SCS-C02 Practice Test 44 — 15 Questions

Question 1

A security engineer is investigating a potential data exfiltration from an S3 bucket that is configured to allow public access. The engineer wants to determine who accessed the bucket and from which IP addresses. Which AWS capability should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS CloudTrail data events for S3. AWS CloudTrail data events for S3 capture detailed API activity at the object level, including GetObject, PutObject, and DeleteObject calls. This allows the security engineer to identify exactly who accessed the bucket (via the user identity) and from which IP address (via the sourceIPAddress field in the CloudTrail event). Unlike management events, data events must be explicitly enabled and provide the granularity needed for this investigation.

Answer

Amazon S3 server access logs

Answer

AWS IAM Access Analyzer

Answer

Amazon VPC Flow Logs

Question 2

A security engineer is designing a network architecture for a three-tier web application. The web tier must be accessible from the internet, but the application and database tiers must not. Which VPC configuration should be used?

Accepted Answer

Place web tier in public subnets, app and database tiers in private subnets.. It places the web tier in public subnets with an internet gateway for direct internet access, while the application and database tiers reside in private subnets with no direct internet route. This ensures that only the web tier is exposed, and the app and database tiers can only be reached through the web tier via internal routing, aligning with the principle of least privilege for a three-tier architecture.

Answer

Place web and app tiers in public subnets, database in private subnet.

Answer

Place all tiers in private subnets and use a VPN for external access.

Answer

Place all tiers in public subnets with security groups restricting access.

Question 3

A security engineer is investigating a potential data exfiltration from an S3 bucket that is configured to allow public access. The engineer wants to determine who accessed the bucket and from which IP addresses. Which AWS capability should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious or unauthorized behavior, including communication with known command and control (C2) servers. It uses threat intelligence feeds, such as those from AWS and third-party partners, to check the reputation of destination IP addresses and alert on suspicious outbound traffic. In this scenario, GuardDuty can directly identify if the EC2 instance is communicating with a known C2 server by analyzing VPC Flow Logs, DNS logs, and other data sources.

Answer

AWS CloudTrail

Answer

VPC Flow Logs

Answer

AWS Trusted Advisor

Question 4

Which TWO of the following are AWS best practices for managing access keys? (Choose 2.)

Accepted Answer

Delete unused access keys.. AWS best practices recommend deleting unused access keys to reduce the risk of unauthorized access. Unused keys represent a potential attack vector, as they may be forgotten and left active, allowing an attacker who discovers them to gain access to AWS resources. By regularly auditing and removing keys that are no longer in use, you minimize the exposure of long-lived credentials.

Answer

Use the same access key for multiple users.

Answer

Share access keys via email.

Answer

Embed access keys directly in application code.

Question 5

A security engineer must ensure that cross-account access to an S3 bucket is restricted to only accounts that are part of a specific AWS organization. Which IAM policy condition key should be used in the bucket policy?

Accepted Answer

aws:PrincipalOrgID. The `aws:PrincipalOrgID` condition key allows you to restrict access to only principals (accounts) that belong to a specific AWS organization. By specifying the organization ID in the bucket policy, you ensure that only accounts within that organization can access the S3 bucket, regardless of whether they are from the same account or cross-account. This key is evaluated against the organization ID of the principal's account, making it ideal for cross-account access control based on organizational membership.

Answer

aws:SourceIp

Answer

aws:MultiFactorAuthPresent

Answer

aws:SourceVpce

Question 6

Refer to the exhibit. An organization applies this SCP to an OU containing a developer account. A developer in that account tries to launch an m5.large instance using the AWS Management Console. What is the outcome?

Accepted Answer

The launch fails because the SCP denies RunInstances for instance types other than t2.micro and t2.small.. The SCP explicitly denies the ec2:RunInstances action when the condition key ec2:InstanceType does not match t2.micro or t2.small. Since m5.large is not in the allowed list, the deny effect applies, and the launch fails regardless of any IAM policy that might allow it. SCPs act as a guardrail that overrides IAM permissions, so even if the developer has full IAM access, the SCP blocks the operation.

Answer

The instance launches successfully because the SCP only applies to StartInstances, not RunInstances.

