IAM Access Analyzer does not specifically detect root user activity.

Answer

Create an AWS CloudTrail trail in each account and aggregate logs to a central S3 bucket.

Answer

Use IAM Access Analyzer to find resources shared with external entities.

Answer

Use AWS Config rules to detect root user usage in each account.

Question 5

A DevOps engineer notices that an EC2 instance's CloudWatch agent is not sending custom metrics to CloudWatch. The agent is installed and the configuration file is valid. The instance has an IAM role attached. What is the most likely reason for the failure?

Accepted Answer

The IAM role attached to the instance does not have the cloudwatch:PutMetricData permission.. The CloudWatch agent needs permissions to put metrics. If the IAM role lacks the 'cloudwatch:PutMetricData' action, the agent will fail silently.

Answer

The instance does not have internet access to reach CloudWatch endpoints.

Answer

The CloudWatch agent is not running as root.

Answer

The CloudWatch agent configuration file has a syntax error.

Question 6

A security engineer is configuring logging for an application running on Amazon EC2 instances. The engineer needs to capture both operating system-level logs and application logs. Which TWO services can be used together to achieve this? (Choose two.)

Accepted Answer

Amazon CloudWatch Logs. The CloudWatch agent can collect OS and application logs and send them to CloudWatch Logs. Options A and C are correct. Option B is wrong because VPC Flow Logs capture network traffic metadata. Option D is wrong because AWS CloudTrail captures API calls. Option E is wrong because Amazon Inspector is for vulnerability assessment.

Answer

AWS CloudTrail

Answer

VPC Flow Logs

Answer

Amazon Inspector

Question 7

A security team uses Amazon Macie to discover sensitive data in S3. They have configured Macie to run automated sensitive data discovery jobs. After reviewing the findings, they notice that some S3 objects containing personally identifiable information (PII) are not being flagged. What is the most likely cause?

Accepted Answer

The PII is in a format that Macie's managed data identifiers do not recognize, and no custom data identifier is configured.. Macie uses managed data identifiers for common PII types. If the PII is in a format not covered (e.g., custom formats), it may not be detected. Macie also supports custom data identifiers that must be configured.

Answer

The Macie service-linked role does not have permissions to read the objects.

Answer

The S3 bucket is in a different AWS Region than the Macie job.

Answer

The S3 objects are encrypted with SSE-S3.

Question 8

A security engineer notices that an IAM user in the company's AWS account is making API calls from an IP address outside the allowed corporate network. The engineer needs to be alerted immediately when such activity occurs. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Create an Amazon CloudWatch Events rule that matches the IAM user's API calls from the unauthorized IP and sends an SNS notification.. Option C is correct because CloudWatch Events (now Amazon EventBridge) can capture API calls from CloudTrail and trigger an SNS notification based on a rule matching the source IP address. Option A is wrong because Trusted Advisor does not monitor IAM user API calls in real time. Option B is wrong because VPC Flow Logs capture network traffic but not API-level details. Option D is wrong because S3 server access logs are for S3 operations only.

Answer

Enable AWS Trusted Advisor and configure email notifications for security checks.

Answer

Enable VPC Flow Logs and analyze them with Amazon Athena to detect suspicious IPs.

Answer

Configure S3 server access logs on the IAM users' bucket and use Amazon Macie to detect anomalies.

Question 9

A security team wants to detect and alert on suspicious network traffic patterns within their VPC. They need to capture traffic to and from an EC2 instance for analysis. Which THREE services should be used together to achieve this? (Choose three.)

Accepted Answer

Network Load Balancer. VPC Traffic Mirroring captures network traffic, which can be sent to a Network Load Balancer for distribution to security appliances, and then analyzed by Amazon Detective. Options A, B, and D are correct. Option C is wrong because AWS Network Firewall is for filtering, not capture. Option E is wrong because AWS WAF is for web traffic filtering.

Answer

AWS Network Firewall

Answer

AWS WAF

Question 10

A company wants to centralize logs from multiple AWS accounts into a single S3 bucket for analysis. The accounts are part of an AWS Organizations organization. Which set of steps will accomplish this?

Accepted Answer

Create an organization trail in the management account with logging enabled for all accounts.. AWS CloudTrail supports organization trails that log all accounts in the organization. A single trail can be created in the management account that delivers logs to a centralized S3 bucket.

Answer

Use AWS Config to aggregate logs from all accounts into a central S3 bucket.

Answer

Create a CloudTrail trail in each account and configure each to write to the same S3 bucket.

