SCS-C02 Practice Test 37 — 15 Questions

Question 1

Which TWO actions can be used to restrict access to an S3 bucket to only requests that originate from a specific VPC?

Accepted Answer

Use an IAM policy with a condition key aws:SourceVpce to restrict access to the VPC endpoint.. The `aws:SourceVpce` condition key in an IAM policy allows you to restrict access to an S3 bucket to requests that originate from a specific VPC endpoint (VPC Endpoint ID). This ensures that only traffic coming through that VPC endpoint can access the bucket, effectively limiting access to the VPC. Option C is also correct because you can configure a VPC endpoint for S3 and attach a bucket policy that explicitly allows access only from that endpoint using the `aws:SourceVpce` condition, achieving the same restriction.

Answer

Use a security group to allow inbound traffic from the VPC to S3.

Answer

Use a network ACL to allow traffic from the VPC to S3.

Answer

Use an IAM policy with a condition key aws:SourceIp to restrict access to the VPC CIDR.

Question 2

A security engineer is reviewing CloudTrail logs and notices an event with the key 'eventType' set to 'AwsServiceEvent'. What does this indicate?

Accepted Answer

The event was initiated by an AWS service.. In AWS CloudTrail, the 'eventType' field indicates the source of the event. When set to 'AwsServiceEvent', it means the event was generated by an AWS service on behalf of the customer, such as automatic backups, scaling actions, or health checks. This is distinct from events initiated by a user or federated identity, which would have 'eventType' set to 'AwsApiCall' or 'AwsConsoleSignIn'.

Answer

The event was initiated by an IAM user via the AWS Management Console.

Answer

The event was a sign-in event from the AWS Management Console.

Answer

The event type is an error in the log.

Question 3

A security engineer needs to monitor for unauthorized changes to IAM roles and policies in an AWS account. The engineer wants to receive an email notification whenever an IAM policy is attached to a role. Which AWS services should be combined to achieve this?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Events (Amazon EventBridge). AWS CloudTrail logs all API calls, including AttachRolePolicy, and CloudWatch Events (EventBridge) can filter for that specific event and trigger an action such as sending an email via SNS. This combination allows real-time monitoring and notification for unauthorized IAM policy attachments to roles.

Answer

Amazon GuardDuty and Amazon Simple Email Service (SES)

Answer

AWS Config and Amazon Simple Notification Service (SNS)

Answer

Amazon Inspector and Amazon CloudWatch Logs

Question 4

A security engineer is designing a monitoring solution for a multi-account AWS environment using AWS Organizations. The solution must provide a centralized view of all API activities and send alerts for suspicious events. Which TWO services together can achieve this? (Choose TWO.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail is correct because it records all API activity across an AWS environment, and when integrated with AWS Organizations, it can deliver a centralized view of API calls from all accounts into a single CloudTrail trail. Amazon CloudWatch Logs is correct because it can ingest CloudTrail logs from a centralized logging account, allowing the security engineer to create metric filters and alarms that trigger alerts for suspicious events based on specific API patterns.

Answer

Amazon GuardDuty

Answer

AWS Lambda

Answer

AWS Config

Question 5

A company uses AWS CloudTrail to log all API activity. The security team needs to retain the logs for 7 years and ensure they are tamper-proof. Additionally, the team must be able to query the logs for investigations. Which solution meets these requirements?

Accepted Answer

Store logs in an Amazon S3 bucket with S3 Object Lock enabled and query using Amazon Athena.. Amazon S3 Object Lock provides a write-once-read-many (WORM) model that prevents logs from being deleted or overwritten, ensuring tamper-proof retention for 7 years. Amazon Athena allows querying the logs directly in S3 using standard SQL, meeting the investigation requirement without needing to move data.

Answer

Store logs in AWS CloudTrail Lake and use the built-in query feature.

Answer

Store logs in Amazon CloudWatch Logs with a retention policy of 7 years.

Answer

Store logs in an Amazon S3 bucket with standard settings and use Amazon S3 Select for querying.