Answer

The instance launches successfully because the SCP does not explicitly allow any actions.

Answer

The launch fails only if the developer's IAM policy also denies the action.

Question 7

A company runs a multi-account AWS environment using AWS Organizations. The security team uses AWS Config to monitor compliance. Recently, they noticed that a developer in the 'development' account created an S3 bucket that is publicly accessible. The security team wants to prevent this in the future by automatically remediating any public S3 bucket. They have an SCP that denies s3:PutBucketPublicAccessBlock, but developers are still making buckets public by using bucket ACLs. The security team wants to implement a solution that automatically fixes any bucket that becomes public. Which solution should they choose?

Accepted Answer

Use AWS Config with the s3-bucket-public-read-prohibited managed rule and an automatic remediation action using AWS Systems Manager Automation. AWS Config's s3-bucket-public-read-prohibited managed rule evaluates S3 bucket ACLs and policies for public read access. When a noncompliant bucket is detected, an automatic remediation action using AWS Systems Manager Automation can invoke a custom SSM document (e.g., AWS-DisableS3BucketPublicReadWrite) to remove public ACLs or apply a bucket policy that denies public access. This provides automated, event-driven remediation without relying on manual intervention or incomplete SCPs.

Answer

Use CloudTrail to detect PutBucketAcl events and send to SNS for manual remediation

Answer

Update the SCP to deny s3:PutBucketAcl with a condition for public access

Answer

Attach an IAM policy to all users that denies s3:PutBucketAcl

Question 8

A security engineer is troubleshooting connectivity issues between two EC2 instances in the same VPC but different subnets. Both instances have security groups that allow all traffic from each other's security group. However, traffic is still blocked. What is the most likely cause?

Accepted Answer

The network ACL for one or both subnets is blocking the traffic.. The most likely cause is that the network ACL (NACL) for one or both subnets is blocking the traffic. Security groups are stateful and allow traffic based on rules, but NACLs are stateless and require explicit inbound and outbound rules for traffic to flow. Even if security groups permit all traffic between the instances, a NACL denying the traffic (e.g., by having a default deny rule or missing ephemeral port ranges) will block it. Since the instances are in different subnets, the NACL associated with each subnet must allow the traffic in both directions.

Answer

The instances are in different VPCs.

Answer

The route tables do not have a route between the subnets.

Answer

VPC Flow Logs are not enabled.

Question 9

A security engineer is investigating a potential data exfiltration from an S3 bucket that is configured to allow public access. The engineer wants to determine who accessed the bucket and from which IP addresses. Which AWS capability should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Launch a test instance from the AMI in an isolated VPC and run Amazon Inspector.. Launching a test instance from the AMI in an isolated VPC allows you to run Amazon Inspector, which performs automated vulnerability assessments and network reachability checks against the instance. This approach provides a thorough analysis of the AMI's software and configuration without exposing the production environment to any potential malicious activity. Amazon Inspector uses a knowledge base of common vulnerabilities and exposures (CVEs) and CIS benchmarks to identify security issues, making it effective for detecting malicious software embedded in the AMI.

Answer

Use AWS Systems Manager to run a compliance scan on the running instance.

Answer

Create an EBS snapshot from the AMI and scan the snapshot with Amazon Detective.

Answer

Launch a test instance from the AMI in an isolated VPC and analyze its behavior.

Question 10

A security analyst notices an IAM role 'AdminRole' is being assumed from an IP address outside the company's allowed network. The analyst wants to receive real-time alerts when this role is assumed from unauthorized locations. Which combination of services should be used?

Accepted Answer

AWS CloudTrail, Amazon CloudWatch Events, and Amazon SNS. AWS CloudTrail logs IAM role assumption events (sts:AssumeRole) as CloudTrail events, which can be sent to Amazon CloudWatch Events (now Amazon EventBridge) as a real-time event stream. CloudWatch Events rules can then match specific patterns (e.g., source IP outside allowed ranges) and trigger an Amazon SNS notification to alert the security analyst immediately. This combination provides the real-time alerting required without additional polling or storage.

