SCS-C02 Practice Test 47 — 15 Questions

Question 1

A company's security team wants to detect unauthorized S3 bucket access attempts in real time. Which service should they use to generate alerts when an IAM user attempts to access a bucket without proper permissions?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS CloudTrail with CloudWatch alarms. AWS CloudTrail logs all API calls made to S3, including access denied errors. By creating a CloudWatch alarm on the `S3 AccessDenied` event in CloudTrail logs, the security team can receive real-time alerts when an IAM user attempts to access a bucket without proper permissions. This approach directly captures the unauthorized attempt at the API level, enabling immediate detection.

Answer

Amazon GuardDuty

Answer

S3 server access logs

Answer

AWS Config

Question 2

A security engineer is designing a multi-tier web application on AWS. The web tier must be accessible from the internet, but the application tier should be accessible only from the web tier. The database tier should be accessible only from the application tier. Which combination of security groups provides the MOST secure configuration?

Accepted Answer

Web SG: allow HTTP/HTTPS from 0.0.0.0/0. App SG: allow HTTP from Web SG security group ID. DB SG: allow MySQL from App SG security group ID.. It uses security group IDs as the source for inbound rules, which allows traffic only from instances associated with the specified security group, regardless of their IP addresses. This provides a dynamic and secure way to control traffic between tiers, as security group IDs are resolved at the instance level and automatically adapt to changes in instance membership. By contrast, using CIDR blocks (as in options A and C) is less secure because it relies on static IP ranges that may not accurately reflect the actual instances in the web or app tiers, and option B is overly permissive by allowing all traffic from the web SG.

Answer

Web SG: allow HTTP/HTTPS from 0.0.0.0/0. App SG: allow HTTP from Web SG CIDR. DB SG: allow MySQL from App SG CIDR.

Answer

Web SG: allow HTTP/HTTPS from 0.0.0.0/0. App SG: allow all traffic from Web SG. DB SG: allow MySQL from App SG.

Answer

Web SG: allow HTTP/HTTPS from 0.0.0.0/0. App SG: allow HTTP from Web SG security group ID. DB SG: allow MySQL from 10.0.0.0/24.

Question 3

Refer to the exhibit. A security engineer is analyzing a CloudTrail log entry for an EC2 RunInstances call. The engineer needs to determine if the instance launch was authorized by an IAM policy. Which field should the engineer check to identify the IAM policy that was used to authorize the action?

Accepted Answer

The 'userIdentity' field to identify the IAM user or role that made the call.. The 'userIdentity' field in a CloudTrail log entry contains details about the IAM user or role that made the API call, including the ARN and the access key ID. To identify the specific IAM policy that authorized the action, the security engineer must first know the identity (user/role) from the 'userIdentity' field, then cross-reference that identity with the IAM policies attached to it. The policy itself is not directly listed in the log entry, but the identity is the key to tracing authorization.

Answer

The 'vpcEndpointId' field to see if the call came through a VPC endpoint.

Answer

The 'sourceIP' field to identify the IP address.

Answer

The 'eventType' field to determine the type of event.

Question 4

A company is designing a security group for a web application that must receive HTTPS traffic from the internet and send traffic to a backend database. The backend database is an Amazon RDS MySQL instance. What is the best practice for configuring the security groups?

Accepted Answer

Web server SG: inbound HTTPS from 0.0.0.0/0. Database SG: inbound MySQL from web server SG.. The best practice is to allow inbound HTTPS from the internet to the web server security group, and then allow inbound MySQL on the database security group referencing the web server security group as the source. This creates a tight, identity-based trust relationship between tiers without hardcoding CIDR ranges.

Answer

Web server SG: inbound HTTPS from 0.0.0.0/0, outbound to database SG on port 3306. Database SG: inbound MySQL from web server CIDR block.

Answer

Web server SG: inbound HTTPS from 0.0.0.0/0, outbound all traffic. Database SG: inbound MySQL from 0.0.0.0/0.

Answer

Web server SG: inbound HTTPS from 0.0.0.0/0, inbound MySQL from database SG. Database SG: outbound MySQL to web server SG.

Question 5

A company is designing a centralized logging solution for multiple AWS accounts. The solution must meet the following requirements: 1) Logs from all accounts must be stored in a centralized S3 bucket. 2) The logs must be encrypted at rest using AWS KMS. 3) Access to the logs must be logged and monitored. Which TWO services should be used to meet the requirements? (Choose TWO.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail is correct because it can be configured to deliver log files from multiple AWS accounts into a single centralized S3 bucket, meeting the requirement for centralized logging. It also integrates with AWS KMS to encrypt the log files at rest using customer-managed keys, satisfying the encryption requirement.

