SCS-C02 Practice Test 34 — 15 Questions

Question 1

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The security team wants to analyze web request logs to identify potential SQL injection attacks. Which AWS service should be used to collect and analyze the ALB access logs?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon Athena. Amazon Athena is the correct service because it allows you to query ALB access logs stored in Amazon S3 directly using standard SQL, without needing to load or transform the data. This makes it ideal for ad-hoc analysis of web request logs to identify patterns like SQL injection attempts, as you can run complex queries against the raw log data.

Answer

VPC Flow Logs

Answer

AWS WAF

Answer

Amazon CloudWatch Logs Insights

Question 2

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The company wants to minimize costs and avoid NAT Gateway or NAT Instance charges. Which solution should be used?

Accepted Answer

Create a VPC Gateway Endpoint for S3 and configure the instance to download patches from S3.. A VPC Gateway Endpoint for S3 allows private subnet resources to access S3 over the AWS network without traversing the internet, avoiding NAT Gateway or NAT Instance charges. The patches can be stored in an S3 bucket and downloaded by the EC2 instance using the endpoint, which uses AWS PrivateLink and does not require an internet gateway or public IP.

Answer

Deploy a proxy instance in a public subnet and configure the private instance to use the proxy.

Answer

Use an egress-only internet gateway for the private subnet.

Answer

Attach an internet gateway to the VPC and add a route to the private subnet route table pointing to the internet gateway.

Question 3

A company wants to detect and alert on unauthorized API calls in their AWS account. Which AWS service can provide real-time notifications when specific API calls are made?

Accepted Answer

Amazon CloudWatch Events (EventBridge). Amazon CloudWatch Events (now part of Amazon EventBridge) can capture real-time API calls made to AWS services by using a rule that matches specific API calls via CloudTrail integration. When a matching API call occurs, EventBridge can trigger a target such as an SNS topic or Lambda function to send a notification, enabling immediate alerting on unauthorized API calls.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

AWS Trusted Advisor

Question 4

A company uses Amazon S3 to store sensitive data. The security team wants to detect when objects are made publicly accessible. Which combination of services provides the MOST comprehensive detection with minimal false positives?

Accepted Answer

Enable S3 Block Public Access at the account level and use AWS Config rules to detect public ACLs and bucket policies.. S3 Block Public Access at the account level provides a preventive control that denies all public access, while AWS Config rules (e.g., s3-bucket-public-read-prohibited, s3-bucket-policy-not-more-permissive) continuously evaluate and detect any public ACLs or bucket policies that would allow public access. This combination ensures comprehensive detection with minimal false positives because Config rules are deterministic and based on explicit policy evaluation, not on heuristic or behavioral analysis.

Answer

Use Amazon Macie to scan S3 buckets for publicly accessible objects.

Answer

Enable CloudTrail data events for S3 and create a CloudWatch Events rule for PutBucketAcl calls.

Answer

Enable Amazon GuardDuty and review the S3 findings for public access.

Question 5

A company uses AWS CloudTrail to log management events in all regions. The security team notices that some API calls made by an IAM user are not appearing in the CloudTrail event history. What is the most likely reason?

Accepted Answer

CloudTrail event history only retains events for 90 days; older events are not visible. D is correct because CloudTrail event history only retains the last 90 days of events. If the API calls were made more than 90 days ago, they would no longer appear in the event history, even though the trail itself may still be delivering log files to an S3 bucket for longer-term storage. The security team is likely looking at the event history rather than querying the S3 bucket or using Athena for older events.

Answer

The user used the AWS Management Console, not the CLI

Answer

The trail is configured for a single region only

Answer

The API calls were read-only and excluded by default

Question 6

A company uses Amazon GuardDuty to monitor its AWS environment. The security team has received a GuardDuty finding of type 'Recon:EC2/PortProbeUnprotectedPort'. The finding indicates that an EC2 instance has an open SSH port that is being probed from the internet. The team wants to reduce the attack surface and prevent future probes. Which THREE actions should the team take? (Choose THREE.)

Accepted Answer

Modify the security group to allow SSH only from specific IP addresses.. Modifying the security group to allow SSH only from specific IP addresses directly restricts inbound traffic to trusted sources, eliminating the open exposure that triggers the GuardDuty 'Recon:EC2/PortProbeUnprotectedPort' finding. This is a fundamental network access control that reduces the attack surface by applying the principle of least privilege at the security group level.

Answer

Suppress the GuardDuty finding to reduce noise.

Answer

Terminate the EC2 instance and launch a new one.

Question 7

A company is using AWS Organizations to manage multiple accounts. The security team wants to ensure that all accounts have AWS CloudTrail enabled in all regions. Which approach should be used?

Accepted Answer

Enable AWS CloudTrail from the master account as an organization trail.. AWS Organizations allows you to create an organization trail from the management account that automatically applies to all member accounts and all regions. This ensures CloudTrail is enabled across the entire organization without requiring per-account configuration, and it centralizes log delivery to a single Amazon S3 bucket for auditing.

Answer

Create an SCP that requires CloudTrail to be enabled.

Answer

Enable CloudTrail in each account using a cross-account IAM role.

Answer

Use AWS Config rules to detect non-compliant accounts and automatically enable CloudTrail.