Answer

AWS CloudTrail, Amazon S3, and Amazon Athena

Answer

AWS Config, Amazon SNS, and AWS Lambda

Answer

Amazon GuardDuty and AWS Lambda

Question 11

Refer to the exhibit. A security engineer runs the iptables command on an EC2 instance in a VPC. The instance has a security group that allows all outbound traffic and inbound SSH from 0.0.0.0/0, HTTP from 0.0.0.0/0, and HTTPS from 0.0.0.0/0. A user from IP 203.0.113.5 tries to connect to the instance over HTTP. What will happen?

Accepted Answer

The connection is dropped by iptables.. The iptables command shown in the exhibit (not provided here but implied to have a default DROP or REJECT policy on the INPUT chain, or a specific rule that drops HTTP traffic) overrides the security group's permissive rules. Security groups act as a virtual firewall at the instance level, but iptables operates within the instance's OS kernel netfilter framework and is evaluated after the security group. Since iptables drops the HTTP connection, the packet is discarded before reaching the application, regardless of the security group allowing HTTP from 0.0.0.0/0.

Answer

The connection succeeds because the security group allows HTTP.

Answer

The connection succeeds because iptables allows HTTP from anywhere.

Answer

The connection is dropped by the security group.

Question 12

A company wants to protect sensitive data stored in Amazon S3 by encrypting it at rest. Which AWS service can be used to manage the encryption keys?

Accepted Answer

AWS Key Management Service (AWS KMS). AWS Key Management Service (AWS KMS) is the AWS service designed to create, manage, rotate, and audit encryption keys used to protect data at rest in AWS services including Amazon S3. S3 server-side encryption with AWS KMS keys (SSE-KMS) integrates directly with KMS, giving the company centralized key management, granular IAM policies, key rotation, and CloudTrail audit logs of key usage. This is the correct answer for managing encryption keys for S3 data at rest.

Answer

AWS Secrets Manager

Answer

AWS CloudHSM

Answer

AWS S3-managed keys (SSE-S3)

Question 13

A security team needs to ensure that all API calls made in the AWS account are logged and the logs are stored in a central S3 bucket that is encrypted with a KMS key. Which combination of steps should the team take to achieve this?

Accepted Answer

Enable CloudTrail and configure it to deliver logs to an encrypted S3 bucket.. AWS CloudTrail records all API calls made in an AWS account, including management events and optionally data events, and can be configured to deliver log files to a central S3 bucket. By enabling CloudTrail with an S3 bucket destination and configuring the bucket with SSE-KMS encryption using a KMS key, the team meets both requirements: logging all API calls and storing logs encrypted with KMS. This is the standard AWS approach for API activity auditing.

Answer

Enable AWS Config and have it deliver configuration history to an encrypted S3 bucket.

Answer

Enable CloudWatch Logs and stream logs to an encrypted S3 bucket.

Answer

Enable VPC Flow Logs and publish to an encrypted S3 bucket.

Question 14

A security engineer is designing a system to centrally manage IAM users and roles across multiple AWS accounts. The company uses AWS Organizations. Which AWS service should be used to manage permissions across accounts?

Accepted Answer

AWS IAM Identity Center (AWS SSO). AWS IAM Identity Center (formerly AWS SSO) is the service for centrally managing user access to multiple accounts. Option A is wrong because AWS Config is for resource compliance. Option B is wrong because AWS Artifact is for compliance reports. Option C is wrong because AWS CloudTrail is for auditing API activity.

Answer

AWS Config

Answer

AWS Artifact

Answer

AWS CloudTrail

Question 15

A security engineer needs to ensure that an Amazon S3 bucket is not publicly accessible. Which AWS service can be used to continuously monitor and alert if the bucket becomes public?

Accepted Answer

AWS Config. (AWS Config) is correct because AWS Config has managed rules such as 's3-bucket-public-read-prohibited' and 's3-bucket-public-write-prohibited' that can evaluate S3 bucket policies and ACLs, continuously monitor configurations, and trigger alerts via Amazon SNS when a bucket becomes public. Option A (AWS CloudTrail) is wrong because CloudTrail records API calls but does not evaluate resource configurations. Option C (AWS Trusted Advisor) provides best-practice checks but does not offer continuous monitoring and alerting for configuration changes. Option D (Amazon GuardDuty) focuses on threat detection, not configuration compliance.

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty