SCS-C02 Practice Test 4 — 10 Questions

Question 1

A company uses AWS Organizations with multiple accounts. The security team wants to detect and automatically respond to suspicious API calls across all accounts. Which solution is the MOST efficient and scalable?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable AWS CloudTrail organization trail and use Amazon EventBridge to invoke automated responses. Enabling an AWS CloudTrail organization trail centrally logs all API calls from every account in the AWS Organization into a single Amazon S3 bucket and CloudWatch Logs log group. Amazon EventBridge can then be used to create event rules that match specific suspicious API calls (e.g., IAM DeleteRolePolicy) and automatically invoke target actions like AWS Lambda functions or AWS Systems Manager Automation, providing a scalable, centralized, and efficient detection and response mechanism without per-account management overhead.

Answer

Use AWS Config rules to detect API calls and trigger Lambda functions

Answer

Deploy Amazon GuardDuty and use its automated response feature

Answer

Create a CloudTrail trail in each account and aggregate logs via cross-account S3 bucket

Question 2

Which TWO AWS services can be used to centrally manage and audit permissions across multiple AWS accounts? (Choose two.)

Accepted Answer

AWS Organizations. AWS Organizations provides a central view of all accounts and can apply SCPs. IAM Access Analyzer analyzes resource policies across accounts to identify public or cross-account access. AWS Config evaluates resource configurations but does not centrally manage permissions. AWS CloudTrail logs API calls but does not manage permissions. AWS SSO manages user access but not resource permissions.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

AWS Single Sign-On

Question 3

A security engineer runs the above CloudTrail lookup command to investigate a change to the S3 bucket policy. The command only returns one event, but the engineer knows that the bucket policy was changed multiple times. What is the most likely reason?

Accepted Answer

The command is limiting results to one event.. The command uses --max-results 1, limiting output to one event. Option A is wrong because changes through the AWS Management Console are logged by CloudTrail. Option B is wrong because PutBucketPolicy is supported by CloudTrail and the event shown confirms it. Option C is wrong because filtering by ResourceName is not the issue; the --max-results parameter is the cause.

Answer

The bucket policy changes were made through the AWS Management Console, which is not logged.

Answer

The event is not logged because PutBucketPolicy is not supported by CloudTrail.

Answer

The command is filtering by the wrong attribute.

Question 4

A company is using AWS KMS to encrypt S3 objects. The security team wants to ensure that only a specific IAM role can decrypt objects in a particular S3 bucket. Which KMS key policy configuration should be used?

Accepted Answer

Add a condition that allows decrypt only when kms:ViaService is s3.amazonaws.com and the caller role matches the specific role ARN.. A KMS key policy with a condition restricting kms:Decrypt to the specific IAM role ARN and kms:ViaService set to s3.amazonaws.com ensures only that role, acting through S3, can decrypt objects. This is the authoritative control because KMS key policies govern all access to the CMK, and the ViaService condition prevents the role from using the key directly outside S3.

Answer

Use an S3 bucket policy that denies decrypt for all principals except the specific IAM user.

Answer

Configure the IAM role with a policy that allows kms:Decrypt for the specific KMS key.

Answer

Attach a resource-based policy to the S3 bucket that grants decrypt permission to the IAM role.

Question 5

A company uses AWS Organizations with all features enabled. The security team needs to ensure that no member account can disable AWS CloudTrail logging or delete CloudTrail logs stored in S3. Which combination of preventive controls should be implemented?

Accepted Answer

Apply a service control policy (SCP) at the root OU to deny CloudTrail and S3 delete actions, and enable CloudTrail organizational trail.. The most effective preventive controls are applying a Service Control Policy (SCP) at the root OU to deny CloudTrail stop/delete and S3 delete actions, combined with enabling an organizational trail in CloudTrail. SCPs enforce guardrails across all member accounts, preventing even account administrators from disabling logging or deleting logs, while the organizational trail ensures centralized logging to a protected S3 bucket.

Answer

Set up CloudWatch alarms to notify when CloudTrail is modified or logs are deleted.

Answer

Use IAM policies in each member account to deny CloudTrail and S3 delete actions.

Answer

Apply an S3 bucket policy denying delete actions, and enable CloudTrail organizational trail.

Question 6

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that no resources can be created in a specific AWS Region except for the us-east-1 Region. Which policy type should the security team use?

Accepted Answer

Service control policy (SCP). Service control policies (SCPs) are the correct choice because they allow you to centrally control the maximum available permissions for all accounts in an AWS Organization. By applying an SCP that denies all actions in a specific region (except us-east-1), the security team can enforce a region restriction across all member accounts, regardless of any IAM policies attached to users or roles. SCPs do not grant permissions themselves but act as a guardrail that limits what IAM policies can allow.

Answer

IAM permissions boundary

Answer

IAM policy applied to the root user

Answer

Resource-based policy

Question 7

A company has an EC2 instance that needs to access an S3 bucket. The security team wants to use the principle of least privilege. Which method should be used to grant access?

Accepted Answer

Create an IAM role with an S3 access policy and attach it to the EC2 instance profile.. It follows the principle of least privilege by using an IAM role with a scoped S3 access policy, which is then attached to the EC2 instance profile. This allows the EC2 instance to obtain temporary security credentials from the AWS STS service, avoiding long-term access keys and ensuring permissions are granted only as needed.

Answer

Use a security group to allow outbound traffic to S3.

Answer

Store AWS access keys on the instance and use them in the application.

Answer

Create a bucket policy that grants access to the EC2 instance ID.

Question 8

A security engineer is investigating a potential security incident and needs to determine if an EC2 instance was launched with a specific AMI ID. Which AWS log should be examined?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records all API calls made within an AWS account, including the RunInstances API call that launches an EC2 instance. The CloudTrail event for RunInstances contains the AMI ID in the request parameters, allowing you to determine if a specific AMI was used. This makes CloudTrail the correct log to examine for this investigation.

Answer

AWS Config timeline

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs (EC2 agent logs)

Question 9

A security engineer notices that an S3 bucket containing sensitive logs is publicly accessible. Which service should be used to automatically remediate this by applying a bucket policy?

Accepted Answer

AWS Config. AWS Config is the correct service because it can continuously monitor S3 bucket configurations and automatically remediate non-compliant resources using AWS Config Rules and AWS Systems Manager Automation documents. When a rule detects that an S3 bucket is publicly accessible, it can trigger an automatic remediation action, such as applying a bucket policy that denies all public access, without manual intervention.

Answer

Amazon GuardDuty

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Question 10

A company wants to ensure that all API calls made to their AWS account are logged and immutable. They have enabled AWS CloudTrail and are delivering logs to an S3 bucket. The security team requires that logs cannot be deleted or modified by anyone, including the root user. What should they do?

Accepted Answer

Enable S3 Object Lock with Compliance retention mode on the bucket.. S3 Object Lock in Compliance mode prevents any principal — including the root user and AWS itself — from deleting or overwriting an object version until its retention period expires. This is the only option that provides true WORM (write once, read many) immutability for CloudTrail logs. It satisfies the requirement that logs cannot be deleted or modified by anyone, including root.

Answer

Enable MFA Delete on the S3 bucket.

Answer

Enable S3 Versioning on the bucket.

Answer

Add a bucket policy that denies s3:DeleteObject for all principals.