SCS-C02 Practice Test 35 — 15 Questions

Question 1

A company has enabled AWS Config to record resource changes. The security team needs to be notified when a security group is modified to allow inbound SSH from 0.0.0.0/0. Which AWS service should be used to evaluate the Config rules and trigger notifications?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Config with a custom rule that triggers an SNS notification. AWS Config with a custom rule is the correct choice because it allows you to define a custom Lambda-backed rule that evaluates security group configurations against the condition of allowing inbound SSH (port 22) from 0.0.0.0/0. When the rule detects non-compliance, it can directly trigger an Amazon SNS notification to alert the security team. This is the native AWS Config mechanism for custom evaluations and notifications, without requiring additional services.

Answer

AWS Lambda

Answer

AWS Security Hub

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Question 2

A security engineer needs to detect unauthorized API calls in an AWS account. Which AWS service should be used to record and monitor API activity for auditing?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it is specifically designed to record API activity across AWS services, capturing details such as the identity of the caller, the time of the call, the source IP address, and the request parameters. This audit log is essential for detecting unauthorized API calls, as it provides a complete history of all management and data plane operations for security analysis and compliance.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

Amazon GuardDuty

Question 3

A security engineer needs to ensure that all EC2 instances launched in a development account are tagged with a cost center. What is the most effective way to enforce this?

Accepted Answer

Use an IAM policy that denies ec2:RunInstances unless the request includes the cost center tag. Using an IAM policy with a condition key (e.g., `aws:RequestTag`) that denies `ec2:RunInstances` unless the `cost center` tag is specified in the API call enforces tagging at launch time. This prevents any untagged instance from being created, providing proactive enforcement rather than reactive detection or remediation.

Answer

Use AWS Config to detect untagged instances and send alerts

Answer

Use AWS Systems Manager to tag instances after launch

Answer

Create a tag policy in AWS Organizations requiring the cost center tag

Question 4

A company uses AWS KMS to encrypt data in Amazon RDS. They need to ensure that the key material is automatically rotated every year. Which key type should they use?

Accepted Answer

AWS managed key. AWS managed keys (D) are automatically rotated every year by AWS without any action required from the customer. For Amazon RDS encryption using AWS KMS, the default key (aws/rds) is an AWS managed key that supports automatic annual rotation, meeting the requirement exactly. Customer managed keys (B) also support automatic rotation, but the question specifies 'every year' and AWS managed keys are the simplest choice that satisfies this, as they are automatically rotated annually by default.

Answer

Custom key store

Answer

Customer managed key

Answer

AWS owned key

Question 5

A company wants to allow a developer to launch EC2 instances only in a specific subnet. The developer should not be able to use any other subnet. Which IAM policy action should be used to enforce this?

Accepted Answer

ec2:RunInstances. The ec2:RunInstances action is the correct IAM action to control EC2 instance launches. By attaching a condition key such as ec2:SubnetId to the ec2:RunInstances action in an IAM policy, you can restrict the developer to launching instances only in a specific subnet. Other actions like ModifySubnetAttribute, CreateTags, or DescribeSubnets do not govern the launch of new instances.

Answer

ec2:ModifySubnetAttribute

Answer

ec2:CreateTags

Answer

ec2:DescribeSubnets

Question 6

A company has a CloudTrail trail that logs management events for all regions. The security team notices that some S3 data events are not being logged. How should the team enable logging for all S3 data events?

Accepted Answer

Update the existing CloudTrail trail to include data events for S3. CloudTrail trails can be configured to log data events for S3 in addition to management events. By updating the existing trail to include S3 data events (e.g., GetObject, PutObject), the security team can capture all object-level API activity without creating a separate trail. This ensures comprehensive logging while maintaining the existing management event logging for all regions.

Answer

Create a new CloudTrail trail that logs only data events

Answer

Use Amazon GuardDuty to monitor S3 access

Answer

Enable S3 server access logging on each bucket

Question 7

Refer to the exhibit. A security engineer runs the above AWS CLI command to search for CreateKeyPair events in CloudTrail. The command returns no results, but the engineer knows that a key pair was created during that time. What is the most likely reason for the missing events?

Accepted Answer

The command was run in a different region than where the key pair was created.. CloudTrail logs are region-specific. The `aws cloudtrail lookup-events` command without the `--region` flag defaults to the region configured in the AWS CLI (e.g., via `AWS_DEFAULT_REGION` or the CLI profile). If the CreateKeyPair event occurred in a different region, the command would return no results. The engineer must specify the correct region using `--region` to retrieve events from that region.

Answer

CreateKeyPair is a data event and not recorded by CloudTrail.

Answer

CloudTrail events are only available after 24 hours.

Answer

CloudTrail is not enabled for management events.

Question 8

A security engineer is designing a VPC with public and private subnets. The private subnets must be able to download software updates from the internet. Which TWO components can provide this functionality without exposing the private instances to inbound internet traffic?

Accepted Answer

NAT gateway. A NAT gateway is a managed AWS service that enables instances in a private subnet to initiate outbound traffic to the internet (e.g., for downloading software updates) while preventing the internet from initiating inbound connections to those instances. It translates the private IP addresses of the instances to the NAT gateway's Elastic IP address, allowing return traffic to be routed back correctly. This meets the requirement of outbound-only internet access without exposing private instances to inbound traffic.

