SCS-C02 Practice Test 38 — 15 Questions

Question 1

A security engineer is designing a network segmentation strategy for a VPC that hosts sensitive data. The engineer needs to ensure that EC2 instances in a private subnet can communicate with an RDS database in a different private subnet, but cannot communicate with any other resources in the same VPC. Which configuration should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure security groups for the EC2 instances that only allow outbound traffic to the RDS security group, and RDS security group allows inbound from the EC2 security group.. Security groups act as a virtual firewall at the instance level, allowing stateful traffic filtering. By configuring the EC2 security group to allow outbound traffic only to the RDS security group (using the security group ID as the destination), and the RDS security group to allow inbound traffic only from the EC2 security group, you create a precise, bidirectional allowlist. This ensures that EC2 instances can communicate exclusively with the RDS database, blocking all other traffic within the VPC without relying on IP addresses or subnet CIDRs.

Answer

Create a VPC peering connection between the subnets.

Answer

Assign the same security group to both the EC2 instances and the RDS database.

Answer

Use network ACLs with deny rules for all traffic except between the two subnets.

Question 2

A security engineer is investigating a potential data exfiltration incident where an attacker used a compromised EC2 instance to transfer data to an external IP. Which TWO AWS services can provide evidence of the network traffic and the API calls made from the instance?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture metadata about IP traffic going to and from network interfaces, including the source/destination IP, ports, protocol, and packet/byte counts. This provides direct evidence of data being transferred to an external IP address from the compromised EC2 instance. AWS CloudTrail records API calls made within the AWS environment, such as those executed by the EC2 instance's IAM role or the instance itself (e.g., via the AWS CLI or SDK), which can reveal actions like starting data transfers or modifying security groups to allow exfiltration.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Question 3

A company uses Amazon GuardDuty and has enabled EKS audit logs as a data source. The security team wants to detect potential container escape attempts. Which TWO findings would indicate a container escape attempt? (Choose TWO.)

Accepted Answer

PrivilegeEscalation:EKS/KubernetesAPICallFromContainer. The PrivilegeEscalation:EKS/KubernetesAPICallFromContainer finding specifically detects when a container makes Kubernetes API calls that indicate an attempt to escalate privileges, such as creating pods with elevated permissions or accessing cluster-admin roles. This is a direct indicator of a container escape attempt, as the container is interacting with the Kubernetes control plane to gain unauthorized access to the host or other resources.

Answer

Execution:ECS/SuspiciousCommand

Answer

UnauthorizedAccess:EC2/SSHBruteForce

Answer

CryptoCurrency:EC2/BitcoinTool.B

Question 4

Which TWO AWS services can be used to centrally collect and analyze logs from multiple AWS accounts? (Choose two.)

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs can centrally collect logs from multiple AWS accounts by using cross-account subscription filters or by aggregating logs into a central account via CloudWatch Logs destination. This enables centralized monitoring and analysis of log data from various sources, meeting the requirement for a multi-account log collection and analysis solution.

Answer

AWS CloudTrail

Answer

Amazon Kinesis Data Firehose

Answer

Amazon Athena

Question 5

Refer to the exhibit. A security engineer runs the AWS CLI command to look up console login events. The output shows two successful login events for user1 within 5 minutes. What should the engineer suspect?

Accepted Answer

The user's credentials may be compromised.. Two successful console login events for the same user within 5 minutes, especially from different source IP addresses or user agents, is a strong indicator of credential compromise. An attacker who has obtained the user's password can log in while the legitimate user is also active, creating overlapping sessions. AWS CloudTrail records the `ConsoleLogin` event with details like `sourceIPAddress` and `userAgent`, which the engineer should examine to confirm whether the logins originated from different locations or devices.

Answer

The user created a new access key.

Answer

The user's account is being used by multiple users.

Answer

The user has disabled multi-factor authentication (MFA).

Question 6

A security team needs to monitor for failed login attempts to an EC2 instance running Linux. The team wants to send a real-time alert when more than 10 failed SSH attempts occur within 5 minutes. Which solution is the most efficient?

Accepted Answer

Install the CloudWatch Logs agent on the EC2 instance to stream /var/log/secure to CloudWatch Logs. Create a metric filter for 'Failed password' and set a CloudWatch alarm.. The CloudWatch Logs agent can stream /var/log/secure (which logs SSH authentication events) to CloudWatch Logs. A metric filter on the 'Failed password' pattern counts failed SSH attempts, and a CloudWatch alarm with a threshold of 10 within a 5-minute period triggers a real-time alert. This is the most efficient solution as it directly monitors the specific log source for SSH failures without additional overhead.

Answer

Enable VPC Flow Logs and filter for SSH traffic to detect failed attempts.

Answer

Configure the EC2 instance to write failed attempts to a file in S3 and use S3 events to trigger a Lambda function for alerting.

Answer

Enable Amazon GuardDuty and create a custom threat list for failed SSH attempts.

Question 7

A security engineer needs to monitor AWS API calls for potential unauthorized access. The engineer wants to be alerted when a specific IAM user performs a high-risk action like deleting a CloudTrail trail. What is the MOST efficient way to achieve this?

Accepted Answer

Create a CloudWatch Events rule that matches the API call and sends an SNS notification.. CloudWatch Events (now part of Amazon EventBridge) can directly capture AWS API calls from CloudTrail in near real-time. By creating a rule that matches the specific API call (e.g., `DeleteTrail`) from a specific IAM user, you can trigger an SNS notification instantly without the latency or cost of log shipping, metric filters, or periodic queries. This is the most efficient method for real-time alerting on specific API actions.

Answer

Configure CloudTrail to send logs to CloudWatch Logs and create a metric filter with an alarm.

Answer

Enable VPC Flow Logs and analyze with Elasticsearch.

Answer

Use Amazon Athena to query CloudTrail logs daily for the action.

Answer

Enable Amazon GuardDuty with a custom threat list.

Question 8

A company wants to use AWS CloudTrail to monitor data events for all S3 buckets. Which THREE steps are necessary? (Choose THREE.)

Accepted Answer

Specify an S3 bucket to store the log files. CloudTrail requires a destination S3 bucket to store the log files it generates. Without specifying a bucket, the trail cannot persist logs, and this bucket must have appropriate bucket policies to allow CloudTrail to write logs. This is a mandatory step when creating any trail, whether for management or data events.

Answer

Create a CloudWatch Events rule to forward data events

Answer

Enable CloudTrail Insights to detect unusual data access

Question 9

A company uses AWS CloudTrail to log all API calls. The security team wants to ensure that any attempt to disable CloudTrail logging is detected and alerted within minutes. Which solution should they implement?

Accepted Answer

Create a CloudWatch metric filter on CloudTrail logs for StopLogging or DeleteTrail events and set an alarm.. CloudTrail logs API calls like `StopLogging` and `DeleteTrail` to CloudWatch Logs. By creating a metric filter on these specific event names and setting a CloudWatch alarm, the security team can receive near-real-time alerts within minutes of any attempt to disable CloudTrail logging, meeting the detection requirement.

Answer

Use Amazon GuardDuty to monitor for disablement events.

Answer

Create an AWS Config rule to detect when CloudTrail is disabled.

Answer

Configure S3 event notifications on the CloudTrail bucket.

Question 10

A company has enabled CloudTrail in all regions and is logging to a single S3 bucket. The security team needs to ensure that any attempted deletion of CloudTrail logs generates an immediate alert. Which solution meets this requirement?

Accepted Answer

Configure an S3 event notification on the bucket for s3:ObjectRemoved:* events, invoke a Lambda function to publish to an SNS topic.. S3 event notifications can be configured to trigger a Lambda function on `s3:ObjectRemoved:*` events, which captures all object deletion actions (including DeleteObject and DeleteObjects API calls). The Lambda function can then publish a message to an SNS topic, enabling immediate alerting. This approach provides real-time, event-driven monitoring directly from S3, without relying on CloudTrail log ingestion delays.

Answer

Use AWS Config to create a rule that checks for deleted objects and sends an SNS notification.

Answer

Enable CloudTrail Insights to detect unusual deletion activity and send alerts.

Answer

Create a CloudWatch Logs metric filter on the CloudTrail log group for DeleteObject events and trigger an alarm.

