SCS-C02 Practice Test 41 — 15 Questions

Question 1

Which TWO actions are effective for detecting and responding to unauthorized access in an AWS environment? (Choose two.)

Accepted Answer

Enable AWS CloudTrail and monitor logs for suspicious activity.. AWS CloudTrail records all API activity in your AWS environment, including management and data plane events. By enabling CloudTrail and monitoring its logs for suspicious activity (e.g., unusual API calls, failed authentication attempts, or access from unexpected IP addresses), you can detect unauthorized access. This is a foundational detective control that provides the audit trail necessary for incident response.

Answer

Use AWS Security Hub to automatically block suspicious IP addresses.

Answer

Enable VPC Flow Logs to capture all network traffic.

Answer

Enable IAM Access Analyzer to detect unauthorized access attempts.

Question 2

A security engineer is designing a logging strategy for a multi-account environment. The engineer needs to ensure that all API activity across accounts is logged and that logs are immutable and centrally accessible. Which THREE actions should the engineer take?

Accepted Answer

Create an AWS CloudTrail organization trail that logs to a central S3 bucket.. AWS CloudTrail organization trails automatically aggregate API activity from all member accounts in an AWS Organizations setup, delivering log files to a single, centrally managed S3 bucket. This eliminates the need to configure individual trails per account, ensuring comprehensive and centralized logging of all API calls across the multi-account environment.

Answer

Stream logs to CloudWatch Logs for real-time monitoring.

Answer

Enable VPC Flow Logs in all accounts and send to the central bucket.

Question 3

Which THREE of the following are best practices for securing an Amazon RDS database instance? (Select THREE.)

Accepted Answer

Enable encryption at rest using AWS KMS. Enabling encryption at rest using AWS KMS ensures that the underlying storage for the RDS instance, automated backups, read replicas, and snapshots are encrypted using AES-256. This protects data at rest from unauthorized physical access or storage media theft, and is a fundamental security best practice for compliance frameworks like PCI DSS and HIPAA.

Answer

Enable public accessibility for ease of management

Answer

Use the default database port

Question 4

Which TWO actions should a security engineer take to protect root user credentials? (Select TWO.)

Accepted Answer

Do not create access keys for the root user. AWS strongly recommends that you do not create access keys for the root user. Access keys provide programmatic access to the AWS API, and if compromised, an attacker would have unrestricted access to all AWS resources and billing information. By not creating access keys, you eliminate this high-risk attack vector.

Answer

Use the root user only for billing

Answer

Share the root user credentials with the security team

Answer

Delete the root user account

Question 5

A security engineer is configuring Amazon GuardDuty to generate alerts for specific threat types. The engineer wants to ensure that alerts are sent to the security team's email distribution list and also trigger an automated Lambda function for immediate response. Which two actions should the engineer take? (Select TWO.)

Accepted Answer

Create an Amazon EventBridge rule that matches GuardDuty findings and triggers a Lambda function.. Amazon EventBridge (formerly CloudWatch Events) can be configured with a rule that matches GuardDuty finding events. When a finding matches the rule pattern, EventBridge can directly invoke a Lambda function for automated incident response, such as isolating a compromised instance or updating security groups.

Answer

Configure Amazon CloudWatch Logs to send log events to an email distribution list.

Answer

Create an Amazon CloudWatch Events rule to route findings to a Lambda function.

Answer

Create an Amazon Simple Queue Service (SQS) queue and have the Lambda function poll the queue.

Question 6

A company uses AWS Organizations and wants to restrict the use of specific instance types across all accounts. Which TWO actions should be taken to enforce this restriction?

Accepted Answer

Apply a Service Control Policy (SCP) that denies ec2:RunInstances with noncompliant instance types.. Service Control Policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts in the organization. By applying an SCP that denies ec2:RunInstances when the instance type does not match an allowed list, you can effectively prevent any user or role in any account from launching noncompliant instance types, even if they have full IAM permissions to do so.

Answer

Restrict instance types at the VPC level using network ACLs.

Answer

Use AWS CloudTrail to monitor instance launches and send alerts.

Answer

Create an IAM role that denies launch of noncompliant instances.

Question 7

A security engineer is tasked with securing an Amazon RDS for MySQL database. The database must be accessible only from a specific set of EC2 instances. Which THREE steps should the engineer take?

Accepted Answer

Enable encryption at rest for the RDS instance.. Enabling encryption at rest for the RDS instance ensures that data stored on the underlying storage is encrypted using AWS Key Management Service (KMS). This is a security best practice for protecting sensitive data at rest, and it does not conflict with the requirement to restrict network access. Encryption at rest is independent of network access controls and is essential for compliance with many security frameworks.

Answer

Disable encryption at rest to improve performance.

Answer

Associate the RDS instance with a public subnet for easier access.