Answer

Set up Amazon Kinesis Data Firehose in each account to stream logs to a central S3 bucket.

Question 11

A company wants to centralize CloudTrail logs from multiple AWS accounts into a single S3 bucket for security analysis. The logs must be encrypted at rest and access must be logged. What is the MOST secure way to grant cross-account access to the central S3 bucket?

Accepted Answer

Create an S3 bucket policy that grants CloudTrail service principal permission to write objects, with a condition checking the source account ID.. Option A is correct because using a bucket policy with a condition for CloudTrail service principal and source account ensures only CloudTrail from allowed accounts can write. Option B is wrong because KMS encryption does not control write access. Option C is wrong because IAM roles are not used by CloudTrail for cross-account delivery. Option D is wrong because a bucket policy without account restriction would allow any CloudTrail to write.

Answer

Create an S3 bucket policy that grants s3:PutObject to everyone, and rely on CloudTrail to restrict access.

Answer

Create an IAM role in the central account that each member account can assume to write logs.

Answer

Use an S3 bucket with default encryption enabled and share the KMS key with the other accounts.

Question 12

Refer to the exhibit. A security engineer has created an S3 bucket policy to allow AWS CloudTrail and VPC Flow Logs to deliver logs to the bucket. However, CloudTrail logs are not being delivered, but VPC Flow Logs are delivered successfully. What is the most likely cause?

Accepted Answer

The bucket policy does not grant CloudTrail permission to perform 's3:GetBucketAcl' and 's3:PutBucketAcl'.. The service principal for CloudTrail is `cloudtrail.amazonaws.com`, which is correct, so the issue is likely that the CloudTrail trail's S3 bucket is not configured correctly, or the bucket policy does not include the necessary permissions for CloudTrail to verify the bucket. However, given that VPC Flow Logs work, the issue might be that the CloudTrail trail is not using the correct bucket name or prefix. But the question focuses on the policy; the policy seems correct for both. The most common issue is that CloudTrail requires the bucket to have a specific ACL or the policy to allow `s3:GetBucketAcl` and `s3:PutBucketAcl`. Option D is correct. Option A is wrong because the service principal is correct. Option B is wrong because the condition is fine. Option C is wrong because the principal is correct. Option D addresses a common missing permission.

Answer

The principal is set to a service instead of an AWS account.

Answer

The condition 's3:x-amz-acl' is misspelled.

Answer

The service principal in the policy is incorrect for CloudTrail.

Question 13

A company uses AWS CloudTrail to log all API activity. They want to ensure that log files are tamper-proof and can be validated for forensic purposes. Which of the following should they enable?

Accepted Answer

CloudTrail log file integrity validation. CloudTrail log file integrity validation uses digital signatures (SHA-256) to verify that log files have not been modified after delivery. It also provides a digest file for validation.

Answer

AWS KMS server-side encryption on the S3 bucket

Answer

S3 bucket versioning

Answer

S3 Object Lock with governance mode

Question 14

Refer to the exhibit. A security engineer is configuring the Amazon CloudWatch agent to collect logs from an Amazon ECS task. The configuration shown is used. However, the logs are not appearing in CloudWatch Logs. What is the most likely cause?

Accepted Answer

The configuration file is missing the 'logs' section at the top level.. The configuration uses `log_group_name` but in the CloudWatch agent configuration for ECS, the correct key is `log_group_name` (lowercase) but more commonly the issue is that the agent requires `logs.region` and `logs.endpoint` to be set, or the IAM role is missing permissions. However, the exhibit uses `log_group_name` which is correct for the standalone agent, but for the ECS agent, the configuration is passed as environment variables or in the task definition. The most typical mistake is that the `log_group_name` is not properly nested under `logs`. Option C is correct. Option A is wrong because the ECS agent can use CloudWatch agent. Option B is wrong because the format is standard. Option D is wrong because the pattern is optional.

Answer

The multi_line_start_pattern is missing a closing delimiter.

Answer

The datetime_format is incorrect for the logs.

Answer

The CloudWatch agent is not installed in the ECS task.

Question 15

A security analyst wants to receive a notification whenever a new security group is created in their AWS account. Which AWS service should they use to trigger an SNS notification based on the CloudTrail event?

Accepted Answer

Amazon EventBridge (CloudWatch Events). Amazon EventBridge (formerly CloudWatch Events) can match events from CloudTrail (e.g., CreateSecurityGroup) and route them to targets like SNS.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

AWS Lambda