SCS-C02 Practice Test 36 — 15 Questions

Question 1

A company wants to ensure that all Amazon S3 bucket policies comply with a security baseline that prohibits public read access. Which TWO methods can be used to detect non-compliant buckets? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use IAM Access Analyzer to review bucket policies for public access.. IAM Access Analyzer reviews resource policies to identify resources shared with an external entity. For S3 buckets, it can analyze bucket policies and detect if they grant public read access (i.e., access to 'Principal': '*'). This directly identifies non-compliant buckets against the security baseline that prohibits public read access.

Answer

Enable AWS CloudTrail to monitor GetPublicAccessBlock calls.

Answer

Use Amazon Inspector to scan bucket policies.

Answer

Use AWS Trusted Advisor to check S3 bucket permissions.

Question 2

A company wants to centralize CloudTrail logs from multiple AWS accounts into a single S3 bucket for security analysis. The logs must be encrypted at rest and access must be logged. What is the MOST secure way to grant cross-account access to the central S3 bucket?

Accepted Answer

Create an S3 bucket policy that grants CloudTrail service principal permission to write objects, with a condition checking the source account ID.. It uses an S3 bucket policy that grants the CloudTrail service principal (cloudtrail.amazonaws.com) permission to write objects, with a condition that checks the source account ID. This ensures that only CloudTrail from authorized accounts can deliver logs, and the service principal approach avoids the need for IAM roles or sharing credentials. The bucket policy also allows encryption at rest via S3 default encryption or a KMS key, and access logging can be enabled separately on the bucket.

Answer

Create an S3 bucket policy that grants s3:PutObject to everyone, and rely on CloudTrail to restrict access.

Answer

Create an IAM role in the central account that each member account can assume to write logs.

Answer

Use an S3 bucket with default encryption enabled and share the KMS key with the other accounts.

Question 3

A company wants to use client-side encryption for data uploaded to Amazon S3. The encryption keys must be managed by the company and never sent to AWS. Which S3 encryption option supports this requirement?

Accepted Answer

Client-side encryption using the Amazon S3 encryption client.. Client-side encryption using the Amazon S3 encryption client is correct because the encryption process occurs entirely on the client side before data is uploaded to S3. The company manages the encryption keys locally and never transmits them to AWS, satisfying the requirement that keys are never sent to AWS.

Answer

Server-side encryption with AWS KMS (SSE-KMS).

Answer

Server-side encryption with S3 managed keys (SSE-S3).

Answer

Server-side encryption with customer-provided keys (SSE-C).

Question 4

An organization uses AWS Organizations with multiple accounts. The security team needs a centralized location to collect and analyze security findings from GuardDuty, Inspector, and Macie. Which AWS service should they use?

Accepted Answer

AWS Security Hub. AWS Security Hub is the correct service because it provides a centralized view of security alerts and compliance status across multiple AWS accounts. It aggregates findings from GuardDuty, Inspector, and Macie, normalizing them into the AWS Security Finding Format (ASFF), enabling the security team to analyze and prioritize threats in a single dashboard.

Answer

Amazon Detective

Answer

Amazon CloudWatch

Answer

AWS Config

Question 5

A security engineer runs the command shown in the exhibit. What is the outcome?

Accepted Answer

Default encryption is enabled on the bucket using SSE-S3.. The command `aws s3api put-bucket-encryption --bucket my-bucket --server-side-encryption-configuration '{"Rules":[{"ApplyServerSideEncryptionByDefault":{"SSEAlgorithm":"AES256"}}]}'` enables default encryption on the bucket using SSE-S3, because `AES256` is the algorithm identifier for SSE-S3 (Amazon S3-managed keys). The command succeeds and sets the default encryption configuration to use server-side encryption with S3-managed keys, which is the standard SSE-S3 behavior.

Answer

The command fails because AES256 is not a valid algorithm.

Answer

Default encryption is enabled on the bucket using SSE-KMS.

Answer

The command removes default encryption from the bucket.

Question 6

Which THREE factors should be considered when designing IAM policies for cross-account access? (Choose three.)

Accepted Answer

The resource-based policy must allow the external account. For cross-account access using resource-based policies (e.g., S3 bucket policies, KMS key policies), the resource-based policy must explicitly grant access to the external AWS account. This allows the external account's IAM principals to access the resource, provided the external account's IAM policy also permits the action. Without this allowance in the resource-based policy, the external account cannot access the resource, even if its own IAM policies allow it.

Answer

Permission boundaries must be used

Answer

Service control policies (SCPs) must allow the action

Question 7

A company stores sensitive data in an Amazon S3 bucket. They want to ensure that data is encrypted in transit when accessed from the internet. Which policy should they attach to the bucket?

Accepted Answer

{"Effect": "Deny", "Principal": "*", "Action": "s3:*", "Resource": "arn:aws:s3:::bucket/*", "Condition": {"Bool": {"aws:SecureTransport": "false"}}}. It uses a Deny effect with the aws:SecureTransport condition set to 'false', which explicitly blocks any request that does not use HTTPS/TLS. This ensures that all S3 operations (s3:*) on the bucket objects require encryption in transit, as any HTTP request will be denied. The Deny effect overrides any Allow, making this a robust policy to enforce encrypted access from the internet.

Answer

{"Effect": "Deny", "Principal": "*", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::bucket/*", "Condition": {"StringNotEquals": {"aws:SourceVpc": "vpc-12345"}}}

Answer

{"Effect": "Allow", "Principal": "*", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::bucket/*", "Condition": {"Bool": {"aws:SecureTransport": "false"}}}

Answer

{"Effect": "Deny", "Principal": "*", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::bucket/*", "Condition": {"IpAddress": {"aws:SourceIp": "0.0.0.0/0"}}}

Question 8

A company uses Amazon RDS for MySQL and wants to monitor database activity for security analysis. Which AWS service should be used to capture detailed database activity logs such as login attempts and query execution?

