SCS-C02 Practice Test 46 — 15 Questions

Question 1

A company wants to enforce encryption in transit for all traffic between its VPC and on-premises data center over AWS Direct Connect. Which TWO configurations can achieve this?

Accepted Answer

Use a public virtual interface with Direct Connect and configure an IPsec VPN over it.. A public virtual interface over Direct Connect provides connectivity to public AWS endpoints, and by layering an IPsec VPN on top, you encrypt all traffic between your VPC and on-premises data center. This ensures encryption in transit while leveraging the low latency and reliability of Direct Connect. Option C is correct because a Direct Connect Gateway allows you to connect multiple VPCs to a Direct Connect private virtual interface, and configuring an IPsec VPN over that private virtual interface encrypts traffic end-to-end, meeting the encryption requirement.

Answer

Use a Site-to-Site VPN connection over the internet.

Answer

Use a Transit VPC architecture with VPN attachments.

Answer

Use a private virtual interface with Direct Connect.

Question 2

A company is using AWS Organizations to manage multiple accounts. The security team wants to prevent any IAM user from creating access keys. Which type of policy should be used to enforce this control across all accounts?

Accepted Answer

Service Control Policy (SCP). Service Control Policies (SCPs) are the only AWS Organizations policy type that can centrally restrict what IAM principals in member accounts are allowed to do, including denying iam:CreateAccessKey across every account in the OU. Because SCPs set the maximum permissions boundary for all identities in the account, an explicit Deny in an SCP overrides any IAM policy that would otherwise grant the action. This makes SCPs the correct mechanism for enforcing a blanket, organization-wide control.

Answer

AWS CloudTrail trail

Answer

AWS Config managed rule

Answer

IAM permissions boundary

Question 3

A company wants to enforce that all IAM users must use multi-factor authentication (MFA) to access the AWS Management Console. Which THREE steps should the company take?

Accepted Answer

Create an IAM policy that denies all actions if aws:MultiFactorAuthPresent is false.. The correct steps are to enable MFA for each IAM user (E), create an IAM policy that denies all actions if `aws:MultiFactorAuthPresent` is false (A), and attach the policy to all IAM users or groups (C). Enabling MFA per user is a prerequisite. The policy enforces MFA usage by denying API calls when MFA is not present. Attaching the policy ensures it applies to users. Option B (CloudTrail) is for auditing, not enforcement. Option D (password policy) does not enforce MFA for console access; it only sets password requirements.

Answer

Enable CloudTrail to monitor MFA usage.

Answer

Set the password policy to require MFA.

Question 4

A security engineer is investigating a potential data exfiltration incident. The engineer notices that an EC2 instance in a private subnet is making outbound connections to an external IP address on port 443. The VPC has a NAT gateway in a public subnet, and the route table for the private subnet directs 0.0.0.0/0 to the NAT gateway. The security group for the instance allows all outbound traffic. Which AWS service can the engineer use to determine which IAM role or user is responsible for launching the instance?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity, including the RunInstances call that launched the EC2 instance, along with the identity (IAM user or role) that made the request. By querying CloudTrail events for the instance ID, the engineer can determine which principal launched it. This directly answers the attribution question.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

IAM Access Analyzer

Question 5

A security engineer is designing a system to centrally manage security rules across multiple AWS accounts. The engineer wants to ensure that any resources that are non-compliant with security policies are automatically remediated. Which combination of services should the engineer use?

Accepted Answer

AWS Config with AWS Lambda for automatic remediation. AWS Config continuously evaluates resource configurations against desired policies (Config Rules), and its remediation action feature can invoke an AWS Lambda function automatically when a resource is found non-compliant. This combination provides both centralized, multi-account compliance evaluation (via a Config aggregator) and automated remediation, which is exactly what the question requires. Lambda gives the custom logic needed to fix the non-compliant resource, making this the only option that delivers automatic remediation based on compliance state.

Answer

AWS CloudTrail with Amazon SNS

Answer

Amazon GuardDuty with AWS Step Functions

Answer

AWS Security Hub with Amazon EventBridge

Question 6

A company is designing a data protection strategy for its Amazon RDS for MySQL database. The database contains sensitive data that must be encrypted at rest. The company also needs to manage the encryption keys using its own HSM. Which solution should be used?