Answer

Internet gateway

Answer

VPC endpoint

Answer

Egress-only internet gateway

Question 9

Which AWS service allows you to create and manage encryption keys for your AWS resources?

Accepted Answer

AWS Key Management Service (KMS). AWS Key Management Service (KMS) is the managed service designed specifically for creating, storing, and managing encryption keys used to encrypt data across AWS services. It integrates with AWS CloudTrail for auditing key usage and supports symmetric and asymmetric keys, with automatic key rotation and fine-grained access control via IAM and key policies.

Answer

AWS CloudHSM

Answer

AWS Certificate Manager

Answer

AWS Secrets Manager

Question 10

A company uses AWS CloudFormation to deploy infrastructure. A security requirement states that no security group should allow inbound SSH access from 0.0.0.0/0. What is the best way to enforce this policy?

Accepted Answer

Use AWS Config with a managed rule to detect and automatically remediate non-compliant security groups.. AWS Config with a managed rule (e.g., 'restricted-ssh') can continuously evaluate security group configurations against the policy and automatically remediate non-compliant rules using AWS Systems Manager Automation. This provides detective and corrective enforcement without blocking legitimate administrative actions, unlike IAM or SCP approaches that would prevent necessary changes or fail to detect existing non-compliant resources.

Answer

Create an IAM policy that denies the ec2:AuthorizeSecurityGroupIngress action if the CIDR is 0.0.0.0/0.

Answer

Add an AWS::IAM::Policy resource in the CloudFormation template to deny the rule.

Answer

Use a service control policy (SCP) that denies the CreateStack action if the template contains SSH from 0.0.0.0/0.

Question 11

A company uses AWS KMS to encrypt EBS volumes. They want to ensure that the key used for EBS encryption is not shared across different AWS accounts. Which feature should they use?

Accepted Answer

Configure the key policy to deny access to any principal from another AWS account.. AWS KMS key policies can explicitly deny access to principals from other AWS accounts by using the `aws:SourceAccount` or `aws:SourceArn` condition keys, or by specifying a `Deny` statement with a condition that checks the account ID. This ensures that the KMS key used for EBS encryption cannot be used by any IAM principal or role from a different AWS account, preventing cross-account key sharing.

Answer

Use a CloudHSM custom key store.

Answer

Use the key's alias to restrict access.

Answer

Enable automatic key rotation.

Question 12

Drag and drop the steps to set up AWS Certificate Manager (ACM) for a custom domain in the correct order.

Accepted Answer

Request certificate, Validate domain ownership via DNS, Issue certificate, Associate certificate with AWS resource. ACM certificate requires request, DNS validation, issuance, association, and automatic renewal.

Answer

Validate domain ownership via DNS, Request certificate, Issue certificate, Associate certificate with AWS resource

Answer

Request certificate, Issue certificate, Validate domain ownership via DNS, Associate certificate with AWS resource

Answer

Request certificate, Validate domain ownership via DNS, Associate certificate with AWS resource, Issue certificate

Question 13

A company is designing a data protection strategy for its Amazon S3 bucket that stores sensitive documents. The security team requires that all data be encrypted in transit and at rest, and that any accidental deletion of objects can be reversed within 30 days. Additionally, the company must be able to audit all access attempts to the bucket, including failed attempts. Which TWO actions should the company take to meet these requirements? (Choose two.)

Accepted Answer

Enable AWS CloudTrail with data events for S3.. AWS CloudTrail with data events for S3 is correct because it captures all S3 API calls, including GetObject, PutObject, and DeleteObject, and records both successful and failed access attempts. This meets the auditing requirement for all access attempts, including failed ones, as CloudTrail logs the request details, error codes, and source IP addresses.

Answer

Enable default encryption on the bucket using SSE-S3.

Answer

Enable S3 server access logs and send them to a separate bucket.

Answer

Enable MFA Delete on the bucket.

Question 14

Refer to the exhibit. A security engineer is reviewing this IAM policy attached to a user. The user reports that they are able to stop and start instances, but they cannot terminate instances. However, the engineer notices that there is no explicit deny for termination. Why is the user unable to terminate instances?

Accepted Answer

The policy does not include an explicit Allow for ec2:TerminateInstances.. IAM policies operate on an explicit allow model. Even though there is no explicit deny for ec2:TerminateInstances, the user is unable to terminate instances because the policy does not include an explicit Allow action for ec2:TerminateInstances. Without an explicit Allow, the default behavior is to deny the action, regardless of whether a deny statement is present.

Answer

The second statement's Resource is set to '*' but the Action list does not include termination.

Answer

The first statement's Resource element is too restrictive and does not include the termination API call.

Answer

The policy has a syntax error that prevents termination from being evaluated.

Question 15

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The security team wants to allow only HTTP and HTTPS traffic from the internet to the ALB, and only HTTP traffic from the ALB to the EC2 instances. Which THREE security group configurations are required? (Choose three.)

Accepted Answer

ALB security group: inbound rule allowing HTTP from 0.0.0.0/0.. The ALB must accept HTTP traffic from the internet (0.0.0.0/0) to serve web requests. This inbound rule allows the ALB to listen on port 80 for unencrypted HTTP traffic, which is a standard requirement for a public-facing web application. Without this rule, HTTP requests from clients would be dropped by the ALB's security group.

Answer

EC2 security group: inbound rule allowing HTTP from 0.0.0.0/0.

Answer

EC2 security group: inbound rule allowing HTTPS from ALB security group.