Accepted Answer

Amazon RDS Database Activity Streams. Amazon RDS Database Activity Streams is the correct service because it captures a near-real-time stream of database activity, including login attempts, query execution, and other operations at the database engine level. It integrates with AWS CloudWatch and third-party monitoring tools, providing granular audit logs for security analysis that go beyond what CloudTrail or Enhanced Monitoring offer.

Answer

AWS CloudTrail

Answer

Amazon RDS Enhanced Monitoring

Answer

AWS Config

Question 9

Which TWO AWS services can be used to detect unauthorized access to an S3 bucket? (Select TWO.)

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior across AWS accounts and workloads. It uses machine learning, anomaly detection, and integrated threat intelligence to analyze S3 data events (e.g., GetObject, PutObject) logged via CloudTrail management and data events, identifying suspicious patterns such as unusual access from a known malicious IP address or an anonymous user gaining access to an S3 bucket.

Answer

AWS WAF

Answer

AWS CloudTrail

Answer

AWS Config

Question 10

Which TWO AWS services can be used to monitor and detect unauthorized changes to Amazon S3 bucket policies? (Choose two.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail is correct because it records all API calls made to Amazon S3, including changes to bucket policies (e.g., PutBucketPolicy, DeleteBucketPolicy). By enabling CloudTrail on the S3 bucket or using a trail that logs data events for S3, you can monitor and detect unauthorized policy modifications in near real-time through the CloudTrail event history or by delivering logs to Amazon CloudWatch Logs for further analysis.

Answer

Amazon GuardDuty

Answer

Amazon CloudWatch Logs

Answer

Amazon VPC Flow Logs

Question 11

Which THREE AWS services can be used to detect potentially compromised EC2 instances? (Choose 3.)

Accepted Answer

VPC Flow Logs. VPC Flow Logs (B) capture IP traffic metadata for ENIs, so you can analyze accepted/rejected flows for signs of compromise such as beaconing to known-bad IPs or unusual outbound traffic. Amazon GuardDuty (D) is a managed threat-detection service that continuously analyzes VPC Flow Logs, CloudTrail events, and DNS logs to identify compromised instances via findings like cryptocurrency mining or communication with malicious hosts. Amazon Inspector (E) scans EC2 instances for software vulnerabilities and unintended network exposure, which helps detect an instance that could be or has been compromised through an exploitable weakness. AWS WAF (A) is a Layer 7 web application firewall that filters HTTP(S) requests to CloudFront, ALB, or API Gateway, not an EC2 compromise-detection service. AWS Shield (C) provides DDoS protection at the network/transport layer and does not detect compromised EC2 instances.

Answer

AWS WAF

Answer

AWS Shield

Question 12

A company uses AWS Organizations and wants to implement a centralized incident response process. Which THREE steps should be taken to ensure that security teams can respond to incidents across all accounts effectively?

Accepted Answer

Create IAM roles in each member account that grant incident responders cross-account access from the security account. Creating IAM roles in each member account with trust policies that allow the security account's incident responders to assume those roles enables centralized, cross-account access for incident response. This follows the principle of least privilege and allows the security team to perform actions (e.g., stopping instances, collecting forensic data) in any affected account without needing separate credentials or direct logins.

Answer

Set up AWS Systems Manager Incident Manager in each account independently

Answer

Create a single CloudTrail trail in the management account to log events from all accounts

Question 13

A company wants to ensure that data stored in Amazon S3 is encrypted at rest using keys managed by AWS. Which encryption option should they choose?

Accepted Answer

Server-side encryption with S3 managed keys (SSE-S3).. SSE-S3 uses AES-256 encryption keys managed entirely by AWS, fulfilling the requirement for encryption at rest with AWS-managed keys. When you upload an object, S3 encrypts it before writing to disk and decrypts it when you access it, all without any customer action or key management overhead.

Answer

Client-side encryption.

Answer

Server-side encryption with AWS KMS (SSE-KMS).

Answer

Server-side encryption with customer-provided keys (SSE-C).

Question 14

A security team needs to audit all changes to IAM policies in their AWS account. Which AWS service should they use to record policy changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made in the AWS account, including IAM policy changes (e.g., CreatePolicy, PutRolePolicy, AttachUserPolicy). These events are captured as CloudTrail log entries, providing a complete audit trail of who made the change, when, and from which source IP. This directly meets the requirement to audit all changes to IAM policies.

Answer

Amazon Inspector

Answer

Amazon GuardDuty

Answer

AWS Config

Question 15

A company uses AWS Organizations with multiple accounts. The security team needs to centralize CloudTrail logs from all accounts into a single S3 bucket in the management account. Which configuration ensures that only the management account can delete the log files?

Accepted Answer

Use an S3 bucket policy that denies s3:DeleteObject unless the principal is the management account.. It uses an S3 bucket policy with a conditional deny that explicitly restricts the s3:DeleteObject action to only the management account. This ensures that even if an IAM user or role in a member account has S3 permissions, they cannot delete log files unless they are from the management account. The policy leverages the aws:PrincipalOrgID or a specific account ID condition to enforce this restriction.

Answer

Enable S3 Object Lock on the bucket with governance mode.

Answer

Use an S3 bucket policy that denies s3:DeleteObject for all principals.

Answer

Enable MFA Delete on the S3 bucket.

Answer

Configure CloudTrail to automatically delete logs older than 90 days.