Question 6

A security engineer runs the CLI command above to investigate a console login event. The output shows: {"type":"Root","principalId":"123456789012","arn":"arn:aws:iam::123456789012:root"}. What does this indicate?

Accepted Answer

The AWS account root user performed the console login.. The output shows `"type":"Root"` and `"arn":"arn:aws:iam::123456789012:root"`, which are the exact identifiers AWS CloudTrail uses to record an action performed by the AWS account root user. The root user is the account owner with full administrative access, and its principal ARN always ends with `:root`. This confirms that the console login was performed by the root user, not by any other identity.

Answer

A federated user performed the console login.

Answer

An AWS service performed the console login.

Answer

An IAM user in the account performed the console login.

Question 7

A security engineer is reviewing the SQS queue policy shown in the exhibit. The queue is subscribed to an SNS topic in the same account. The security team has a requirement that only the SNS topic should be allowed to send messages to the queue. What is the issue with this policy?

Accepted Answer

The second statement allows any principal in the 10.0.0.0/8 range to receive messages from the queue.. The second statement in the SQS queue policy allows any principal in the 10.0.0.0/8 IP range to receive messages from the queue, which violates the security requirement that only the SNS topic should be allowed to send messages. The policy should restrict the `sqs:SendMessage` action to the SNS topic using a condition like `aws:SourceArn` and should not include a broad `Effect: Allow` for `sqs:ReceiveMessage` without restricting the principal or source.

Answer

The policy does not specify a principal, so it will not work.

Answer

The aws:SourceArn condition uses ArnLike which is deprecated.

Answer

The aws:SourceIp condition cannot be used with SQS queue policies.

Question 8

A company runs a critical application on EC2 instances behind an Application Load Balancer. The security team suspects that a DDoS attack is targeting the application. Which AWS service can be used to absorb and mitigate the attack at the network layer before traffic reaches the ALB?

Accepted Answer

AWS Shield Advanced. AWS Shield Advanced provides enhanced protections against larger and more sophisticated DDoS attacks, including network-layer (Layer 3/4) attacks such as UDP floods, SYN floods, and reflection attacks. It integrates directly with Application Load Balancers to absorb and mitigate malicious traffic before it reaches the ALB, ensuring the application remains available. This makes it the correct choice for mitigating a DDoS attack at the network layer.

Answer

AWS WAF

Answer

AWS Identity and Access Management (IAM)

Answer

Network ACLs

Question 9

A security engineer is analyzing VPC Flow Logs and sees the entry above. The source IP 203.0.113.5 is flagged as suspicious. What additional information would help determine if this is malicious?

Accepted Answer

CloudTrail logs for any `ConsoleLogin` or `AssumeRole` events from 203.0.113.5.. VPC Flow Logs capture network traffic metadata (IPs, ports, protocols) but not the identity or authentication context of the source. CloudTrail logs record API calls, including ConsoleLogin and AssumeRole events, which can reveal whether 203.0.113.5 is associated with an authenticated user or role. If no such events exist, the traffic is likely from an unauthenticated external source, strengthening the case for malicious activity.

Answer

The source port used by 203.0.113.5.

Answer

Network ACL changes associated with the destination subnet.

Answer

Amazon GuardDuty findings for the destination 10.0.1.5.

Question 10

Which TWO AWS services can be used to automatically block malicious IP addresses at the network perimeter? (Select TWO.)

Accepted Answer

Network ACLs. Network ACLs (NACLs) are stateless virtual firewalls that operate at the subnet level in a VPC. They can be configured with inbound and outbound rules to explicitly deny traffic from specific IP addresses, effectively blocking malicious IPs at the network perimeter before they reach the instances.

