SCS-C02 Practice Test 35 — 15 Questions

Question 1

A company uses AWS CloudTrail to log all API calls across multiple accounts in AWS Organizations. The security team notices that management events are being logged, but data events for Amazon S3 are not appearing in the CloudTrail logs for any account. The team needs to enable data event logging for S3 across all accounts. Currently, the organization trail is configured in the management account, and all member accounts have default CloudTrail configurations. What is the MOST efficient way to enable S3 data event logging for all current and future accounts in the organization?

Accepted Answer

Update the existing organization trail's event selectors in the management account to include S3 data events for all accounts.. The correct answer is C. By updating the organization trail's event selectors to include S3 data events, CloudTrail will automatically apply this configuration to all accounts in the organization, including future accounts. Option A is incorrect because member accounts cannot modify an organization trail. Option B is incorrect because creating a new trail in each account is inefficient and does not leverage the organization trail. Option D is incorrect because S3 server access logs are a different feature and do not capture data events via CloudTrail.

Answer

Ask each member account to create a new trail in their own account with S3 data events enabled.

Answer

Enable S3 server access logging on all S3 buckets across the organization and aggregate logs in a central S3 bucket.

Answer

Create a new organization trail in the management account with S3 data events enabled, and share it with member accounts.

Question 2

A company wants to allow users from an external AWS account to assume a role in the company's account. What must be configured in the company's account?

Accepted Answer

A trust policy that allows the external account to assume the role.. The trust policy of the role must specify the external account as a principal. Option B is for permissions policy. Option C is for identity provider. Option D is for cross-account access via IAM user.

Answer

An IAM user in the company's account with cross-account access.

Answer

A permissions policy that allows the external account to list roles.

Answer

An IAM identity provider for the external account.

Question 3

Which THREE AWS services can be used to authenticate users for accessing AWS resources?

Accepted Answer

AWS Single Sign-On. IAM authenticates users, Cognito provides user pools for federated access, SSO integrates with identity providers. Option D is not an authentication service. Option E is for secrets management.

Answer

AWS Secrets Manager

Answer

AWS CloudTrail

Question 4

A company is using AWS CloudTrail to log API calls. The security team wants to ensure that the logs are encrypted at rest and that access to the logs is controlled. Which actions should be taken? (Choose two.)

Accepted Answer

Enable default encryption on the S3 bucket where CloudTrail logs are stored. Option A (Enable S3 Server-Side Encryption) and Option B (Use S3 bucket policy to restrict access) are correct. Option C is wrong because CloudTrail does not support KMS per trail; it uses S3 SSE. Option D is wrong because CloudTrail does not support bucket policies for delivery. Option E is wrong because CloudWatch Logs can be encrypted but not the primary method for S3.

Answer

Enable CloudTrail log file validation

Answer

Use AWS KMS to encrypt the CloudTrail log files

Answer

Store logs in Amazon CloudWatch Logs with encryption enabled

Question 5

A company is using AWS Key Management Service (KMS) to encrypt data at rest in Amazon S3. The security team wants to ensure that only a specific IAM role can decrypt the data. Which KMS policy element should be used?

Accepted Answer

Principal. Option B (Principal) is correct because it specifies who can use the key. Option A (Effect) is for allow/deny. Option C (Action) is for allowed operations. Option D (Resource) is for the key ARN.

Answer

Resource

Answer

Action

Answer

Effect

Question 6

A company wants to restrict access to an S3 bucket so that only objects with specific tags can be accessed by a certain IAM role. Which THREE steps are required to implement this?

Accepted Answer

Attach an IAM policy to the role that uses the s3:ExistingObjectTag condition.. Option A (Enable S3 object-level logging) is not required for access control. Option B (Create a bucket policy with a condition based on s3:ExistingObjectTag) is correct. Option C (Attach an IAM policy to the role with condition) is correct. Option D (Set S3 bucket policy to deny untagged objects) is correct. Option E (Use S3 inventory) is for reporting, not access control.

