SCS-C02 Practice Test 43 — 15 Questions

Question 1

A security engineer is configuring Amazon GuardDuty in a multi-account environment using AWS Organizations. The engineer needs to ensure that all findings from member accounts are visible in the administrator account. Additionally, the engineer wants to receive real-time notifications for high-severity findings. Which TWO actions should the engineer take? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Designate an administrator account in GuardDuty to manage the multi-account environment.. Designating an administrator account in GuardDuty is the required step to centrally manage findings from all member accounts in an AWS Organizations multi-account setup. This configuration enables the administrator account to view and aggregate all findings from member accounts without needing to log into each account individually.

Answer

Enable Amazon Detective to analyze GuardDuty findings.

Answer

Enable AWS CloudTrail in all member accounts to log GuardDuty API calls.

Answer

Use AWS Config to monitor GuardDuty configuration.

Question 2

A company wants to grant an IAM user the ability to rotate their own access keys. What is the least privileged IAM policy that allows this?

Accepted Answer

A policy with Action: 'iam:CreateAccessKey', 'iam:DeleteAccessKey', 'iam:UpdateAccessKey' and Resource: 'arn:aws:iam::*:user/${aws:username}'. It grants only the specific actions required to rotate access keys (CreateAccessKey, DeleteAccessKey, UpdateAccessKey) and restricts the resource to the user's own path using the ${aws:username} variable. This ensures the IAM user can only manage their own keys, adhering to the least privilege principle.

Answer

A policy with Action: 'iam:*AccessKey*' and Resource: 'arn:aws:iam::*:user/*'

Answer

A policy with Action: 'iam:ListAccessKeys' and 'iam:GetAccessKeyLastUsed' and Resource: '*'

Answer

A policy with Action: 'iam:*' and Resource: '*'

Question 3

A security team has enabled AWS CloudTrail in all regions and is delivering logs to an S3 bucket. The team has also enabled S3 server access logging for the CloudTrail bucket. The team needs to detect any unauthorized access to the CloudTrail logs. Which combination of services should the team use to achieve near-real-time detection?

Accepted Answer

Amazon GuardDuty and Amazon CloudWatch Events. Amazon GuardDuty continuously monitors S3 data plane events, including CloudTrail log delivery and S3 server access logs, to detect suspicious API calls or unauthorized access patterns. Amazon CloudWatch Events (now part of Amazon EventBridge) can trigger near-real-time alerts when GuardDuty generates findings, enabling immediate response. This combination provides the required near-real-time detection without relying on batch analysis or configuration rules.

Answer

AWS CloudTrail Insights and Amazon CloudWatch

Answer

Amazon Athena and Amazon QuickSight

Answer

AWS Config and Amazon SNS

Question 4

A security engineer is troubleshooting an issue where CloudTrail is not delivering logs to an S3 bucket. The bucket policy appears correct. Which TWO additional steps should the engineer take to diagnose the issue? (Choose TWO.)

Accepted Answer

Verify that the S3 bucket exists and is in the correct region.. If the S3 bucket does not exist or is in a different region, CloudTrail cannot deliver log files to it. CloudTrail requires the bucket to be in the same region as the trail (for a single-region trail) or in the designated bucket region for a multi-region trail. Verifying the bucket's existence and region ensures the delivery path is valid. Option E is correct because the CloudTrail configuration in the AWS Management Console displays error messages related to delivery failures, such as bucket policy issues or permission errors. Reviewing this console can provide immediate insight into why logs are not being delivered, without needing to check other logs manually.

Answer

Check CloudWatch Logs for CloudTrail errors.

Answer

Create an IAM role for CloudTrail with S3 write permissions.

Answer

Enable S3 server access logging on the bucket.

Question 5

A company wants to securely store and manage SSL/TLS certificates for use with CloudFront. Which AWS service should be used?

Accepted Answer

AWS Certificate Manager (ACM). AWS Certificate Manager (ACM) is the correct service because it is specifically designed to provision, manage, and deploy public and private SSL/TLS certificates for use with AWS services like CloudFront. ACM integrates directly with CloudFront to automatically renew certificates before expiration, eliminating manual renewal overhead. It also handles the complex certificate chain and private key management securely, ensuring HTTPS termination at CloudFront edge locations.

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Key Management Service (AWS KMS)

Answer

AWS CloudHSM

Question 6

A security engineer is investigating a potential compromise of an EC2 instance. The engineer needs to capture network traffic to and from the instance for forensic analysis. Which AWS service should be used to capture this traffic?

Accepted Answer

VPC Traffic Mirroring. VPC Traffic Mirroring captures and inspects network traffic at the Elastic Network Interface (ENI) level by copying packets from a source ENI to a target, such as a Network Load Balancer or another ENI. This allows the security engineer to perform deep packet inspection and forensic analysis without impacting the production traffic flow. It supports both IPv4 and IPv6 traffic and can filter by protocol, port, or packet direction, making it ideal for incident response scenarios.

Answer

AWS Config

Answer

AWS Network Firewall

Answer

Amazon Inspector

Question 7

A company is designing an incident response plan for AWS. The plan must include the ability to collect forensic data from EC2 instances without requiring SSH key pairs. Which TWO AWS services can be used to acquire forensic data from EC2 instances without remote access? (Choose 2.)