Answer

Amazon Route 53

Answer

Security Groups

Answer

AWS Shield Advanced

Question 11

A company is using AWS CloudFormation to deploy a web application. The template includes an EC2 instance with a security group that allows inbound HTTP traffic from 0.0.0.0/0. The security team wants to ensure that this security group is never used in production. Which AWS service can automatically remediate this noncompliant configuration?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides managed rules (e.g., 'restricted-ssh' or 'incoming-ssh-disabled') that can evaluate security group configurations against desired compliance. When a noncompliant resource is detected, AWS Config can trigger an automatic remediation action via Systems Manager Automation documents (e.g., AWSConfigRemediation-RevokeUnusedSecurityGroupIngress) to remove the overly permissive inbound rule. This directly addresses the security team's requirement to prevent the use of a security group allowing HTTP traffic from 0.0.0.0/0 in production.

Answer

AWS Identity and Access Management (IAM)

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Question 12

An organization has a requirement to retain all security logs for at least 7 years for compliance. The logs are stored in Amazon S3 and are rarely accessed. Which storage class is the MOST cost-effective for this retention period?

Accepted Answer

S3 Glacier Deep Archive. S3 Glacier Deep Archive is the most cost-effective storage class for data that is rarely accessed and must be retained for 7 years. It offers the lowest storage cost among S3 classes, designed specifically for long-term retention of archival data where retrieval times of 12 hours are acceptable. The compliance requirement for 7-year retention aligns perfectly with Glacier Deep Archive's intended use case, minimizing costs while meeting the retention mandate.

Answer

S3 Standard

Answer

S3 One Zone-IA

Answer

S3 Intelligent-Tiering

Question 13

A company uses AWS CloudTrail and wants to ensure that logs are encrypted at rest using a customer-managed KMS key. The CloudTrail trail is configured to deliver logs to an S3 bucket. After enabling SSE-KMS on the S3 bucket, the logs are not being delivered. What is the most likely cause?

Accepted Answer

The KMS key policy does not grant CloudTrail permission to use the key.. CloudTrail requires explicit permissions in the KMS key policy to use the key for encrypting log files. Even if SSE-KMS is enabled on the S3 bucket, CloudTrail must have `kms:GenerateDataKey` and `kms:Decrypt` permissions granted via the key policy. Without these, CloudTrail cannot encrypt the logs, causing delivery to fail.

Answer

CloudTrail does not support SSE-KMS.

Answer

The KMS key is in a different AWS account.

Answer

The S3 bucket policy does not allow CloudTrail to write logs.

Question 14

A company requires real-time analysis of AWS CloudTrail logs to detect unauthorized API calls. The logs are stored in Amazon S3. Which architecture minimizes latency and cost?

Accepted Answer

Send CloudTrail logs to Amazon CloudWatch Logs, then use a subscription filter to Amazon Kinesis Data Firehose delivering to Amazon OpenSearch Service. It provides the lowest-latency path for real-time analysis: CloudTrail logs are delivered to CloudWatch Logs in near real-time, and a subscription filter streams them to Kinesis Data Firehose, which buffers and delivers directly to Amazon OpenSearch Service for immediate indexing and search. This architecture avoids batch processing, minimizes data movement overhead, and uses managed services that scale automatically, keeping both latency and cost low.

Answer

Use AWS Glue to crawl S3 and load into Amazon Redshift for analysis

Answer

Query CloudTrail logs directly using Amazon Athena

Answer

Configure S3 event notifications to invoke an AWS Lambda function that writes to Amazon OpenSearch Service

Question 15

A company uses AWS CloudTrail to log API calls. They want to ensure that log files are encrypted at rest and that integrity is verified. Which TWO services can be used together to achieve this?

Accepted Answer

CloudTrail log file integrity validation. CloudTrail log file integrity validation (option C) provides a built-in mechanism to verify that log files have not been modified, deleted, or tampered with after delivery. It uses SHA-256 hashing and digital signatures (based on RSA) to create a digest file that can be independently validated. AWS KMS (option D) allows you to encrypt CloudTrail log files at rest using server-side encryption (SSE-KMS), ensuring that the logs are stored in an encrypted format. Together, they meet both the encryption-at-rest and integrity verification requirements.

Answer

S3 Inventory

Answer

AWS CloudHSM

Answer

S3 MFA Delete