Answer

Use S3 Inventory to list objects and their tags.

Answer

Enable S3 object-level logging in CloudTrail.

Question 7

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that no IAM user in any account can create new IAM users. Which approach should be used?

Accepted Answer

Apply a service control policy (SCP) at the root organizational unit that denies IAM:CreateUser.. Option B is correct because an SCP can deny the IAM:CreateUser action across all accounts. Option A is wrong because it only applies to the root user. Option C is wrong because it affects only one account. Option D is wrong because SCPs cannot be attached to IAM users.

Answer

Apply an IAM policy to the root user of each account.

Answer

Use an SCP attached to each IAM user.

Answer

Use an IAM permissions boundary on each IAM user.

Question 8

A company wants to restrict access to an S3 bucket so that only requests from a specific VPC endpoint are allowed. The bucket policy must deny all requests that do not come from the VPC endpoint. Which TWO statements are true for this configuration?

Accepted Answer

Use the aws:SourceVpce condition key in the bucket policy.. The aws:SourceVpce condition key restricts requests to a specific VPC endpoint. The Principal must be '*' to apply to all principals, and the Effect Deny ensures non-VPC endpoint requests are blocked.

Answer

Use the aws:SourceIp condition key to restrict IP addresses.

Answer

Set the Principal to the VPC endpoint ID.

Answer

Ensure the bucket policy has an explicit Allow for the VPC endpoint.

Question 9

A company uses Amazon CloudFront with an Application Load Balancer (ALB) as the origin. The security team wants to restrict access to the ALB so that it only accepts traffic from CloudFront. Which configuration should be used?

Accepted Answer

Configure the ALB security group to allow inbound traffic only from the CloudFront origin IP ranges published by AWS.. Option B is correct because configuring the ALB security group to allow traffic only from CloudFront's IP ranges ensures that only CloudFront can reach the ALB. Option A is wrong because CloudFront does not require a VPC origin; ALB is a regional endpoint. Option C is wrong because the ALB cannot authenticate the CloudFront user agent. Option D is wrong because CloudFront cannot use an IAM role to access the ALB.

Answer

Configure the ALB to be internal and place it in a VPC with a CloudFront VPC origin.

Answer

Configure the ALB to require a specific header 'X-CloudFront-Origin' and reject requests without it.

Answer

Configure the ALB to use an IAM role that allows only CloudFront to invoke the ALB.

Question 10

A security engineer is designing a VPC with private subnets for an application that must access the internet for software updates. The VPC has a NAT gateway in a public subnet. The private subnet route table has a default route (0.0.0.0/0) pointing to the NAT gateway. Which additional security measure should be implemented to ensure that only the application instances can use the NAT gateway, and not any other resources in the VPC?

Accepted Answer

Configure a network ACL on the private subnet to allow outbound traffic only to the NAT gateway's private IP address.. Option D is correct because using a VPC endpoint for the NAT gateway is not possible; a network ACL on the private subnet can restrict outbound traffic to the NAT gateway's IP, ensuring only that traffic can exit. Option A is wrong because security groups cannot reference the NAT gateway as a destination; they control inbound/outbound traffic based on IP/CIDR. Option B is wrong because there is no IAM policy for NAT gateway usage. Option C is wrong because a flow log does not block traffic; it only monitors.

Answer

Enable VPC Flow Logs on the NAT gateway to detect unauthorized usage.

Answer

Create an IAM policy that allows only the application instances to use the NAT gateway.

Answer

Configure a security group for the NAT gateway that allows only the application instances' security group as source.

Question 11

A company wants to use AWS Direct Connect to establish a dedicated network connection from its on-premises data center to AWS. Which of the following is a security best practice when configuring Direct Connect?

