SCS-C02 Practice Test 45 — 15 Questions

Question 1

A company uses AWS Organizations with multiple accounts. The security team wants to centrally manage IAM policies across all accounts. Which AWS feature should the team use to enforce permissions across member accounts?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Service Control Policies (SCPs). Service Control Policies (SCPs) allow central control over permissions for all accounts in an organization. Option A is wrong because IAM roles with cross-account access provide temporary access but do not enforce policies centrally. Option C is wrong because AWS Config rules are for compliance monitoring, not permission enforcement. Option D is wrong because AWS CloudTrail is for auditing, not enforcement.

Answer

IAM roles with cross-account access

Answer

AWS Config rules

Answer

AWS CloudTrail trails

Question 2

A company wants to allow an EC2 instance to access a DynamoDB table without traversing the internet. Which AWS feature should be used?

Accepted Answer

VPC Gateway Endpoint for DynamoDB. A VPC Gateway Endpoint for DynamoDB allows EC2 instances within a VPC to access DynamoDB without traversing the internet. It uses AWS PrivateLink to route traffic through the AWS network, ensuring low latency and enhanced security by keeping traffic within the AWS backbone.

Answer

VPC Peering

Answer

ClassicLink

Answer

NAT Gateway

Question 3

A company uses AWS CloudTrail to log API calls in all accounts. The security team wants to be notified immediately when an IAM user creates a new access key for another user. Which combination of services should the team use?

Accepted Answer

AWS CloudTrail, Amazon CloudWatch Logs, and Amazon Simple Notification Service (SNS).. It uses CloudTrail to capture the CreateAccessKey API call, sends those logs to CloudWatch Logs, and then triggers a CloudWatch alarm that publishes to an SNS topic for immediate notification. This combination provides real-time alerting on the specific IAM event without requiring additional services.

Answer

AWS Config and Amazon Simple Email Service (SES).

Answer

Amazon GuardDuty and Amazon Simple Notification Service (SNS).

Answer

Amazon Macie and AWS Lambda.

Question 4

Refer to the exhibit. A security engineer applies this bucket policy to an S3 bucket. A user without HTTPS tries to download an object. What is the outcome?

Accepted Answer

The request is denied because the condition matches. The bucket policy includes a condition that denies requests when `aws:SecureTransport` is `false`. Since the user attempts to download an object without HTTPS, the condition matches, and the explicit Deny effect overrides any Allow. Therefore, the request is denied.

Answer

The request fails because the condition does not match

Answer

The request succeeds because the policy has a Deny effect

Answer

The request succeeds because the resource is not specific enough

Question 5

A company wants to ensure that all IAM users have multi-factor authentication (MFA) enabled. Which AWS service can be used to detect users without MFA and automatically send a notification?

Accepted Answer

AWS Config. AWS Config is the correct answer because it provides a managed rule 'iam-user-mfa-enabled' that can evaluate whether IAM users have MFA enabled. When a non-compliant user is detected, AWS Config can trigger an SNS notification to alert administrators. AWS Trusted Advisor (option A) only checks MFA on the root account, not all IAM users. AWS CloudTrail (option B) records API activity but does not evaluate configuration rules. AWS IAM (option D) itself does not have automatic detection and notification capabilities for MFA status.

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Answer

AWS IAM

Question 6

A company stores sensitive data in an Amazon S3 bucket. The security team requires that all data in transit between the company's on-premises data center and S3 be encrypted. Which solution meets this requirement?

Accepted Answer

Use HTTPS (TLS) endpoints when uploading objects to S3.. Using HTTPS (TLS) ensures encryption of data in transit between the client and S3. Option A is incorrect because although an IPsec VPN encrypts traffic between the data center and AWS, the data is then decrypted and sent to S3, so it does not guarantee encryption for the entire path unless S3 is accessed via HTTPS as well. Option B is incorrect because S3 Transfer Acceleration speeds up transfers using edge locations but does not provide encryption; HTTPS is still required. Option D is incorrect because a VPC endpoint for S3 provides private connectivity but does not encrypt traffic; encryption still relies on HTTPS.

