SCS-C02 Practice Test 33 — 15 Questions

Question 1

A security engineer notices that an EC2 instance in a private subnet can reach the internet, even though there is no NAT gateway or instance in the route table. What is the most likely cause?

Accepted Answer

An egress-only internet gateway is used for IPv6 traffic.. An egress-only internet gateway (EIGW) allows outbound-only IPv6 traffic from instances in a private subnet to the internet, but it does not permit inbound connections initiated from the internet. Since the question states there is no NAT gateway or instance, and the instance can reach the internet, the most likely cause is that the VPC uses IPv6 and an EIGW is configured with a default route (::/0) pointing to it. This enables outbound internet access without a NAT device, matching the described scenario.

Answer

An internet gateway is attached to the VPC and a default route points to it.

Answer

A VPC endpoint for S3 is configured.

Answer

A NAT gateway is configured in a different availability zone.

Question 2

A company wants to ensure that all traffic to and from an Amazon RDS instance is encrypted in transit. Which solution should the security engineer implement?

Accepted Answer

Configure the database to require SSL/TLS connections and modify clients to connect using SSL.. Encrypting data in transit for Amazon RDS requires enabling SSL/TLS on the database instance and configuring client connections to use SSL/TLS. This ensures that all traffic between the client and the RDS instance is encrypted using TLS protocols, protecting against eavesdropping and man-in-the-middle attacks. Amazon RDS supports SSL/TLS for all database engines, and you can enforce SSL connections by setting the 'require_secure_transport' parameter (MySQL) or similar parameters for other engines.

Answer

Enable encryption at rest using AWS KMS.

Answer

Use an S3 bucket policy to enforce encryption in transit for all S3 traffic.

Answer

Use an AWS Transit Gateway to route traffic through a central VPC.

Question 3

Refer to the exhibit. A security engineer is reviewing this CloudFormation template. What security risk is present in this configuration?

Accepted Answer

SSH access is allowed from a large internal CIDR block (10.0.0.0/8) which could expose the instance to unnecessary internal threats.. Allowing SSH (TCP port 22) from the entire 10.0.0.0/8 CIDR block is overly permissive. This range encompasses all RFC 1918 private addresses in the 10.x.x.x space, which could include many internal subnets, VPNs, or peered VPCs that do not require administrative access. Unnecessarily broad internal access increases the attack surface and violates the principle of least privilege.

Answer

The template does not associate the security group with the instance, so the instance has no security group.

Answer

HTTP access is allowed from all IP addresses (0.0.0.0/0) which is a security risk.

Answer

The template uses SecurityGroups property instead of SecurityGroupIds, which is deprecated.

Question 4

A security engineer is troubleshooting an issue where an Amazon RDS for MySQL DB instance encrypted at rest with AWS KMS is failing to launch. The error message indicates a KMS access issue. Which IAM role or policy is most likely missing?

Accepted Answer

The AWSServiceRoleForRDS service-linked role is missing. The AWSServiceRoleForRDS service-linked role is required for RDS to call AWS KMS on your behalf to manage encryption keys for encrypted DB instances. If this role is missing, RDS cannot obtain the necessary permissions to decrypt the KMS key during instance launch, resulting in a KMS access error. This role is automatically created the first time you create an RDS resource, but if it was deleted or not present, you must recreate it to resolve the issue.

Answer

The RDS subnet group is in a private subnet without a NAT gateway

Answer

The DB instance's security group does not allow outbound traffic to KMS

Answer

The KMS key policy does not grant access to the root account

Question 5

A company uses AWS Organizations and wants to enable Amazon GuardDuty across all member accounts. The security team wants to centrally manage findings and automate responses. What is the MOST efficient way to achieve this?

Accepted Answer

Designate a Delegated Administrator account for GuardDuty in AWS Organizations and enable GuardDuty for all accounts from that account.. AWS Organizations allows you to designate a Delegated Administrator account for GuardDuty, which can then enable GuardDuty and manage findings centrally across all member accounts without manual per-account setup. This approach is the most efficient as it leverages the Organizations integration to automatically enable GuardDuty in new accounts and centralize finding management, reducing operational overhead.

Answer

Use AWS CloudFormation StackSets to deploy a GuardDuty detector in each account.

