SCS-C02 Practice Test 45 — 15 Questions

Question 1

A company uses AWS Key Management Service (KMS) to encrypt data at rest. The security team needs to ensure that only specific IAM roles can use a particular KMS key to encrypt and decrypt data. What is the most secure way to achieve this?

Accepted Answer

Create a KMS key policy that grants access only to the specific IAM roles using the kms:CallerArn condition.. Option B is correct because using a key policy with a condition for the kms:CallerArn attribute restricts usage to the specified roles. Option A is wrong because IAM policies alone cannot restrict KMS key usage if the key policy allows all principals. Option C is wrong because key policy with Principal "*" grants access to all, even with a condition. Option D is wrong because a condition for the IAM role's ARN is not a standard KMS condition key.

Answer

Create an IAM policy that allows kms:Encrypt and kms:Decrypt for the roles and attach it to the roles.

Answer

Create a KMS key policy that grants access to the account and use IAM policies to restrict the roles.

Answer

Create a KMS key policy with Principal "*" and a condition that the request originates from the roles.

Question 2

A company needs to enforce that all Amazon S3 buckets are encrypted at rest. Which TWO actions should be taken? (Choose two.)

Accepted Answer

Enable default encryption on each S3 bucket.. Option A is correct because enabling default encryption ensures all new objects are encrypted. Option D is correct because an SCP can deny creation of unencrypted buckets. Option B is wrong because bucket policies cannot enforce encryption on existing objects. Option C is wrong because CloudTrail logs do not enforce encryption. Option E is wrong because KMS keys are used for encryption but do not enforce the policy.

Answer

Enable AWS CloudTrail to log S3 API calls.

Answer

Use bucket policies to deny write operations without encryption.

Answer

Create a KMS key and apply it to all buckets.

Question 3

A company wants to encrypt data at rest in an Amazon S3 bucket. Which AWS service can centrally manage the encryption keys?

Accepted Answer

AWS Key Management Service (AWS KMS). Option B is correct because AWS KMS is the managed service for creating and controlling encryption keys used to encrypt data. Option A is wrong because AWS CloudHSM provides hardware security modules but not central key management. Option C is wrong because AWS Secrets Manager is for managing secrets, not encryption keys for S3. Option D is wrong because AWS Certificate Manager manages SSL/TLS certificates, not encryption keys for data at rest.

Answer

AWS CloudHSM

Answer

AWS Certificate Manager (ACM)

Answer

AWS Secrets Manager

Question 4

A Security Engineer is designing a network architecture for a multi-tier application. The web tier must be accessible from the internet, while the application tier should only be accessible from the web tier, and the database tier only from the application tier. All tiers are in the same VPC. Which configuration meets these requirements with minimal administrative overhead?

Accepted Answer

Use security groups with inbound rules that reference the security group of the previous tier.. Option B is correct because security group rules can reference other security groups by ID, allowing traffic between tiers without managing IP addresses. Option A is wrong because NACLs are stateless and require explicit allow rules for return traffic, adding complexity. Option C is wrong because using public IPs for internal communication is unnecessary and insecure. Option D is wrong because prefix lists are used for IP address management, not for allowing traffic between security groups.

Answer

Use network ACLs with inbound rules that reference the prefix list of the previous tier's subnets.

Answer

Use network ACLs with inbound rules that allow traffic from the previous tier's subnet CIDR.

Answer

Use security groups with inbound rules that allow traffic from the previous tier's public IP addresses.

Question 5

A company is using AWS WAF to protect a web application behind an Application Load Balancer. The Security Engineer wants to block requests that contain SQL injection attacks. Which action should the Engineer take?

Accepted Answer

Create a WAF rule with a SQL injection match condition and set the action to block.. Option D is correct because AWS WAF has managed rules for SQL injection that can be enabled with a block action. Option A is wrong because WAF rules are not applied at the EC2 instance level. Option B is wrong because Shield Advanced provides DDoS protection, not SQL injection detection. Option C is wrong because GuardDuty is for threat detection, not inline blocking of web requests.

Answer

Enable AWS Shield Advanced to automatically block SQL injection attacks.

Answer

Use Amazon GuardDuty to detect and block SQL injection attempts.

Answer

Configure the security group of the EC2 instances to block traffic containing SQL injection patterns.

