SCS-C02 Practice Test 39 — 15 Questions

Question 1

A Security Engineer is designing a secure VPC architecture. Which THREE components are essential for creating a public subnet that can host a web server accessible from the internet?

Accepted Answer

Route table with a default route (0.0.0.0/0) pointing to the IGW. A public subnet requires a route table that directs traffic destined for 0.0.0.0/0 to an Internet Gateway (IGW). Without this default route, instances in the subnet cannot send or receive traffic from the internet, even if they have public IP addresses. The IGW acts as the target for this route, enabling bidirectional communication between the VPC and the internet.

Answer

VPN connection to on-premises

Answer

NAT Gateway

Question 2

A company's security engineer is configuring a web application firewall (WAF) to protect a public-facing Application Load Balancer (ALB). The application is vulnerable to SQL injection attacks. Which AWS WAF rule should be used to mitigate this threat?

Accepted Answer

Add a rule from the AWS Managed Rules for SQL injection.. AWS WAF includes managed rule groups specifically designed to detect and block SQL injection attacks by inspecting request parameters, URIs, and headers for malicious SQL patterns. This directly addresses the vulnerability described in the scenario, as SQL injection targets the application's database layer through crafted input.

Answer

Add a rule to block cross-site scripting (XSS) attacks.

Answer

Add a rate-based rule to limit requests per IP.

Answer

Add a geographic match rule to block traffic from specific countries.

Question 3

A security engineer is designing a logging solution for an application that runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The engineer needs to capture and store the following logs for analysis: (1) HTTP request logs from the ALB, (2) operating system logs from the EC2 instances, and (3) network traffic logs for the VPC. Which combination of AWS services should the engineer use? (Choose three.)

Accepted Answer

Enable access logging on the ALB and store logs in an S3 bucket.. ALB access logging captures detailed HTTP request data (method, URI, status code, user agent, etc.) and can be directly configured to store logs in an S3 bucket without additional agents or infrastructure. This satisfies the requirement for HTTP request logs from the ALB.

Answer

Enable S3 server access logging for the application's S3 buckets.

Answer

Enable AWS CloudTrail to capture API calls.

Question 4

A security engineer is designing a secure VPC architecture for a web application that must be accessible from the internet. The application runs on EC2 instances in private subnets. Which THREE components are required to provide secure internet connectivity?

Accepted Answer

Public subnets with routes to the IGW. A is correct because public subnets require routes to the Internet Gateway (IGW) in their route tables to allow traffic from the internet to reach resources in those subnets. For the web application's EC2 instances in private subnets to initiate outbound internet connectivity (e.g., for software updates), a NAT Gateway must be placed in a public subnet with a route to the IGW, and the private subnet's route table must point 0.0.0.0/0 traffic to the NAT Gateway. The IGW attached to the VPC is the foundational component that enables bidirectional internet traffic for the VPC, but it must be explicitly associated with route tables of public subnets.

Answer

Virtual Private Gateway (VGW)

Answer

Transit Gateway

Question 5

A company uses AWS CloudTrail to log all API activity. A security analyst notices that some delete operations on S3 buckets are missing from the CloudTrail logs. What is the MOST likely reason?

Accepted Answer

The trail is configured to log only management events, not data events.. CloudTrail trails can be configured to log management events (control plane operations like CreateBucket) and/or data events (data plane operations like GetObject, DeleteObject). By default, a trail logs only management events. S3 delete operations on objects within a bucket are data events, so if the trail is not configured to log data events, those delete operations will not appear in CloudTrail logs.

Answer

The S3 bucket has server access logging enabled, which overrides CloudTrail.

Answer

The delete operations are performed by a cross-account role, which CloudTrail does not log.

Answer

The root user of the account is excluded from CloudTrail logging.

Question 6

Refer to the exhibit. A security engineer created this S3 bucket policy to allow CloudTrail to deliver logs from account 123456789012 to the bucket my-trail-bucket. However, CloudTrail logs are not being delivered. What is the most likely reason?

Accepted Answer

The policy is missing s3:GetBucketAcl permission.. CloudTrail requires both s3:PutObject and s3:GetBucketAcl permissions on the destination S3 bucket to validate that the bucket policy grants the necessary access. Without s3:GetBucketAcl, CloudTrail cannot confirm the bucket's ACL allows log delivery, causing delivery to fail.

Answer

The Principal should be the CloudTrail service principal for the specific region.

Answer

The Action should be s3:PutObjectAcl instead of s3:PutObject.

Answer

The resource ARN does not include the bucket name.

Question 7

A company is required to audit all changes to IAM policies. Which AWS service should be used to record these changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API activity in your AWS account, including all IAM policy changes made via the AWS Management Console, SDKs, CLI, or AWS services. Each event is captured as a CloudTrail event with details such as the identity making the request, the time of the request, and the request parameters, enabling a complete audit trail of IAM policy modifications.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

Amazon S3

Answer

IAM Access Analyzer

Question 8

A company wants to detect and respond to potential security threats in near real-time. Which THREE AWS services should the company use together? (Select THREE.)