Question 8

Which THREE are features of Amazon GuardDuty that help with threat detection? (Select THREE.)

Accepted Answer

Analyzes VPC Flow Logs.. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior. It ingests and analyzes VPC Flow Logs (option C) to detect suspicious network traffic patterns, such as port scans or data exfiltration attempts. This analysis is a core feature of GuardDuty's threat detection capabilities.

Answer

Analyzes AWS Config configuration history.

Answer

Analyzes S3 object content for malware.

Question 9

Which TWO of the following are valid ways to control inbound traffic to an EC2 instance? (Select TWO.)

Accepted Answer

Network ACLs. Network ACLs (NACLs) are a valid method to control inbound traffic to an EC2 instance because they act as a stateless firewall at the subnet level. Each NACL rule evaluates inbound traffic based on source IP, protocol, and port, and rules are processed in order from lowest to highest number. Since NACLs are stateless, you must explicitly allow both inbound and outbound traffic for a response to return.

Answer

IAM policies

Answer

Amazon CloudWatch alarms

Answer

AWS Key Management Service (KMS)

Question 10

A company is considering using AWS Shield Advanced to protect against DDoS attacks. Which three features are included with AWS Shield Advanced? (Choose THREE.)

Accepted Answer

Cost protection against DDoS-related scaling charges. AWS Shield Advanced provides cost protection against DDoS-related scaling charges, meaning if your EC2 or ELB instances scale up due to a DDoS attack, AWS will provide credits for the additional resources incurred. This is a key financial safeguard included in the Shield Advanced subscription.

Answer

Dedicated IP addresses for EC2 instances

Answer

AWS Site-to-Site VPN

Question 11

A security engineer is investigating a potential compromise of an EC2 instance. The engineer wants to capture volatile memory data and create a forensic image of the instance's EBS volumes. Which TWO actions should the engineer take? (Choose 2.)

Accepted Answer

Use AWS Systems Manager Run Command to execute a memory capture script.. AWS Systems Manager Run Command allows you to remotely execute scripts on EC2 instances without needing SSH access, which is critical during incident response to capture volatile memory data before the instance is compromised further. Option D is correct because creating an EBS snapshot provides a point-in-time forensic image of the root volume that can be analyzed offline without altering the original evidence.

Answer

Enable AWS CloudTrail for the instance.

Answer

Use AWS Backup to create a backup of the instance.

Answer

Use Amazon Inspector to scan the instance for vulnerabilities.

Question 12

Which TWO AWS services can be used to detect anomalous API calls in an AWS account?

Accepted Answer

AWS CloudTrail with Amazon CloudWatch Logs metric filters.. AWS CloudTrail with Amazon CloudWatch Logs metric filters is correct because CloudTrail records all API calls, and you can create metric filters on CloudWatch Logs to match patterns indicative of anomalous activity (e.g., unauthorized API calls, root user activity). When the filter triggers a threshold, it can send an alarm via Amazon SNS, enabling detection of anomalous API calls in near real-time.

Answer

AWS Shield Advanced.

Answer

AWS Config with managed rules.

Answer

AWS WAF.

Question 13

A security engineer is configuring AWS CloudTrail to monitor data events for S3 objects. Which TWO of the following must be enabled to log object-level operations? (Select TWO.)

Accepted Answer

Enable data events in the CloudTrail trail.. CloudTrail data events capture S3 object-level operations such as GetObject, PutObject, and DeleteObject. To enable this, you must explicitly select 'Data events' in the CloudTrail trail configuration, as management events only cover bucket-level operations like CreateBucket.

Answer

Enable S3 server access logs on the bucket.

Answer

Enable management events in the CloudTrail trail.

Answer

Enable S3 Object Lambda.

Question 14

Refer to the exhibit. A security engineer is reviewing a CloudTrail event. What security concern does this event raise?

Accepted Answer

The user is opening SSH access to the world.. The CloudTrail event shows an AuthorizeSecurityGroupIngress API call with a CidrIp of 0.0.0.0/0 for port 22 (SSH). This opens SSH access to the entire internet, which is a severe security risk because it exposes the instance to brute-force attacks, unauthorized access, and potential compromise. The correct answer is D because this action directly violates the principle of least privilege and is a common misconfiguration.

Answer

The user is revoking a security group rule.

Answer

The event is not being logged by CloudTrail.

Answer

The user is using the AWS root account.

Question 15

Which THREE of the following are valid key management features of AWS KMS? (Choose THREE.)

Accepted Answer

Importing key material. AWS KMS allows you to import your own key material (BYOK) for use with KMS keys, which is a valid key management feature. This is done via the 'ImportKeyMaterial' API, enabling you to create a KMS key with no key material and then upload your own symmetric key material. This feature is essential for meeting compliance requirements that mandate control over the key material lifecycle.

Answer

SSL certificate management

Answer

Password generation