Question 6

A company is using Amazon EC2 instances in a VPC with a security group that allows inbound SSH from 0.0.0.0/0. A security engineer needs to restrict SSH access to only the company's public IP range (203.0.113.0/24) while maintaining all other existing rules. What is the MOST efficient way to accomplish this?

Accepted Answer

Modify the existing security group rule to change the source from 0.0.0.0/0 to 203.0.113.0/24.. Option B is correct because modifying the existing security group rule to change the source CIDR is the most direct method. Option A is wrong because adding a new rule doesn't remove the open rule. Option C is wrong because NACLs are stateless and would require additional rules. Option D is wrong because System Manager Session Manager does not replace the need for SSH restrictions.

Answer

Disable SSH and use AWS Systems Manager Session Manager to connect to instances.

Answer

Create a network ACL with an inbound rule allowing SSH from 203.0.113.0/24 and deny all other traffic.

Answer

Create a new security group rule allowing SSH from 203.0.113.0/24 and keep the existing rule.

Question 7

A security engineer needs to ensure that an EC2 instance can only be accessed using SSH key pairs, not passwords. Which configuration is required?

Accepted Answer

Set 'PasswordAuthentication no' in /etc/ssh/sshd_config on the EC2 instance. Option B is correct because disabling password authentication in the SSH daemon configuration ensures only key-based authentication is allowed. Option A is wrong because security groups control network access, not authentication method. Option C is wrong because IAM roles do not affect SSH authentication. Option D is wrong because EC2 Instance Connect is an alternative, not a method to enforce key-only.

Answer

Use EC2 Instance Connect instead of SSH

Answer

Attach an IAM role to the instance that denies password-based access

Answer

Configure the security group to allow SSH only from specific IP addresses

Question 8

A security engineer reviews the above IAM policy attached to an IAM user. The user reports that they cannot download objects from the S3 bucket 'example-bucket' when connected from the office network (IP range 10.0.0.0/16). What is the most likely cause?

Accepted Answer

The source IP condition does not match the user's actual IP address. Option C is correct because the policy grants access based on the source IP of the request. IAM user credentials are used, but the actual source IP must match the condition. Option A is wrong because the policy allows GetObject. Option B is wrong because the policy does not require a specific IAM role. Option D is wrong because the bucket policy is not shown; the IAM policy is the issue.

Answer

The bucket policy overrides the IAM policy

Answer

The policy does not allow the s3:GetObject action

Answer

The user is not assuming the correct IAM role

Question 9

A company uses AWS Direct Connect to connect its on-premises data center to a VPC. The security team wants to encrypt all traffic between on-premises and the VPC. Which solution should be used?

Accepted Answer

Set up an IPsec VPN over the Direct Connect connection. Option B is correct because IPsec VPN over Direct Connect provides encryption. Option A is wrong because Direct Connect alone does not provide encryption. Option C is wrong because VPC Peering is for VPC-to-VPC. Option D is wrong because TLS is for application layer, not for the network connection.

Answer

Enable encryption on the Direct Connect virtual interface

Answer

Use VPC Peering with encryption

Answer

Configure TLS on all applications

Question 10

A company wants to ensure that all data transmitted between its EC2 instances and an Application Load Balancer (ALB) is encrypted. Which configuration should be applied?

Accepted Answer

Configure the ALB with an HTTPS listener and a target group that uses HTTPS as the protocol.. Option D is correct because the ALB can terminate HTTPS and use HTTPS with the target group to encrypt traffic to instances. Option A is wrong because security groups do not encrypt traffic. Option B is wrong because SSL certificates are for the listener, not the target group. Option C is wrong because Network Load Balancer does not support HTTPS termination natively.

Answer

Install SSL certificates on each EC2 instance and configure the ALB to use TCP passthrough.

Answer

Use a Network Load Balancer with TLS listeners and target groups.

Answer

Configure security groups to allow only HTTPS traffic.

Question 11

A company is designing a hybrid cloud architecture with an AWS Direct Connect connection. The company wants to ensure that traffic to and from the VPC goes through the Direct Connect connection and not over the internet. Which configuration should be used?

Accepted Answer

Attach a Virtual Private Gateway to the VPC and update the route tables to point to the Direct Connect virtual interface.. Option A is correct because using a Virtual Private Gateway and updating route tables to point to the Direct Connect virtual interface ensures traffic is routed through Direct Connect. Option B is wrong because a VPN connection still uses the internet. Option C is wrong because a VPC Endpoint is for AWS service access. Option D is wrong because Direct Connect alone does not enforce routing.

