SCS-C02 Practice Test 40 — 15 Questions

Question 1

Which THREE actions can be performed using AWS CloudTrail to enhance security monitoring?

Accepted Answer

Detect unauthorized API calls by analyzing CloudTrail logs.. AWS CloudTrail records API activity in your AWS account, including calls to IAM, S3, and other services. By analyzing CloudTrail logs, you can detect unauthorized API calls (Option B) because every API call is logged with details such as the identity, source IP, and timestamp, enabling security monitoring and alerting on suspicious actions.

Answer

Monitor SSH login attempts to EC2 instances.

Answer

Capture all network traffic to and from EC2 instances.

Question 2

A security team is designing an automated incident response system. The system must meet the following requirements: (1) automatically respond to GuardDuty findings, (2) ensure that response actions are logged and immutable, and (3) allow for human approval before destructive actions. Which services should the team use? (Select THREE.)

Accepted Answer

Amazon EventBridge. Amazon EventBridge (A) is correct because it can receive GuardDuty findings in near real-time and route them to downstream targets for automated response. This enables the first requirement by triggering workflows directly from GuardDuty events without custom polling.

Answer

AWS Lambda

Answer

Amazon Simple Notification Service (SNS)

Question 3

Which TWO actions can be performed using AWS IAM? (Choose two.)

Accepted Answer

Define a password policy for IAM users. AWS IAM allows you to define a password policy for IAM users, which enforces complexity requirements, rotation periods, and reuse prevention. This is a core IAM feature that helps secure user credentials without relying on external identity providers.

Answer

Change the instance type of an RDS database

Answer

Create a CloudFront distribution

Answer

Configure a VPC peering connection

Question 4

A company needs to ensure that data in transit between an on-premises data center and Amazon S3 is encrypted. Which AWS service should be used to establish a dedicated encrypted connection?

Accepted Answer

AWS Direct Connect with VPN. AWS Direct Connect provides a dedicated, private network connection from an on-premises data center to AWS, but it does not inherently encrypt data in transit. By combining Direct Connect with a VPN (IPsec tunnel), you get both a dedicated connection and encryption of all traffic between the on-premises network and Amazon S3. This ensures data in transit is protected while avoiding the public internet.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

AWS Client VPN

Question 5

Which TWO actions are valid ways to send application logs from an EC2 instance to Amazon CloudWatch Logs? (Select TWO.)

Accepted Answer

Install and configure the unified CloudWatch agent on the EC2 instance.. The unified CloudWatch agent (option C) is a valid and recommended method for collecting application logs from EC2 instances and sending them to CloudWatch Logs. It supports collecting logs from various sources, including syslog, and can also collect metrics, providing a single agent for both monitoring and logging.

Answer

Configure the EC2 instance to stream syslog to AWS CloudTrail.

Answer

Write logs to an S3 bucket and use S3 event notifications to send to CloudWatch Logs.

Answer

Enable VPC Flow Logs to capture application traffic.

Question 6

Which TWO AWS services can be used to centrally collect and analyze logs from multiple AWS accounts? (Select TWO.)

Accepted Answer

Amazon Athena (to query logs in S3). Amazon S3 can serve as a centralized log repository by aggregating logs from multiple AWS accounts using cross-account S3 bucket policies. Amazon Athena can then query those logs directly in S3 using standard SQL, enabling centralized analysis without moving data. Together, they provide a scalable, serverless solution for multi-account log collection and analysis.

Answer

AWS Config

Answer

Amazon Inspector

Answer

AWS Shield

Question 7

A security engineer is investigating a potential compromise. The engineer has captured a memory dump from an EC2 instance and needs to analyze it for malware. Which TWO actions should the engineer take to preserve the chain of custody? (Choose TWO.)

Accepted Answer

Record the date, time, and digital signature of the acquisition.. Recording the date, time, and digital signature of the acquisition establishes a clear audit trail, which is essential for proving that the evidence has not been tampered with. In forensic investigations, this metadata is part of the standard chain-of-custody documentation that demonstrates who collected the evidence, when, and that it remains unaltered. A digital signature (e.g., using a tool like gpg or a signed hash) provides non-repudiation and integrity verification beyond a simple hash.

Answer

Create an EBS snapshot of the instance's root volume.

Answer

Analyze the memory dump on the same EC2 instance.

Answer

Upload the memory dump to a public S3 bucket for analysis.

Question 8

A security engineer is designing a VPC with private and public subnets. Which TWO actions improve network security? (Choose two.)

Accepted Answer

Use security groups to restrict traffic to the database from only the application tier.. Security groups act as a stateful virtual firewall at the instance level, allowing you to restrict inbound traffic to the database instances to only the application tier's security group. This ensures that only traffic originating from the application instances can reach the database, effectively implementing a least-privilege security model.

Answer

Use a single subnet for all resources to simplify network rules.

Answer

Place database instances in a public subnet for easier management.

Answer

Place an internet gateway in a private subnet.

