SCS-C02 Practice Test 42 — 15 Questions

Question 1

A security engineer is configuring logging for an application running on Amazon EC2 instances. The engineer needs to capture both operating system-level logs and application logs. Which TWO services can be used together to achieve this? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is the correct service because it provides a centralized location to store, monitor, and access log files from your EC2 instances. The Amazon CloudWatch agent is the correct companion service because it is specifically designed to collect both operating system-level logs (e.g., syslog, Windows Event Log) and application logs from EC2 instances and send them to CloudWatch Logs. Together, they fulfill the requirement of capturing both OS and application logs.

Answer

AWS CloudTrail

Answer

VPC Flow Logs

Answer

Amazon Inspector

Question 2

A security engineer is investigating a potential compromise of an IAM user. The engineer sees that the user's access keys were used from an IP address outside the company's allowed geography. Which AWS service can provide the most immediate notification of such anomalous API calls?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious or unauthorized behavior, including anomalous API calls from unusual geographies. It uses machine learning and integrated threat intelligence to analyze CloudTrail events, VPC flow logs, and DNS logs in near real-time, enabling immediate notification of suspicious activity such as access key usage from an unexpected IP address.

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Answer

Amazon CloudWatch

Question 3

A company is using IAM roles to grant EC2 instances access to an S3 bucket. The security team wants to ensure that the instances can only access their own bucket. Which policy should be attached to the IAM role to enforce this?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::my-bucket/*"}]}. Option D is the only policy that scopes the Allow to a specific bucket ARN (arn:aws:s3:::my-bucket/*), which enforces least privilege by ensuring the role can only access objects in that one bucket. The other options either grant wildcard access or use conditions that do not restrict the resource to the instance's own bucket.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:*","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"*","Condition":{"IpAddress":{"aws:SourceIp":"10.0.0.0/16"}}}]}

Question 4

Which FOUR are valid ways to restrict access to an S3 bucket using IAM policies? (Choose 4.)

Accepted Answer

Requiring server-side encryption using the 's3:x-amz-server-side-encryption' condition key. Options A, B, C, and E are all valid ways to restrict access to an S3 bucket using IAM policies. A: The 's3:x-amz-server-side-encryption' condition key can enforce server-side encryption in IAM policies. B: The 'aws:PrincipalOrgID' global condition key can be used in IAM identity-based policies to restrict access to principals from a specific AWS Organization. C: The 'aws:SourceVpc' condition key restricts requests to those originating from a specific VPC. E: The 'aws:SourceIp' condition key restricts access to specific IP addresses. Option D is incorrect because 's3:ResourceAccount' checks the account ID of the resource, not a specific bucket; bucket-specific restriction is done via the Resource element.

Answer

Using the 's3:ResourceAccount' condition key to restrict access to a specific bucket

Question 5

Refer to the exhibit. An IAM policy is attached to a user. The user reports that they cannot upload objects to the S3 bucket 'example-bucket' using the AWS CLI from a remote location. What is the MOST likely cause?

Accepted Answer

The CLI is using HTTP instead of HTTPS.. The IAM policy shown in the exhibit includes a `Deny` effect for `s3:PutObject` when the request does not use `aws:SecureTransport` (i.e., HTTPS). If the AWS CLI is configured to use HTTP instead of HTTPS, the condition `aws:SecureTransport=false` is met, and the explicit deny blocks the upload. The user reports the issue from a remote location, which often involves misconfigured endpoints or proxies that force HTTP.

Answer

The bucket policy denies access.

Answer

The bucket requires server-side encryption.

Answer

The user is not authorized to upload to the bucket.

Answer

The user does not have s3:PutObject permission.

Question 6

A security engineer is designing a solution to protect sensitive data in S3. Which THREE mechanisms can be used to enforce encryption at rest?

Accepted Answer

Use an SCP to deny s3:PutObject without encryption. An SCP (Service Control Policy) can be applied at the organizational level to deny any s3:PutObject action that does not include encryption parameters. This enforces encryption at rest across all accounts in the organization, preventing users from uploading unencrypted objects regardless of individual bucket policies or default encryption settings.

Answer

Enable cross-region replication

Answer

Enable MFA Delete on the S3 bucket

Question 7

A security engineer is investigating a potential security incident. They suspect that an IAM user's credentials were compromised and used to launch EC2 instances in a region where the user normally does not operate. Which AWS service can help the engineer identify the source IP address and user agent of the API calls that launched the instances?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to the AWS environment, including the source IP address, user agent, and the identity of the caller. By examining CloudTrail logs for the `RunInstances` event, the engineer can identify the exact source IP address and user agent used to launch the EC2 instances, even if the region is unusual for the user.

Answer

AWS CloudHSM

Answer

Amazon Inspector

Answer

AWS Artifact

Question 8

A security team is implementing automated response to AWS GuardDuty findings. Which THREE actions should be taken to ensure proper incident response?

Accepted Answer

Create an AWS Lambda function that automatically modifies the security group of the affected instance to block all traffic.. Isolating the affected instance by modifying its security group to block all traffic is a common containment strategy that stops malicious network activity without destroying evidence. This approach allows the security team to perform forensic analysis and remediation while preventing further compromise, aligning with AWS incident response best practices.