Question 11

A security engineer needs to detect and respond to suspicious activity on an Amazon RDS database. Which TWO services can be used together to monitor database activity and trigger automated remediation?

Accepted Answer

AWS Lambda. AWS Lambda is correct because it can be triggered by Amazon RDS database activity streams (e.g., via Amazon RDS for MySQL or PostgreSQL) or by Amazon CloudWatch Events/EventBridge rules that detect suspicious database events (such as failed login attempts or unusual query patterns). Lambda functions can then execute automated remediation actions, such as revoking database access, rotating credentials, or isolating the database instance. This enables a serverless, event-driven response to threats without manual intervention.

Answer

Amazon Detective

Answer

Amazon RDS Enhanced Monitoring

Answer

Amazon RDS Performance Insights

Question 12

A company needs to monitor for unauthorized S3 bucket deletions. Which CloudWatch Logs metric filter should be used on CloudTrail logs?

Accepted Answer

eventName = DeleteBucket. The CloudTrail event `DeleteBucket` is logged when an S3 bucket is deleted. By creating a CloudWatch Logs metric filter that matches `eventName = DeleteBucket` on the CloudTrail log group, you can trigger an alarm or automated response to detect unauthorized bucket deletions. This directly addresses the monitoring requirement.

Answer

eventName = GetBucketAcl

Answer

eventName = PutBucketPolicy

Answer

eventName = ListBuckets

Question 13

During a security incident, a security engineer needs to capture network traffic between an EC2 instance and an attacker's IP address for forensic analysis. The engineer has already identified the attacker's IP from CloudTrail logs. Which action captures the traffic without affecting the instance?

Accepted Answer

Create a VPC Traffic Mirroring session targeting the instance's ENI and mirror the traffic to a Network Load Balancer for capture.. VPC Traffic Mirroring captures all network traffic at the Elastic Network Interface (ENI) level without any performance impact or configuration change on the EC2 instance itself. It copies the traffic to a Network Load Balancer (NLB) or another target for capture and analysis, making it ideal for forensic investigation without disrupting the running instance.

Answer

Update the network ACL to log all traffic to and from the attacker's IP.

Answer

Enable VPC Flow Logs on the subnet and query logs for the attacker's IP.

Answer

SSH into the instance and run tcpdump with a filter for the attacker's IP.

Question 14

The above IAM policy is attached to an AWS Lambda function. The function is failing to write logs to CloudWatch Logs. What is the likely cause?

Accepted Answer

The resource ARN does not include the log group itself; only log streams. The IAM policy grants `logs:CreateLogStream` and `logs:PutLogEvents` with a resource ARN that correctly targets log streams under the specified log group. However, the policy lacks any statement that grants permission on the log group resource itself. If the log group does not already exist, the Lambda function requires `logs:CreateLogGroup` permission on the log group ARN (`arn:aws:logs:us-east-1:123456789012:log-group:MyLogGroup`) to create it. Without this, the function cannot create the log group, causing the write to fail. The resource ARN in the policy does not include the log group itself, only log streams, which is why the function lacks the necessary permissions to interact with the log group resource.

Answer

The actions list does not include logs:DescribeLogGroups

Answer

The policy is missing an explicit deny for other actions

Answer

The region in the ARN does not match the Lambda function's region

Question 15

A company has a VPC with a public subnet and a private subnet. They launch an EC2 instance in the private subnet with a default security group that allows all outbound traffic. The instance needs to download files from an S3 bucket in the same region. Which configuration allows this without internet access?

Accepted Answer

Create a VPC gateway endpoint for S3 and add a route to the private subnet's route table.. A VPC gateway endpoint for S3 allows instances in a private subnet to access S3 without traversing the internet. By adding a route to the private subnet's route table that points to the endpoint, traffic destined for S3 stays within the AWS network. The default security group's outbound rule permits all traffic, so no additional security group changes are needed.

Answer

Set up an AWS Direct Connect connection to the S3 bucket.

Answer

Attach an internet gateway to the VPC and add a route to the private subnet.

Answer

Create a NAT gateway in the public subnet and add a route to the private subnet's route table.