Answer

Enable AWS Security Hub in the management account and configure it to ingest GuardDuty findings from member accounts.

Answer

Enable GuardDuty in each member account individually and configure cross-account access to a central S3 bucket.

Question 6

A company has a multi-account AWS environment using AWS Organizations. The security team uses AWS Security Hub to consolidate findings. They notice that a critical finding in the production account is not being aggregated in Security Hub. The finding is generated by Amazon GuardDuty. What is the MOST likely cause?

Accepted Answer

Amazon GuardDuty is not enabled in the production account.. Amazon Security Hub aggregates findings from enabled security services across accounts. For GuardDuty findings to appear in Security Hub, GuardDuty must be enabled in the account where the finding is generated. If GuardDuty is not enabled in the production account, it cannot produce findings for Security Hub to consume, which is the most likely cause of the missing critical finding.

Answer

The IAM role for Security Hub does not have permissions to read GuardDuty findings.

Answer

AWS Config is not enabled in the production account.

Answer

VPC Flow Logs are not enabled in the production account.

Question 7

A company has multiple AWS accounts and wants to centrally aggregate VPC Flow Logs from all accounts into a single S3 bucket in the logging account. What is the MOST secure way to configure cross-account delivery?

Accepted Answer

Create VPC Flow Logs in each account, specifying the central S3 bucket ARN as the destination, and configure the bucket policy to allow the flow logs service principal to write.. VPC Flow Logs can be published directly to an S3 bucket in another account by specifying the bucket ARN as the destination. The logging account's bucket policy must grant the `s3:PutObject` permission to the VPC Flow Logs service principal (`delivery.logs.amazonaws.com`) for the cross-account write to succeed. This approach avoids sharing credentials or introducing additional services, maintaining a secure and direct delivery path.

Answer

Use AWS CloudTrail to log flow logs and deliver to the central bucket.

Answer

Share the central bucket's access key with each account to write directly.

Answer

Use Amazon Kinesis Data Firehose to stream flow logs from each account to the central S3 bucket.

Question 8

A company uses AWS Organizations with all features enabled. The security team wants to ensure that no IAM users are created in any account. Which approach should be used?

Accepted Answer

Attach a service control policy (SCP) that denies iam:CreateUser.. Service Control Policies (SCPs) in AWS Organizations allow you to centrally restrict permissions across all accounts in the organization. By attaching an SCP that denies the `iam:CreateUser` action, you prevent the creation of IAM users in any member account, regardless of any IAM policies attached to users or roles within those accounts. This provides a guardrail that cannot be overridden by account administrators, ensuring compliance with the security team's requirement.

Answer

Use AWS Config rules to detect IAM users and notify via SNS.

Answer

Enable AWS CloudTrail Insights to detect anomalous IAM activity.

Answer

Apply an IAM policy to the root user to deny iam:CreateUser.

Question 9

A company's incident response team is using AWS Systems Manager to run commands on EC2 instances for forensic analysis. The team needs to ensure that the commands are run with minimal latency and that the results are stored securely. Which Systems Manager capability should the team use?

Accepted Answer

AWS Systems Manager Run Command. AWS Systems Manager Run Command is the correct capability because it allows the incident response team to execute commands on EC2 instances with minimal latency by using the SSM Agent to run scripts or commands directly, and it can store command output in Amazon S3 or CloudWatch Logs for secure, durable storage. This meets the requirement for low-latency execution and secure result storage without requiring interactive sessions or complex automation workflows.

Answer

AWS Systems Manager Automation

Answer

AWS Systems Manager Session Manager

Answer

AWS Systems Manager Patch Manager

Question 10

A company wants to monitor for unauthorized changes to security group rules in their VPC. Which TWO AWS services can be used together to detect and alert on such changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is correct because it records API calls made to the EC2 service, including AuthorizeSecurityGroupIngress, RevokeSecurityGroupEgress, and CreateSecurityGroup. By monitoring CloudTrail events for these specific API actions, you can detect unauthorized changes to security group rules. AWS Config is correct because it provides a managed rule called 'restricted-common-ports' or custom rules that can evaluate security group configurations against desired policies, and it can trigger alerts via Amazon SNS when a security group rule is changed.