Answer

Amazon GuardDuty

Answer

Amazon Macie

Answer

AWS Config

Question 6

A security team wants to audit all changes to IAM policies in the AWS account. Which AWS service should be used to track these changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity in the account, including all IAM policy changes (CreatePolicy, PutRolePolicy, AttachPolicy, etc.), and delivers these events to an S3 bucket and optionally CloudWatch Logs. It is the authoritative service for auditing who changed what and when across AWS APIs. For IAM policy change auditing, CloudTrail is the correct and standard answer.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

AWS CloudWatch Logs

Question 7

Which TWO of the following are valid use cases for IAM permissions boundaries? (Choose TWO.)

Accepted Answer

To prevent an IAM user from escalating privileges. IAM permissions boundaries are a feature that allows you to set the maximum permissions that an identity-based policy can grant to an IAM entity. By attaching a permissions boundary to a user or role, you can prevent that entity from creating or modifying IAM resources (such as roles or policies) to escalate their privileges, even if their attached policies would otherwise allow it. This acts as a guardrail to enforce a hard limit on what actions the entity can perform, directly addressing privilege escalation risks.

Answer

To allow cross-account access to an S3 bucket

Answer

To delegate permission management to non-administrators

Answer

To restrict access to an S3 bucket based on IP address

Question 8

A security engineer is designing a cross-account access policy. The engineer has an S3 bucket in Account A and wants to grant read access to a user in Account B. Which combination of policies is required?

Accepted Answer

A bucket policy in Account A allowing the user, and an IAM policy in Account B granting s3:GetObject.. Cross-account access to an S3 bucket requires both a resource-based policy (bucket policy) in Account A that grants permissions to the user in Account B, and an identity-based policy (IAM policy) in Account B that allows the user to perform the s3:GetObject action. Without both, access is denied. Option A is wrong because a bucket policy alone is insufficient; the user still needs an IAM policy in their own account to allow the action. Option B is wrong because bucket ACLs are a legacy mechanism and do not effectively support cross-account access for specific IAM users; they would still require an IAM policy in Account B. Option C is wrong because an IAM policy in Account B alone is insufficient; the bucket policy in Account A must explicitly grant access to the user, as the bucket's default policy denies access from other accounts.

Answer

A bucket policy in Account A that allows access to the user in Account B.

Answer

A bucket ACL in Account A granting access to the user in Account B.

Answer

An IAM policy in Account B that grants s3:GetObject to the bucket.

Question 9

Refer to the exhibit. A company uses this CloudFormation template. What security best practice is being violated?

Accepted Answer

The security group allows SSH access from all IP addresses.. The security group allows SSH access from all IP addresses (0.0.0.0/0), which is a significant security risk that exposes the instance to unauthorized access. Option A is wrong because the instance type is a performance consideration, not a security best practice. Option C is wrong because specifying the AMI ID as a parameter is not a security requirement; it is a parameterization best practice but not security-related. Option D is wrong because while encryption is a security best practice, the most critical violation here is the open SSH access, as it directly exposes the instance to potential attacks.

Answer

The instance type is too small for production workloads.

Answer

The AMI ID is not specified as a parameter.

Answer

The EBS volume is not encrypted.

Question 10

A company's security team discovers that an EC2 instance in the production account has been compromised. The instance has an IAM role attached that allows it to read from an S3 bucket containing sensitive data. The team needs to immediately stop the data exfiltration while preserving the evidence. What should the team do first?

Accepted Answer

Apply an inline policy to the IAM role that denies all S3 actions.. The correct first step because applying an inline policy that denies all S3 actions to the IAM role immediately stops the compromised instance from accessing the S3 bucket, preventing data exfiltration while preserving the instance's state for forensic investigation. Option A is incorrect because detaching the S3 bucket from the VPC endpoint does not affect the instance's ability to access S3 through the internet or other endpoints. Option C is incorrect because removing the IAM role from the instance may not take effect immediately if the role's credentials are cached, and it could disrupt evidence collection. Option D is incorrect because terminating the instance would destroy volatile evidence and might not stop exfiltration in time if the instance is already sending data.

Answer

Detach the S3 bucket from the VPC endpoint.

Answer

Remove the IAM role from the EC2 instance.

Answer

Terminate the compromised EC2 instance immediately.