Question 8

A security team needs to monitor for unauthorized API calls in their AWS account. Which TWO services can provide real-time alerts for such events?

Accepted Answer

AWS CloudTrail with Amazon CloudWatch Events. B is correct because AWS CloudTrail logs all API calls, and by integrating CloudTrail with Amazon CloudWatch Events (now Amazon EventBridge), you can create event rules that trigger real-time alerts (e.g., via SNS or Lambda) for unauthorized API calls. This combination provides the necessary logging and immediate notification capability for security monitoring.

Answer

Amazon CloudWatch Logs Insights

Answer

Amazon VPC Flow Logs

Answer

AWS Config

Question 9

A security team needs to centrally manage permissions for multiple AWS accounts. Which AWS service should they use?

Accepted Answer

AWS Organizations with service control policies (SCPs). AWS Organizations with service control policies (SCPs) is the correct choice because SCPs allow you to centrally manage permissions across multiple AWS accounts by defining maximum permissions for member accounts. Unlike IAM policies that are attached to users or roles within a single account, SCPs act as a guardrail at the organization or organizational unit (OU) level, restricting what actions accounts and their IAM principals can perform, even if the account's own IAM policies allow more.

Answer

AWS IAM

Answer

AWS Config

Answer

AWS CloudTrail

Question 10

Which AWS service can be used to create a private network connection between a VPC and an on-premises data center over dedicated physical lines?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct service because it establishes a dedicated, private network connection from an on-premises data center to a VPC using physical Ethernet cables routed through an AWS Direct Connect location. This bypasses the public internet entirely, providing consistent latency, higher bandwidth, and a more reliable connection than internet-based options.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

VPC Peering

Question 11

A company wants to monitor AWS API calls for suspicious activity and automatically remediate by revoking IAM roles in real time. Which combination of services should be used?

Accepted Answer

Amazon CloudWatch Events and AWS Lambda. The combination of Amazon CloudWatch Events and AWS Lambda enables real-time monitoring and automated remediation of AWS API calls. CloudWatch Events can capture API calls from AWS CloudTrail (or other sources) and trigger a Lambda function to revoke IAM roles based on suspicious activity patterns, providing the required real-time response.

Answer

AWS CloudTrail and Amazon Inspector

Answer

AWS CloudTrail and AWS Config

Answer

Amazon GuardDuty and AWS Config

Question 12

A company is using AWS Config to track resource changes. They want to receive notifications when a security group is modified to allow inbound traffic from 0.0.0.0/0. What is the most efficient way to achieve this?

Accepted Answer

Create a custom AWS Config rule with an AWS Lambda function that checks for public inbound traffic.. AWS Config custom rules allow you to define a Lambda function that evaluates security group configurations against your compliance requirements. By writing a rule that checks for inbound rules with '0.0.0.0/0' on ports like SSH (22) or RDP (3389), you can trigger notifications via Amazon SNS when non-compliant changes occur. This is the most efficient approach as it directly monitors the desired condition without relying on external services or manual log analysis.

Answer

Use IAM Access Analyzer to detect publicly accessible security groups.

Answer

Enable Amazon GuardDuty and use its findings for security group changes.

Answer

Create a CloudTrail trail and filter on AuthorizeSecurityGroupIngress events.

Question 13

A company wants to allow an EC2 instance to access an S3 bucket without exposing the instance to the internet. Which AWS service should be used to achieve this?

Accepted Answer

VPC Endpoint (Gateway type) for S3. A VPC Endpoint (Gateway type) for S3 allows EC2 instances within a VPC to access S3 buckets privately using AWS's internal network, without traversing the internet. This is achieved by adding an endpoint route in the VPC route table that directs S3 traffic to the endpoint, which uses AWS's private infrastructure. It eliminates the need for an internet gateway, NAT gateway, or VPN connection, ensuring the instance remains isolated from the public internet.

Answer

NAT Gateway

Answer

AWS Site-to-Site VPN

Answer

Internet Gateway

Question 14

A company needs to ensure that all API calls in their AWS account are logged and monitored for suspicious activity. Which service should be enabled first?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct first service to enable because it records all API calls made in the AWS account, including the identity, source IP, and timestamp of each call. This audit log is foundational for detecting suspicious activity, as it provides the raw data needed for analysis by other services like Amazon GuardDuty or third-party tools. Without CloudTrail, there is no record of API activity to monitor.

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Answer

AWS Config

Question 15

A company uses AWS Organizations with multiple accounts. The security team wants to centralize threat detection and automatically remediate high-severity GuardDuty findings across all accounts. What is the MOST efficient way to achieve this?

Accepted Answer

Enable GuardDuty in the management account and designate a delegated administrator to manage findings across all accounts. AWS Organizations allows you to enable GuardDuty in the management account and designate a delegated administrator, which automatically enables GuardDuty across all member accounts and centralizes finding management. This approach eliminates the need for per-account configuration or cross-account IAM roles, as the delegated administrator can view and manage findings from all accounts in a single GuardDuty console. It is the most efficient method because it leverages native AWS Organizations integration for automated, centralized threat detection and remediation.

Answer

Create a Lambda function that enables GuardDuty in each account using cross-account IAM roles

Answer

Configure Amazon EventBridge to forward findings from each account to a central account

Answer

Use AWS Security Hub and enable GuardDuty in each account separately