Accepted Answer

AWS Security Hub. AWS Security Hub (A) aggregates security findings from multiple AWS services, including Amazon GuardDuty (E) and Amazon Detective (C), into a single dashboard. GuardDuty provides near real-time threat detection by analyzing VPC Flow Logs, DNS logs, and CloudTrail events using machine learning. Detective automates the investigation of those findings by correlating historical data to identify root causes. Together, these three services enable near real-time detection and response to security threats.

Answer

Amazon Inspector

Answer

AWS CloudTrail

Question 9

A company wants to detect and alert on SSH brute force attacks on EC2 instances. Which AWS service should be used?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior, including SSH brute force attacks. It uses machine learning and integrated threat intelligence to analyze VPC Flow Logs, DNS logs, and CloudTrail events, and can generate findings for 'UnauthorizedAccess:EC2/SSHBruteForce' when repeated failed SSH login attempts are detected.

Answer

AWS Config

Answer

Amazon Inspector

Answer

AWS CloudTrail

Answer

AWS Shield

Question 10

An organization uses AWS CloudTrail with a multi-region trail. The security team suspects that an attacker has deleted logs. Which THREE findings would indicate that log deletion occurred? (Choose THREE.)

Accepted Answer

A `StopLogging` API call from an unknown IP address.. A `StopLogging` API call from an unknown IP address indicates that logging was deliberately disabled, which an attacker could do to cover their tracks. CloudTrail records all `StopLogging` events, and an unexpected source IP is a strong indicator of unauthorized activity. This directly suggests log deletion or suppression, as stopping the trail prevents further log delivery.

Answer

An S3 bucket with MFA Delete enabled.

Answer

Multiple `StartLogging` API calls in the logs.

Question 11

A company wants to receive real-time notifications when specific API calls are made in their AWS account, such as creating a new IAM user. Which AWS service should be used to trigger a notification based on CloudTrail events?

Accepted Answer

Amazon EventBridge. Amazon EventBridge is the correct service because it can ingest CloudTrail events in near real-time and use event rules to match specific API calls, such as CreateUser, and then route those events to targets like SNS topics to send notifications. EventBridge provides a serverless event bus that directly integrates with CloudTrail, enabling you to react to API activity without custom polling or additional infrastructure.

Answer

AWS Config

Answer

Amazon Inspector

Answer

Amazon VPC Flow Logs

Question 12

A company uses AWS Organizations with SCPs. The security team wants to ensure that no IAM user can be created without MFA. Which SCP should be applied at the root OU?

Accepted Answer

Deny iam:CreateUser unless the request includes a condition for MFA. It uses a Service Control Policy (SCP) to deny the `iam:CreateUser` action unless the request includes a condition that MFA is present. SCPs are account-level permission boundaries in AWS Organizations, and this approach ensures that no IAM user can be created without MFA across all accounts in the organization, as SCPs are evaluated before any IAM policies.

Answer

Deny iam:CreateUser unconditionally

Answer

Use an IAM policy to require MFA for API calls

Answer

Attach an IAM policy to all users requiring MFA

Question 13

A security engineer is configuring a VPC for a web application. The VPC has public and private subnets. The web servers are in public subnets and the database servers are in private subnets. The engineer wants to ensure that the database servers are not accessible from the internet. Which two actions should the engineer take?

Accepted Answer

Ensure the route table for the database subnets does not have a default route to an Internet Gateway.. Removing the default route (0.0.0.0/0) to an Internet Gateway (IGW) from the route table associated with the database subnets ensures that traffic from those subnets cannot reach the internet, and the internet cannot initiate connections to instances in those subnets. This is the fundamental network-level isolation required for private subnets in a VPC.

Answer

Place the database instances in a public subnet with a NAT gateway.

Answer

Assign public IP addresses to the database instances.

Answer

Configure a network ACL on the database subnets to deny all inbound traffic.

Question 14

A company wants to detect and respond to potential security threats in near real-time. Which TWO services should the company use together to achieve this? (Choose TWO.)

Accepted Answer

AWS Security Hub. AWS Security Hub (D) aggregates security findings from multiple AWS services, including Amazon GuardDuty, and provides a comprehensive view of security alerts and compliance status. Amazon GuardDuty (E) is a threat detection service that continuously monitors for malicious activity and unauthorized behavior using machine learning and integrated threat intelligence. Together, they enable near real-time detection and response by centralizing findings from GuardDuty in Security Hub, which can trigger automated remediation workflows via Amazon EventBridge.

Answer

AWS Config

Answer

Amazon Inspector

Answer

AWS CloudTrail

Question 15

A company wants to implement automated remediation of security findings from Amazon GuardDuty. Which THREE AWS services can be used together to create an automated response workflow? (Select THREE.)

Accepted Answer

Amazon CloudWatch Events (EventBridge). Amazon GuardDuty sends findings to Amazon CloudWatch Events (EventBridge) as events. You can configure an EventBridge rule to match specific GuardDuty findings and trigger an AWS Lambda function for automated remediation. AWS Step Functions can orchestrate complex remediation workflows involving multiple Lambda functions or other AWS services, providing retry logic and error handling.

Answer

Amazon SQS

Answer

AWS Config