Answer

VPC Flow Logs

Answer

Amazon GuardDuty

Answer

Amazon Macie

Question 11

A security engineer needs to monitor for unusual outbound network traffic from an EC2 instance. Which AWS service provides this capability?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture metadata about IP traffic going to and from network interfaces in a VPC, including source/destination IPs, ports, protocols, and packet counts. This allows a security engineer to analyze outbound traffic patterns from an EC2 instance and detect anomalies such as data exfiltration or communication with known malicious IPs. The logs can be published to Amazon CloudWatch Logs or Amazon S3 for further analysis with tools like Amazon Athena or third-party SIEMs.

Answer

Amazon CloudWatch Logs agent

Answer

Amazon Inspector

Answer

AWS Config

Question 12

A company uses AWS CloudFormation to deploy infrastructure. The security team needs to ensure that all CloudFormation stacks include a specific tag with a value that complies with corporate policies. Which AWS service can enforce this requirement?

Accepted Answer

AWS Service Catalog. AWS Service Catalog allows administrators to create and manage a portfolio of approved products (e.g., CloudFormation templates) with predefined constraints. One such constraint is a tag option, which enforces that every provisioned product (i.e., CloudFormation stack) includes a specific tag key and value, ensuring compliance with corporate policies. This is the only service among the options that can directly enforce mandatory tagging on CloudFormation stacks at provisioning time.

Answer

AWS Config

Answer

AWS Identity and Access Management (IAM)

Answer

AWS CloudTrail

Question 13

A company uses AWS Organizations with multiple accounts. The security team needs a centralized solution to automatically initiate incident response runbooks across all accounts when a threat is detected. Which approach meets these requirements?

Accepted Answer

Use AWS Security Hub with cross-account aggregation and Amazon EventBridge to trigger AWS Systems Manager Automation runbooks.. AWS Security Hub with cross-account aggregation collects findings from all accounts into a single administrator account. Amazon EventBridge can then be configured to match specific Security Hub findings (e.g., a GuardDuty threat detection) and trigger AWS Systems Manager Automation runbooks. This provides a centralized, automated incident response mechanism across all accounts without requiring per-account Lambda functions or manual remediation.

Answer

Enable Amazon GuardDuty in all accounts and use its built-in remediation actions.

Answer

Configure AWS CloudFormation StackSets to deploy incident response stacks in all accounts.

Answer

Deploy an AWS Lambda function in each member account to respond to findings.

Question 14

Refer to the exhibit. A security engineer is analyzing a VPC Flow Logs entry for an EC2 instance with private IP 192.0.2.10. The log shows an accepted outbound connection from the instance to 203.0.113.50 on port 443. The instance is not expected to initiate outbound HTTPS connections. What should the engineer do next to investigate?

Accepted Answer

Log into the instance and check for unauthorized processes or malware.. The VPC Flow Logs show an accepted outbound connection from the EC2 instance to an external IP on port 443, which is unexpected behavior. The immediate next step is to log into the instance and investigate for unauthorized processes, malware, or compromised credentials that could be initiating this outbound HTTPS traffic. This aligns with incident response best practices: verify the host before making network-level changes.

Answer

Block the IP 203.0.113.50 in the security group immediately.

Answer

Check the security group rules to see if outbound HTTPS is allowed.

Answer

Check Amazon Route 53 DNS logs to see what domain was resolved.

Question 15

During a security incident, a security engineer needs to preserve forensic evidence from an EC2 instance that may be compromised. The instance is running a critical application. Which approach minimizes data loss while ensuring the integrity of the evidence?

Accepted Answer

Create an EBS snapshot, then isolate the instance by modifying the security group and removing it from the load balancer.. Creating an EBS snapshot preserves the disk state at the point of the incident, capturing forensic evidence without altering the running instance. Isolating the instance by modifying the security group (e.g., removing all inbound/outbound rules) and removing it from the load balancer stops network traffic and prevents further compromise, minimizing data loss while maintaining the integrity of the evidence for later analysis.

Answer

Immediately terminate the instance to stop any ongoing malicious activity.

Answer

SSH into the instance and run forensic tools to capture memory.

Answer

Detach the instance from the Auto Scaling group and leave it running without changes.