Answer

Terminate the affected instance immediately to neutralize the threat.

Answer

Disable AWS CloudTrail to prevent further logging of malicious activity.

Question 9

Which THREE steps should a security engineer take to ensure that an incident response plan for an AWS environment is effective? (Choose three.)

Accepted Answer

Regularly test the incident response plan through tabletop exercises and simulations.. Regularly testing the incident response plan through tabletop exercises and simulations validates the plan's effectiveness, identifies gaps, and ensures team readiness. AWS recommends using Game Days and fault injection simulators to practice real-world scenarios without impacting production environments.

Answer

Use the AWS account root user for incident response actions to ensure full permissions.

Answer

Store all evidence in an S3 bucket with public read access for easy sharing.

Question 10

Match each AWS security control to its category.

Accepted Answer

Security Group: A stateful firewall that controls inbound and outbound traffic at the instance level.. Security Groups are stateful instance-level firewalls, Network ACLs are stateless subnet-level firewalls. Common confusions involve mixing statefulness and level of operation.

Answer

Security Group: A stateless firewall that controls traffic at the subnet level.

Answer

AWS WAF: A stateful firewall that controls traffic at the instance level.

Question 11

A company uses Amazon RDS for MySQL with automated backups enabled. The security team suspects that a database administrator (DBA) with full RDS access has exfiltrated data by creating a snapshot of the database and sharing it with an external AWS account. The team wants to detect such exfiltration in the future. Which step should the team take to detect and alert on snapshot sharing?

Accepted Answer

Create an Amazon EventBridge rule that triggers on the `ModifyDBSnapshotAttribute` API call and sends an alert via Amazon SNS.. The `ModifyDBSnapshotAttribute` API call is the specific action used to share an RDS snapshot with an external AWS account. By creating an Amazon EventBridge rule that triggers on this API call, the team can immediately send an alert via Amazon SNS, enabling real-time detection and response to unauthorized snapshot sharing. This approach is automated, event-driven, and directly targets the exfiltration vector.

Answer

Use AWS Config to detect changes to RDS snapshot attributes.

Answer

Enable Amazon GuardDuty with RDS Protection.

Answer

Enable AWS CloudTrail and review logs manually.

Question 12

A security engineer suspects that an EC2 instance is communicating with a known malicious IP address. The engineer needs to capture the full network packets for analysis. Which approach should be taken?

Accepted Answer

Use VPC Traffic Mirroring to mirror the instance's ENI to a monitoring appliance.. VPC Traffic Mirroring captures and copies all network traffic from an EC2 instance's Elastic Network Interface (ENI) and forwards it to a monitoring appliance (e.g., a security appliance or packet analyzer) for full packet-level analysis. This is the only option that provides raw, full network packets (including headers and payloads) without impacting the instance's performance or requiring software installation on the instance itself.

Answer

Enable AWS Security Hub to detect and capture malicious traffic.

Answer

Install the Amazon CloudWatch agent on the instance to capture network logs.

Answer

Enable VPC Flow Logs on the subnet and analyze the logs.

Question 13

A company wants to use AWS WAF to protect its web application from common web exploits. Which AWS service must be integrated with AWS WAF to provide this protection?

Accepted Answer

Application Load Balancer or Amazon CloudFront. AWS WAF is a web application firewall that inspects HTTP/HTTPS traffic at Layer 7. It must be integrated with a service that can terminate HTTP/HTTPS connections and forward the traffic to WAF for inspection. Both Application Load Balancer (ALB) and Amazon CloudFront support this integration, allowing WAF to filter requests based on rules such as SQL injection or cross-site scripting. Security Groups and Network ACLs operate at the network and transport layers (Layers 3/4) and cannot provide Layer 7 inspection.

Answer

Security Groups

Answer

Amazon Route 53

Answer

Network ACLs

Question 14

A company uses AWS Systems Manager Patch Manager to patch EC2 instances. During a security incident, the security team needs to quickly patch a critical vulnerability across all Windows instances in a specific AWS region. Which steps should the team take? (Choose TWO.)

Accepted Answer

Assign the patch baseline to the instances by specifying a patch group.. Assigning a custom patch baseline to instances via a patch group allows the security team to target specific Windows instances for patching. Patch Manager uses patch groups to associate instances with a specific patch baseline, ensuring only the desired instances receive the critical patch. This approach provides granular control over which instances are patched during an incident.

Answer

Tag all instances with 'PatchGroup=Critical' to include them in the patching.

Answer

Use the AWS-provided default patch baseline for Windows.

Answer

Use SSM Run Command to execute a script that downloads and installs the patch.

Question 15

A security engineer is investigating a potential data breach. The engineer wants to analyze historical API calls made by a specific IAM user. Which TWO AWS services can be used together to achieve this? (Select TWO.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the service that records API activity across AWS accounts, including who made the call, the source IP address, and the time of the call. By enabling CloudTrail for the specific IAM user, the security engineer can retrieve a history of all API calls made by that user. CloudWatch Logs can then be used to store and query those CloudTrail logs for analysis, such as filtering by user ARN or event name.

Answer

S3 Server Access Logs

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs Insights