Accepted Answer

Use a private virtual interface (VIF) and enable IPsec encryption for the traffic.. Option A is correct because using a private VIF ensures traffic goes over the AWS private network, not the internet, and encrypting with IPsec adds a layer of security. Option B is wrong because MACsec is for physical layer security, not required for private VIF. Option C is wrong because public VIF is for public services and is less secure. Option D is wrong because a VPN over Direct Connect is redundant if private VIF is used.

Answer

Use a public VIF to access all AWS services including VPC resources.

Answer

Use a private VIF and establish an IPsec VPN tunnel over the Direct Connect connection.

Answer

Use a private VIF and enable MACsec encryption at the physical layer.

Question 12

A company uses Network Load Balancer (NLB) in front of a fleet of EC2 instances in private subnets. Security team requires that the source IP addresses of clients be preserved in the access logs of the backend instances. Which configuration should the security engineer verify?

Accepted Answer

Ensure the NLB is configured with a subnet from each Availability Zone and the targets are in the same subnets. NLB preserves source IP by default, so no special configuration is needed. Option C is correct. Option A is wrong because NLB uses the client IP directly. Option B is wrong because proxy protocol is an alternative but not required for NLB. Option D is wrong because target group stickiness does not affect source IP preservation.

Answer

Configure proxy protocol v2 on the target group

Answer

Enable target group stickiness

Answer

Enable cross-zone load balancing on the NLB

Question 13

A security engineer is designing a VPC with public and private subnets. The application must be able to send outbound traffic to the internet, but inbound traffic from the internet must be blocked except for a single HTTP load balancer. The application also needs to access an S3 bucket in the same AWS region. Which combination of VPC components meets these requirements? (Choose two.)

Accepted Answer

NAT Gateway in a public subnet. Option A (NAT Gateway in public subnet) allows outbound internet. Option C (S3 Gateway Endpoint) provides private access to S3. Option B is wrong because Internet Gateway alone would allow inbound. Option D is wrong because VPC Peering is not needed. Option E is wrong because VPC Endpoint (Interface) for S3 is not supported; S3 uses Gateway Endpoint.

Answer

S3 Interface Endpoint in the VPC

Answer

VPC Peering to a shared services VPC

Answer

Internet Gateway attached to the VPC

Question 14

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance is associated with a security group that allows outbound HTTPS (port 443) to 0.0.0.0/0. The private subnet route table has a default route (0.0.0.0/0) pointing to a NAT Gateway in the public subnet. The NAT Gateway's security group allows inbound HTTPS from the private subnet CIDR. However, the instance cannot download patches. What is the most likely cause?

Accepted Answer

The NAT Gateway's security group is blocking outbound traffic to the internet. NAT Gateway's security group must allow inbound HTTPS from the private subnet CIDR. The problem statement says it does, so that is not the issue. The most likely issue is that the NAT Gateway's security group must also allow outbound HTTPS to 0.0.0.0/0 for the return traffic. Option D is correct. Option A is wrong because NACL is stateless but default NACL allows all. Option B is wrong because the security group allows outbound. Option C is wrong because the route is present.

Answer

The network ACL for the private subnet is blocking outbound traffic

Answer

The private subnet route table does not have a route to the NAT Gateway

Answer

The security group attached to the EC2 instance is blocking inbound traffic

Question 15

A company uses AWS Direct Connect to connect its on-premises data center to AWS. The connection is set up with a private VIF to a VPC using a virtual private gateway. The security team wants to encrypt all traffic between on-premises and the VPC. Which solution should be implemented?

Accepted Answer

Set up an IPsec VPN over the Direct Connect private VIF. Option B (IPsec VPN over Direct Connect) is correct because it encrypts the traffic over the private VIF. Option A is wrong because Direct Connect itself does not encrypt. Option C is wrong because using a VPN over the internet is less secure and not over Direct Connect. Option D is wrong because TLS is for application layer, not network layer.

Answer

Configure TLS on the applications

Answer

Use a site-to-site VPN over the internet instead of Direct Connect

Answer

Enable encryption on the Direct Connect private VIF