Accepted Answer

Use AWS KMS with a custom key store backed by AWS CloudHSM. To encrypt an Amazon RDS for MySQL database at rest while managing keys in a customer-owned HSM, you must use AWS KMS with a custom key store backed by AWS CloudHSM. This allows you to use keys from your own CloudHSM cluster for RDS encryption. Option D is correct. Option A is incorrect because client-side encryption is not for at-rest encryption of the RDS instance itself. Option B is incorrect because you cannot directly import keys from CloudHSM into RDS; the integration is through KMS custom key store. Option C is incorrect because the default AWS KMS key does not allow you to manage the key in your own HSM.

Answer

Use client-side encryption with a key from CloudHSM

Answer

Use AWS CloudHSM to generate a key and import it into RDS

Answer

Enable encryption at rest using the default AWS KMS key

Question 7

A company wants to restrict access to an S3 bucket so that only traffic from a specific VPC can read objects. Which security mechanism should be used?

Accepted Answer

Use an S3 bucket policy with a condition that restricts access to the VPC endpoint ID.. An S3 bucket policy can include a condition that restricts access to traffic originating from a specific VPC endpoint. By using the `aws:SourceVpce` condition key, the policy ensures that only requests coming through the specified VPC endpoint (interface or gateway) are allowed to read objects, effectively locking down access to the VPC.

Answer

Assign an IAM role to the S3 bucket.

Answer

Attach a security group to the S3 bucket.

Answer

Configure a network ACL on the VPC subnet to allow traffic to S3.

Question 8

Drag and drop the steps to implement a secure CI/CD pipeline with AWS CodePipeline and IAM in the correct order.

Accepted Answer

First, create IAM roles with least privilege for CodePipeline and CodeBuild. Then, create an encrypted S3 bucket for storing artifacts. Next, create a source repository (e.g., AWS CodeCommit). After that, create a build project configured with security scanning tools. Finally, create the CodePipeline that integrates the source, build, and deployment stages.. Secure pipeline requires encrypted artifact bucket, IAM roles, source repo, build project with security scanning, and pipeline.

Answer

First, create an encrypted S3 bucket. Then, create a source repository. Next, create IAM roles. After that, create a build project with security scanning. Finally, create the pipeline.

Answer

First, create the pipeline. Then, create a source repository. Next, create a build project with security scanning. After that, create IAM roles. Finally, create an encrypted S3 bucket.

Answer

First, create a source repository. Then, create a build project with security scanning. Next, create IAM roles. After that, create the pipeline. Finally, create an encrypted S3 bucket.

Question 9

A company wants to protect sensitive data stored in Amazon S3 by enforcing encryption in transit. Which policy should be used to deny requests that do not use HTTPS?

Accepted Answer

{"Effect": "Deny", "Principal": "*", "Action": "s3:*", "Resource": "*", "Condition": {"Bool": {"aws:SecureTransport": "false"}}}. It uses the aws:SecureTransport condition set to 'false' to deny requests that are not using HTTPS. Option A is incorrect because it denies requests when SecureTransport is 'true', meaning it would block legitimate HTTPS traffic. Option C is incorrect because it checks for the presence of the s3:x-amz-server-side-encryption header, which relates to encryption at rest, not encryption in transit. Option D is incorrect because it denies all requests unconditionally, which would block all traffic, including HTTPS.

Answer

{"Effect": "Deny", "Principal": "*", "Action": "s3:*", "Resource": "*", "Condition": {"Bool": {"aws:SecureTransport": "true"}}}

Answer

{"Effect": "Deny", "Principal": "*", "Action": "s3:*", "Resource": "*", "Condition": {"Null": {"s3:x-amz-server-side-encryption": "true"}}}

Answer

{"Effect": "Deny", "Principal": "*", "Action": "s3:*", "Resource": "*"}

Question 10

A company uses AWS KMS to encrypt data in Amazon S3. The security team receives an alert that an IAM user is attempting to decrypt data using a key that they do not have access to. Which AWS service can be used to monitor and alert on such unauthorized KMS API calls?