Question 9

A security engineer needs to collect and analyze operating system logs from EC2 instances. Which TWO services are required?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is the service that stores, monitors, and accesses operating system logs from EC2 instances. However, to collect and send those logs to CloudWatch Logs, you must install and configure the Amazon CloudWatch Agent on the EC2 instances. The CloudWatch Agent can collect logs from the OS (e.g., /var/log/syslog, /var/log/messages, Windows Event Log) and forward them to CloudWatch Logs for analysis.

Answer

Amazon VPC Flow Logs

Answer

AWS Config

Answer

AWS CloudTrail

Question 10

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that no IAM user can have an access key older than 90 days. What is the MOST efficient way to achieve this?

Accepted Answer

Use an SCP in the root organizational unit that denies IAM actions if the access key age exceeds 90 days.. A service control policy (SCP) applied at the root organizational unit centrally enforces the 90-day access key age limit across all accounts. SCPs can use a condition like 'aws:AccessKeyAge' to deny actions (e.g., 'iam:CreateAccessKey') when the age exceeds 90 days. This is the most efficient because it's a single policy that applies to all accounts without per-account configuration or manual auditing.

Option B (AWS Config) is reactive—it only sends alerts and does not prevent excessive key age.

Option C (IAM policy in each account) requires deploying a policy to every account individually, which is less efficient and prone to gaps.

Option D disables IAM user creation entirely, which is too restrictive and does not address existing old access keys.

Answer

Use AWS Config rules to detect old access keys and send alerts.

Answer

Use an IAM policy in each account that denies access if the key age exceeds 90 days.

Answer

Use an SCP to disable IAM user creation.

Question 11

A security engineer is configuring an automated incident response workflow for Amazon GuardDuty findings. Which TWO actions should the engineer take to ensure that the response is triggered for all current and future GuardDuty findings?

Accepted Answer

Create an Amazon EventBridge rule with an event pattern that matches GuardDuty finding events.. Amazon EventBridge can capture all GuardDuty findings by using an event pattern that matches the 'GuardDuty Finding' event type. This ensures that both current and future findings automatically trigger the rule without requiring manual updates or additional configuration.

Answer

Enable GuardDuty to export findings to CloudWatch Logs and then create a metric filter.

Answer

Create an Amazon SNS topic and subscribe the Lambda function to it, then configure GuardDuty to publish to SNS.

Answer

Set up a CloudWatch Logs subscription filter to forward GuardDuty logs to the Lambda function.

Question 12

Which TWO AWS services are designed to provide DDoS protection? (Choose 2.)

Accepted Answer

AWS WAF. AWS WAF (Option D) is a web application firewall that helps protect web applications from common web exploits that could affect application availability, compromise security, or consume excessive resources. It integrates with Amazon CloudFront, Application Load Balancer, and API Gateway to filter and monitor HTTP(S) requests, providing protection against layer 7 DDoS attacks such as SQL injection and cross-site scripting.

Answer

VPC Flow Logs

Answer

AWS CloudTrail

Answer

AWS Config

Question 13

Refer to the exhibit. A security engineer configured this S3 bucket policy to allow CloudTrail to deliver logs. However, logs are not being delivered. What is the MOST likely reason?

Accepted Answer

The policy is missing s3:GetBucketAcl permission for CloudTrail.. CloudTrail requires the s3:GetBucketAcl permission on the S3 bucket to verify that the bucket policy grants the necessary access for log delivery. Without this permission, CloudTrail cannot confirm it has write access, and log delivery fails even if s3:PutObject is allowed. Option D correctly identifies this missing permission as the root cause.

Answer

The Resource should be arn:aws:s3:::my-trail-bucket/*, not with AWSLogs prefix.

Answer

The Principal is set to a service, but must be an AWS account ID.

Answer

The Action should be s3:GetObject, not s3:PutObject.

Question 14

A company's AWS Lambda function that processes sensitive data is triggering unexpectedly. The security team wants to investigate using AWS CloudTrail. What should they look for?

Accepted Answer

`Invoke` events in CloudTrail from the Lambda service.. `Invoke` events in CloudTrail record every invocation of a Lambda function, including the source (e.g., AWS service, SDK, or console) and the identity that triggered it. By analyzing these events, the security team can identify unexpected triggers, such as unauthorized IAM users or roles invoking the function, or anomalous invocation patterns that indicate a potential security issue.

Answer

`UpdateFunctionConfiguration` events in CloudTrail from the Lambda service.

Answer

`CreateFunction` events in CloudTrail from the Lambda service.

Answer

`PutSubscriptionFilter` events in CloudTrail from CloudWatch Logs.

Question 15

A company wants to receive notifications when AWS CloudTrail logs are delivered to an S3 bucket. Which TWO AWS services can be used together to achieve this? (Choose TWO.)

Accepted Answer

Amazon S3 Event Notifications. Amazon S3 Event Notifications can be configured to publish events (like `s3:ObjectCreated:*`) when CloudTrail logs are delivered to the S3 bucket. These notifications can be sent directly to Amazon SNS, which then delivers the notification to subscribers (e.g., email, SMS, or HTTP endpoints). Together, S3 Event Notifications and SNS provide a serverless, real-time notification pipeline without needing custom polling or compute resources.

Answer

AWS CloudTrail

Answer

AWS Lambda

Answer

Amazon Simple Queue Service (SQS)