Answer

Set up an IPsec VPN connection between the data center and AWS, and access S3 through the VPN.

Answer

Enable S3 Transfer Acceleration on the bucket.

Answer

Use AWS PrivateLink to create a VPC endpoint for S3.

Question 7

A company wants to ensure that all S3 buckets in their AWS account have encryption enabled. Which AWS service can continuously evaluate compliance and automatically remediate non-compliant buckets?

Accepted Answer

AWS Config. AWS Config is the service that continuously evaluates resource configurations against desired policies and can automatically remediate non-compliant resources. It can monitor S3 bucket encryption settings and trigger remediation actions (e.g., via SSM Automation) to enable encryption. AWS Config rules can be configured to check for encryption and automatically remediate using remediation actions.

Answer

AWS CloudTrail

Answer

AWS IAM

Answer

Amazon S3

Question 8

A company has an S3 bucket with versioning enabled. They want to ensure that all deleted objects are retained for 90 days before permanent deletion. Which S3 feature should be used?

Accepted Answer

S3 Lifecycle policy with NoncurrentVersionExpiration. S3 Lifecycle policies can manage the expiration of noncurrent versions of objects. In this scenario, after an object is deleted, it becomes a noncurrent version. A lifecycle rule with NoncurrentVersionExpiration can be set to permanently delete those noncurrent versions after a specified number of days (e.g., 90). Option A is correct. S3 Object Lock protects objects from deletion but does not automatically delete them after a period. S3 Replication is for copying objects to another bucket. MFA Delete adds a multi-factor authentication requirement for deletion but does not set a retention period.

Answer

S3 Replication

Answer

S3 Object Lock

Answer

MFA Delete

Question 9

A security engineer is implementing centralized logging across multiple AWS accounts. Which TWO actions should the engineer take to ensure logs are securely stored and immutable? (Choose TWO.)

Accepted Answer

Use AWS KMS with a customer managed key for encryption. Using AWS KMS with a customer managed key (CMK) for encryption ensures that the security engineer has full control over the encryption keys, including key rotation, access policies, and the ability to disable or revoke the key. This prevents unauthorized decryption of logs, even by AWS, and is a critical component of securing log data at rest. Option C is correct because enabling S3 Object Lock on the destination bucket enforces a write-once-read-many (WORM) model, preventing logs from being deleted or overwritten for a specified retention period, which ensures immutability and compliance with regulatory requirements.

Answer

Enable S3 Transfer Acceleration on the bucket

Answer

Enable CloudTrail log file validation

Answer

Enable MFA Delete on the bucket

Question 10

A security engineer is investigating an IAM role that was used to access AWS resources from an external account. The role has a trust policy that allows the external account to assume it. Which of the following is a required step for the external account to use the role?

Accepted Answer

Attach an IAM policy to an IAM user in the external account that allows sts:AssumeRole for the role ARN.. For an external account to assume an IAM role in another account, an IAM user or role in the external account must have an IAM policy that allows the sts:AssumeRole action for the role's ARN. This is a required step because the external account's identity needs permission to call AssumeRole. The trust policy on the role allows the external account to assume it, but the external account must also grant its own identity the permission to assume that role.

Answer

Configure the role to require MFA for the external account.

Answer

Create a new IAM role in the external account with a trust policy allowing the role's ARN.

Answer

Add the external account's root user ARN to the role's trust policy.

Question 11

A company uses S3 to store sensitive customer data. They want to ensure that all S3 buckets have encryption enabled at rest. Which S3 feature should be used to automatically enforce encryption on all newly created objects?

Accepted Answer

S3 Bucket Policy with a condition requiring server-side encryption. An S3 bucket policy with a condition requiring server-side encryption (e.g., 's3:x-amz-server-side-encryption': 'aws:kms' or 'AES256') can deny any PutObject request that does not include the encryption header, thereby automatically enforcing encryption on all newly created objects. Option A is incorrect because S3 Block Public Access controls public access, not encryption. Option B is incorrect because S3 Object Lock is for write-once-read-many (WORM) retention, not encryption enforcement. Option D is incorrect because S3 Inventory provides a list of objects and their metadata but does not enforce encryption.