Accepted Answer

AWS Systems Manager Run Command. AWS Systems Manager Run Command allows you to run scripts or commands on EC2 instances via the SSM Agent, without requiring SSH keys or direct network access. This enables forensic data collection (e.g., memory dumps, log files) by executing commands remotely through the AWS Systems Manager service, using IAM roles for authentication.

Answer

AWS Config

Answer

Amazon Inspector

Answer

AWS CloudTrail

Question 8

A security engineer is designing a threat detection solution for a multi-account AWS environment. The engineer needs to detect and respond to suspicious API activity across all accounts. Which TWO services should be used together to achieve this? (Choose two.)

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious or unauthorized behavior across AWS accounts, including suspicious API activity. By enabling GuardDuty in all accounts and aggregating findings to a central administrator account, it provides the necessary detection layer for multi-account environments.

Answer

Amazon CloudWatch

Answer

Amazon Inspector

Answer

AWS Config

Question 9

A security team detects that an IAM user's access keys are being used from an unusual geographic location. Which AWS service provides this type of anomaly detection?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior, including anomalous API calls from unusual geographic locations. It uses machine learning models and integrated threat intelligence to analyze AWS CloudTrail management events, VPC Flow Logs, and DNS logs, making it the correct service for detecting IAM user access key usage from an unexpected region.

Answer

Amazon Inspector

Answer

AWS CloudTrail

Answer

AWS Config

Question 10

An IAM policy has the following statement: {"Effect":"Deny","Action":"*","Resource":"*","Condition":{"Bool":{"aws:SecureTransport":"false"}}}. What does this policy achieve?

Accepted Answer

Denies all actions that are not made over HTTPS. This policy statement uses the `aws:SecureTransport` condition key with a `Bool` condition set to `false`. When the condition evaluates to true (i.e., the request is not using HTTPS/TLS), the `Deny` effect applies to all actions on all resources. This effectively denies any API call made over HTTP (non-secure transport), ensuring that only HTTPS requests are allowed. The policy does not explicitly allow anything; it only denies non-HTTPS traffic, so all actions are implicitly allowed when made over HTTPS.

Answer

Allows all actions only when using HTTPS

Answer

Enforces HTTPS for S3 bucket policies only

Answer

Blocks all actions for a specific AWS service

Question 11

Which TWO are characteristics of an IAM role? (Choose 2.)

Accepted Answer

It does not have long-term access keys.. IAM roles do not have long-term access keys; they provide temporary security credentials when assumed. Option D is correct because roles provide temporary security credentials through AWS STS. Option A is incorrect because while a role can be used by an AWS service, it still requires an entity (user, service, or application) to assume it—a role is not 'without a user.' Option C is incorrect because roles can have attached permissions policies that define what actions are allowed. Option E is incorrect because a role is not tied to a specific IAM user; it can be assumed by multiple users, services, or federated identities.

Answer

It can be used to grant permissions to an AWS service without requiring a user.

Answer

It cannot have an attached permissions policy.

Answer

It is associated with a specific IAM user.

Question 12

A security engineer needs to ensure that all traffic between two EC2 instances in different subnets is encrypted in transit. What is the most secure and efficient solution?

Accepted Answer

Set up an IPsec VPN between the instances. An IPsec VPN between the two EC2 instances provides end-to-end encryption of all traffic at the network layer, regardless of the application protocol. This ensures that data in transit between the instances is encrypted using IPsec (ESP/AH), which is the most secure and efficient solution for encrypting traffic between two specific instances in different subnets without relying on the underlying network infrastructure.

Answer

Configure network ACLs to allow traffic

Answer

Use VPC Peering

Answer

Configure security groups to allow traffic

Question 13

A security engineer needs to centrally collect and analyze AWS CloudTrail logs from multiple accounts. Which service is designed for this purpose?

Accepted Answer

Use AWS Organizations to create a CloudTrail trail that applies to all accounts. AWS Organizations allows you to create a single CloudTrail trail that applies to all accounts in the organization, centrally collecting management and data events into a single S3 bucket (and optionally CloudWatch Logs). This eliminates the need to manually configure trails in each account and ensures consistent logging across the entire organization, meeting the requirement for central collection and analysis.

Answer

Configure each account to send logs to a central S3 bucket

Answer

Enable Amazon GuardDuty in each account and aggregate findings

Answer

Use Amazon CloudWatch Logs to stream logs from each account to a central account

Question 14

A company wants to centrally manage access keys for IAM users. Which AWS service can generate and rotate access keys automatically?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct service because it natively supports automatic rotation of secrets, including IAM user access keys. You can configure a rotation schedule (e.g., every 30 days) and Secrets Manager will generate a new access key pair, update the IAM user, and optionally disable or delete the old key. This provides a fully managed, centralized solution for rotating access keys without custom scripting.

Answer

AWS CloudHSM

Answer

AWS KMS

Answer

AWS Systems Manager Parameter Store

Question 15

A security engineer is designing a governance framework for a multi-account AWS environment. The framework must enforce the principle of least privilege for cross-account access. Which TWO strategies should be implemented?

Accepted Answer

Use IAM roles with specific permissions and trust policies for cross-account access.. IAM roles with specific permissions and trust policies enable cross-account access without sharing long-term credentials. The trust policy defines which accounts can assume the role, and the permissions policy grants only the necessary actions, enforcing the principle of least privilege.

Answer

Enable AWS CloudTrail in all accounts and aggregate logs.

Answer

Grant full administrative access to a central security group.

Answer

Use a single IAM user across all accounts for administrative tasks.