Question 11

A company wants to allow its developers to SSH into EC2 instances only from the corporate network IP range (203.0.113.0/24). Which configuration should be used to enforce this restriction?

Accepted Answer

Add a security group rule that allows inbound SSH (port 22) from the corporate IP range.. A security group rule can restrict inbound SSH to the specific IP range. Security groups act as a virtual firewall for EC2 instances, and by adding a rule that allows inbound SSH only from the corporate IP range (203.0.113.0/24), all other inbound traffic on port 22 is implicitly denied. Option A is incorrect because network ACLs are stateless and apply at the subnet level, not the instance level, and the question asks for a configuration to enforce SSH restriction on EC2 instances. Option B is incorrect because AWS Systems Manager Session Manager does not use SSH; it provides browser-based shell access without inbound ports. Option C is incorrect because IAM policies control permissions for API actions, not network traffic.

Answer

Configure a network ACL on the subnet to allow inbound SSH from the corporate range and deny all other inbound traffic.

Answer

Use AWS Systems Manager Session Manager to connect to instances instead of SSH.

Answer

Add an IAM policy that allows `ec2:RunInstances` only if the request includes the corporate IP.

Question 12

A company has a multi-account AWS environment managed with AWS Organizations. The security team wants to ensure that no EC2 instance in any account can be launched without a specific tag 'CostCenter'. The team has created a Service Control Policy (SCP) that denies the ec2:RunInstances action if the request does not include the tag 'CostCenter'. However, they find that instances are still being launched without the tag in some accounts. What is the most likely reason?

Accepted Answer

The accounts launching instances without tags are the management account.. The most likely reason is that the accounts launching instances without the tag are the management account. Service Control Policies (SCPs) do not affect the management account in AWS Organizations; they only apply to member accounts. Therefore, if the security team is testing from the management account, the SCP denying ec2:RunInstances without the 'CostCenter' tag will not be enforced. Option A is incorrect because 'aws:RequestTag' is the correct condition key for tagging requests, not 'aws:ResourceTag'. Option C is incorrect because SCPs work by denying actions, not by requiring explicit allows. Option D is incorrect because the SCP would still prevent unauthorized launches even without an explicit allow. The issue is specifically that SCPs do not apply to the management account.

Answer

The SCP uses the wrong condition key; it should use 'aws:ResourceTag' instead.

Answer

The SCP does not include an explicit allow for the action.

Answer

The SCP is not attached to the organizational units containing the accounts.

Question 13

Refer to the exhibit. A security engineer is analyzing VPC Flow Logs and notices a pattern of outbound traffic from an EC2 instance to an external IP on port 22 (SSH). The engineer wants to identify which instances are initiating SSH connections to the internet. Which field in the flow log record indicates the source of the connection?

Accepted Answer

The first IP address in the log entry (srcaddr). In VPC Flow Logs, the `srcaddr` field records the source IP address of the traffic. Since the engineer is looking for which EC2 instances are initiating outbound SSH connections (port 22), the source IP in the flow log entry (srcaddr) directly identifies the instance that started the connection. The direction of the traffic is determined by the source and destination fields, not by the port numbers alone.

Answer

The second IP address (dstaddr)

Answer

The first port number (srcport)

Answer

The second port number (dstport)

Question 14

A security engineer is investigating a potential data exfiltration from an AWS account. Which TWO CloudTrail events would be MOST indicative of data exfiltration via S3?

Accepted Answer

`CopyObject` API calls from a production bucket to a bucket in another AWS account.. `CopyObject` API calls from a production bucket to a bucket in another AWS account indicate data being replicated or moved across account boundaries, which is a strong signal of potential data exfiltration. This action bypasses typical network controls and can transfer large volumes of data without requiring a download, making it a common exfiltration technique.

Answer

`PutObject` API calls from a known internal IP.

Answer

`ListObjects` API calls from an EC2 instance in the same VPC.

Answer

`DeleteObject` API calls from the root user.

Question 15

A security analyst wants to receive a notification whenever a new security group is created in their AWS account. Which AWS service should they use to trigger an SNS notification based on the CloudTrail event?

Accepted Answer

Amazon EventBridge (CloudWatch Events). Amazon EventBridge (formerly CloudWatch Events) can monitor CloudTrail API calls in real time and trigger an SNS notification when a specific event, such as CreateSecurityGroup, occurs. By creating a rule that matches the event source and detail type, EventBridge evaluates incoming events and routes matching ones to an SNS topic, enabling the desired notification.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

AWS Lambda