Answer

S3 Block Public Access

Answer

S3 Object Lock

Answer

S3 Inventory

Question 12

A security team wants to collect and analyze logs from multiple AWS services including CloudTrail, VPC Flow Logs, and AWS WAF. They need a centralized solution that can filter, transform, and route logs to multiple destinations in near real-time. Which AWS service should they use?

Accepted Answer

Amazon Kinesis Data Streams combined with Amazon Kinesis Data Firehose. Amazon Kinesis Data Streams combined with Amazon Kinesis Data Firehose is the correct choice because it provides a fully managed, scalable, and near real-time pipeline for collecting, filtering, transforming, and routing logs from multiple AWS services (CloudTrail, VPC Flow Logs, WAF) to multiple destinations such as Amazon S3, Amazon Redshift, or Amazon Elasticsearch Service. Kinesis Data Streams captures and stores the data stream, while Kinesis Data Firehose can invoke AWS Lambda for transformation and reliably deliver the processed logs to the specified sinks, meeting the requirement for centralized, near real-time log processing.

Answer

Amazon CloudWatch Logs Insights

Answer

Amazon CloudWatch Logs subscription filters with AWS Lambda

Answer

Amazon S3 with S3 Event Notifications

Question 13

A solutions architect needs to design a system where an EC2 instance can write logs to CloudWatch Logs. Which IAM entity should be used to grant permissions to the EC2 instance?

Accepted Answer

An IAM role with an instance profile. An IAM role with an instance profile is the correct approach because it allows the EC2 instance to assume temporary, rotated credentials via the AWS Security Token Service (STS). The instance profile is attached to the EC2 instance, and the AWS SDK or CLI automatically retrieves credentials from the instance metadata service (IMDS) to authenticate API calls to CloudWatch Logs. This eliminates the need to store long-term credentials on the instance and follows the principle of least privilege.

Answer

A resource-based policy on the EC2 instance

Answer

An IAM user with access keys stored on the instance

Answer

An IAM group

Question 14

A financial services company uses AWS CloudTrail to log all API calls in their account. They store the logs in an S3 bucket with server-side encryption using AWS KMS (SSE-KMS). The security team needs to ensure that only authorized users can decrypt and read the logs. They have created a KMS key with a key policy that grants decrypt permissions to the security team's IAM roles. However, when a security engineer tries to download a log file from the S3 bucket using the AWS CLI, they receive an 'AccessDenied' error. The engineer has s3:GetObject permission on the bucket. What is the most likely cause?

Accepted Answer

The KMS key policy does not grant the engineer's role permission to decrypt.. The engineer has s3:GetObject permission, but the S3 object is encrypted with SSE-KMS. To decrypt and read the object, the engineer also needs kms:Decrypt permission on the KMS key. The key policy grants decrypt permissions to the security team's IAM roles, but the engineer's role may not be included. The most likely cause is that the KMS key policy does not grant the engineer's role permission to decrypt.

Answer

The CloudTrail trail is not configured to use SSE-KMS.

Answer

The S3 bucket has a bucket policy that denies access to the engineer's IAM role.

Answer

The S3 bucket policy does not allow the engineer to read objects.

Question 15

A company uses AWS Secrets Manager to rotate database credentials automatically. The security team wants to ensure that while the secret is being rotated, applications can always retrieve a valid credential. Which rotation strategy should be used?

Accepted Answer

Use the alternating users rotation strategy.. The alternating users rotation strategy (Option D) is correct because it creates two sets of credentials—one active and one pending—so that during rotation, at least one set remains valid for applications. Option A (IAM database authentication) is not a rotation strategy for Secrets Manager. Option B (single user rotation with immediate update) would cause a brief period where the credential is invalid, leading to potential downtime. Option C (disabling automatic rotation) defeats the purpose of automated rotation.

Answer

Use AWS IAM database authentication instead.

Answer

Use a single user rotation with immediate update.

Answer

Disable automatic rotation and manually update credentials.