Accepted Answer

AWS CloudTrail with CloudWatch Alarms. AWS CloudTrail logs all KMS API calls, and CloudWatch Alarms can be configured to trigger on specific unauthorized API calls, such as Decrypt attempts with a key the user does not have access to. Option A is incorrect because Amazon GuardDuty is a threat detection service that focuses on identifying malicious activity, but it does not provide detailed monitoring of specific KMS API calls. Option B is incorrect because AWS Config evaluates resource configurations and compliance, not API calls. Option D is incorrect because Amazon Inspector is a vulnerability assessment service for EC2 instances and does not monitor API calls.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

Amazon Inspector

Question 11

A company uses AWS KMS to encrypt data in Amazon RDS. The security team wants to ensure that the KMS key can be used only by specific IAM roles and that all usage of the key is logged. Which TWO actions should the team take?

Accepted Answer

Enable AWS CloudTrail to log KMS API calls. To restrict KMS key usage to specific IAM roles, the key policy must be modified to grant only those roles the kms:Encrypt and kms:Decrypt permissions (option D). To log all usage of the key, enable AWS CloudTrail to capture KMS API calls (option C). Option A is incorrect because an S3 bucket policy does not control KMS key usage. Option B is incorrect because key rotation does not restrict access. Option E is incorrect because cross-account access is not specified as a requirement.

Answer

Apply an S3 bucket policy to the RDS automated backup bucket

Answer

Enable automatic key rotation

Answer

Create a cross-account key policy to allow all IAM roles in the account

Question 12

A security engineer is troubleshooting why CloudTrail logs are not being delivered to an S3 bucket. The bucket policy allows CloudTrail to write objects, and the trail is configured to log management events. However, no log files appear in the bucket. What is the MOST likely cause?

Accepted Answer

The S3 bucket uses SSE-KMS encryption and the trail does not have permission to use the KMS key.. When an S3 bucket uses SSE-KMS encryption, CloudTrail requires explicit permission to use the KMS key for encrypting log files. Even if the bucket policy allows CloudTrail to write objects, the trail will fail to deliver logs if the KMS key policy does not grant the `kms:GenerateDataKey` and `kms:Decrypt` actions to the CloudTrail service principal. This is the most likely cause because the bucket policy appears correct, but the KMS key permissions are missing.

Answer

The trail is not logging data events.

Answer

The S3 bucket is in a different AWS account.

Answer

The bucket policy is missing a Deny statement.

Question 13

A company needs to encrypt data at rest in its Amazon EBS volumes. The company wants to use an encryption key that is automatically rotated every year without any manual intervention. Which key type should be used?

Accepted Answer

AWS managed key for EBS. AWS managed keys are automatically rotated annually. Option B (AWS managed key for EBS) is correct because this key type handles rotation automatically without any manual intervention. Option A (Imported key material in a customer managed key) is incorrect because imported key material does not support automatic rotation. Option C (Customer managed key with manual rotation) is incorrect because even though automatic rotation can be enabled on a customer managed key, the key type itself requires enabling rotation; the question implies a managed solution without manual setup. Option D (Default EBS encryption using an AWS managed key) is incorrect because it refers to an encryption setting, not a key type, and the question asks for the key type.

Answer

Imported key material in a customer managed key

Answer

Customer managed key with manual rotation

Answer

Default EBS encryption using an AWS managed key

Question 14

A company has multiple AWS accounts and wants to centrally manage access using IAM Identity Center (AWS SSO). Which feature allows the company to define permissions once and reuse them across multiple accounts?

Accepted Answer

Permission sets. Permission sets in IAM Identity Center define a collection of administrator-defined policies that grant specific permissions to users or groups. Once created, a permission set can be assigned to any number of AWS accounts within the organization, enabling centralized permission management and reuse across multiple accounts without duplicating policy definitions.

Answer

Application assignments

Answer

Identity providers

Answer

Account assignments

Question 15

Refer to the exhibit. This is a line from a VPC Flow Log. A security analyst notices that the log shows an ACCEPT record for a connection from 10.0.1.5 to 10.0.2.10 on port 443. However, the analyst expected the connection to be denied. Which field in the flow log record indicates that the connection was accepted?

Accepted Answer

The action field (ACCEPT). The action field in a VPC Flow Log record explicitly indicates whether the firewall (security group or network ACL) allowed or denied the traffic. In this case, the value 'ACCEPT' confirms that the connection from 10.0.1.5 to 10.0.2.10 on port 443 was permitted, which is why the analyst sees an ACCEPT record despite expecting a denial.

Answer

The version field (2)

Answer

The protocol field (6)

Answer

The destination port field (443)