Answer

Create a VPC Endpoint for each AWS service.

Answer

Set up a VPN connection over the internet as a backup.

Answer

Configure the Direct Connect connection and assign public IPs to instances.

Question 12

A company wants to grant an IAM user the ability to rotate their own access keys. What is the least privileged IAM policy that allows this?

Accepted Answer

A policy with Action: 'iam:CreateAccessKey', 'iam:DeleteAccessKey', 'iam:UpdateAccessKey' and Resource: 'arn:aws:iam::*:user/${aws:username}'. Option B is correct because it allows the user to manage their own access keys. Option A is wrong because it grants full IAM access. Option C is wrong because it does not allow deleting or creating keys. Option D is wrong because it requires a specific resource ARN with a wildcard, which is not necessary for self-management.

Answer

A policy with Action: 'iam:*AccessKey*' and Resource: 'arn:aws:iam::*:user/*'

Answer

A policy with Action: 'iam:ListAccessKeys' and 'iam:GetAccessKeyLastUsed' and Resource: '*'

Answer

A policy with Action: 'iam:*' and Resource: '*'

Question 13

A company is using an Application Load Balancer (ALB) to distribute traffic to EC2 instances in a VPC. The Security Engineer notices that the ALB health checks are failing. Which configuration change should the Engineer make to resolve the issue?

Accepted Answer

Add a rule to the target instances' security group to allow inbound traffic from the VPC CIDR on the health check port.. Option B is correct because the ALB health checks originate from the VPC CIDR, so the security group must allow traffic from the VPC CIDR. Option A is wrong because the ALB does not have a fixed IP; it uses the VPC CIDR for health checks. Option C is wrong because health checks are not sent from the internet. Option D is wrong because the ALB's security group is for the ALB itself, not for the target instances.

Answer

Add a rule to the target instances' security group to allow inbound traffic from 0.0.0.0/0 on the health check port.

Answer

Add a rule to the ALB's security group to allow inbound traffic from the internet on the health check port.

Answer

Add a rule to the ALB's security group to allow outbound traffic to the target instances on the health check port.

Question 14

A Security Engineer is configuring a VPC with a public subnet for a web server and a private subnet for a database. The web server needs to download patches from the internet. Which TWO actions should the Engineer take to allow the web server internet access without exposing the database to the internet?

Accepted Answer

Create a NAT Gateway in the public subnet.. Option A (NAT Gateway) and Option C (route table update) are correct because a NAT Gateway in the public subnet allows instances in private subnets to initiate outbound traffic to the internet, and updating the private subnet route table directs internet-bound traffic to the NAT Gateway. Option B is wrong because an Internet Gateway is used for public subnets, not private. Option D is wrong because a VPC endpoint for S3 is for accessing S3 privately, not for general internet access. Option E is wrong because a bastion host is for SSH access, not for internet access.

Answer

Create a bastion host in the public subnet and configure the web server to use it as a proxy.

Answer

Create a VPC endpoint for Amazon S3.

Answer

Attach an Internet Gateway to the VPC and add a route to the Internet Gateway in the private subnet's route table.

Question 15

A security engineer is designing a multi-tier web application on AWS. The web tier must be accessible from the internet, but the application tier should be accessible only from the web tier. The database tier should be accessible only from the application tier. Which combination of security groups provides the MOST secure configuration?

Accepted Answer

Web SG: allow HTTP/HTTPS from 0.0.0.0/0. App SG: allow HTTP from Web SG security group ID. DB SG: allow MySQL from App SG security group ID.. Option D is correct because it uses specific security group references, which are more secure than CIDR ranges. Option A is wrong because it uses CIDR for the web tier, which is less specific. Option B is wrong because it allows all traffic from the web tier. Option C is wrong because it uses CIDR for the database tier.

Answer

Web SG: allow HTTP/HTTPS from 0.0.0.0/0. App SG: allow HTTP from Web SG CIDR. DB SG: allow MySQL from App SG CIDR.

Answer

Web SG: allow HTTP/HTTPS from 0.0.0.0/0. App SG: allow all traffic from Web SG. DB SG: allow MySQL from App SG.

Answer

Web SG: allow HTTP/HTTPS from 0.0.0.0/0. App SG: allow HTTP from Web SG security group ID. DB SG: allow MySQL from 10.0.0.0/24.