SCS-C02 Practice Test 47 — 15 Questions

Question 1

A company has a multi-account AWS environment using AWS Organizations. The security team needs to enforce that all new S3 buckets created in any account in the organization are encrypted with a specific KMS key. Which approach should be used?

Accepted Answer

Apply a Service Control Policy (SCP) that denies s3:CreateBucket unless encryption is configured. Option D is correct because an SCP can deny creation of S3 buckets that do not have the required encryption. Option A is wrong because IAM roles are for individual accounts, not organization-wide enforcement. Option B is wrong because a bucket policy is per bucket, not preventive for new buckets. Option C is wrong because AWS Config can detect non-compliance but does not prevent creation.

Answer

Set up AWS Config rules to detect non-compliant buckets

Answer

Create an IAM role that requires encryption and attach it to all users

Answer

Use an S3 bucket policy with a condition for encryption

Question 2

Which TWO AWS services are designed to provide DDoS protection? (Choose 2.)

Accepted Answer

AWS WAF. Options A and D are correct. AWS Shield Standard provides automatic DDoS protection. AWS WAF provides application-layer DDoS protection. Option B is wrong because VPC Flow Logs are for logging traffic. Option C is wrong because AWS Config is for configuration management. Option E is wrong because CloudTrail is for API logging.

Answer

VPC Flow Logs

Answer

AWS CloudTrail

Answer

AWS Config

Question 3

Which TWO actions can be taken to improve the security of an Amazon RDS for MySQL database instance? (Choose TWO.)

Accepted Answer

Place the RDS instance in a private subnet and restrict inbound traffic to the application security group.. Options A and D are correct. Enabling encryption at rest protects data, and using a VPC security group restricts network access. Option B is wrong because disabling automated backups reduces durability but does not directly improve security. Option C is wrong because Multi-AZ is for high availability, not security. Option E is wrong because assigning a public IP address increases exposure.

Answer

Disable automated backups to reduce storage costs.

Answer

Enable Multi-AZ deployment for fault tolerance.

Answer

Assign a public IP address to the RDS instance for easier access from the internet.

Question 4

A company has a VPC with multiple subnets. An EC2 instance in a private subnet needs to access an S3 bucket. Which configuration provides the most secure and efficient access?

Accepted Answer

Create a Gateway VPC Endpoint for S3 and update the route table.. Option B is correct because a Gateway VPC Endpoint for S3 allows private access to S3 without going through the internet or NAT Gateway, and it is more secure. Option A is wrong because it goes through the internet. Option C is wrong because Interface Endpoints are more costly and complex for S3. Option D is wrong because internet access still goes through the internet.

Answer

Create an Interface VPC Endpoint for S3.

Answer

Route the traffic through a NAT Gateway to the internet.

Answer

Assign a public IP address to the EC2 instance and allow it to access S3 via internet.

Question 5

A company has a VPC with a public subnet and a private subnet. An Amazon RDS instance is in the private subnet, and an application server is in the public subnet. The security team needs to allow the application server to connect to the RDS instance on port 3306 (MySQL). Which configuration will meet this requirement securely?

Accepted Answer

Add an inbound rule to the RDS security group that allows traffic from the security group of the application server on port 3306.. Security groups are stateful; you can allow inbound traffic from the security group of the application server. Option A is correct. Option B is less secure because it allows all traffic from the subnet. Option C is incorrect because it allows all traffic from the VPC. Option D is incorrect because it allows traffic from the internet.

Answer

Add an inbound rule to the RDS security group that allows traffic from the VPC CIDR on port 3306.

Answer

Add an inbound rule to the RDS security group that allows traffic from the subnet CIDR of the application server on port 3306.

Answer

Add an inbound rule to the RDS security group that allows traffic from 0.0.0.0/0 on port 3306.

Question 6

A company wants to allow an IAM user to list objects in an S3 bucket named 'my-bucket'. Which IAM policy statement grants the minimum required permissions?

Accepted Answer

{"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::my-bucket"}. Option B is correct because it grants only the s3:ListBucket action on the specified bucket. Option A is wrong because it grants s3:* which is excessive. Option C is wrong because it uses s3:GetObject which is not needed for listing. Option D is wrong because it grants s3:PutObject which is not needed.

Answer

{"Effect":"Allow","Action":"s3:PutObject","Resource":"arn:aws:s3:::my-bucket/*"}

Answer

{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::my-bucket/*"}

Answer

{"Effect":"Allow","Action":"s3:*","Resource":"arn:aws:s3:::my-bucket"}

Question 7

A company has an IAM policy that allows s3:GetObject on all buckets. However, a specific S3 bucket policy explicitly denies s3:GetObject to all principals. An IAM user with the IAM policy tries to read an object from that bucket. What is the result?

Accepted Answer

The request is denied because the explicit deny in the bucket policy overrides the allow in the IAM policy.. Option A is correct because an explicit deny in a bucket policy overrides any allow. Option B is wrong because explicit deny overrides allow. Option C is wrong because the bucket policy deny applies to all principals. Option D is wrong because the IAM policy allows the action but the bucket policy denies it.

Answer

The request is allowed because the IAM policy is more specific.

Answer

The request is allowed because the IAM policy allows the action.

Answer

The request is denied because the bucket policy applies only to IAM users.

Question 8

Which THREE are best practices for managing IAM roles?

Accepted Answer

Use IAM roles instead of IAM users for applications running on EC2.. Options B, C, and D are correct. Option A is wrong because roles should be granted the least privilege, not broad access. Option E is wrong because trust policies should be scoped to specific accounts or principals.

Answer

Set the trust policy to allow any AWS account to assume the role.

Answer

Grant broad permissions to roles to avoid frequent updates.

Question 9

A company uses AWS SSO to manage access to multiple accounts. An employee leaves the company. What is the most efficient way to revoke all AWS access for that employee?

Accepted Answer

Deactivate the user in the connected identity provider (e.g., Active Directory).. Option B is correct because deactivating the user in the identity provider (IdP) will invalidate all sessions and prevent new ones. Option A is wrong because deleting the IAM user in each account is inefficient. Option C is wrong because removing from groups in AWS SSO may not immediately revoke active sessions. Option D is wrong because deleting the IAM role would break access for other users.

Answer

Delete the corresponding IAM user in every AWS account.

Answer

Remove the user from all groups in AWS SSO.

Answer

Delete the IAM role that the user assumes in each account.

Question 10

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The Security Engineer needs to ensure that traffic between VPCs is inspected by a central network appliance. Which architecture should the Engineer implement?

Accepted Answer

Use Transit Gateway with appliance mode enabled on the attachments to the inspection VPC, and route inter-VPC traffic through the inspection VPC.. Option D is correct because Transit Gateway supports appliance mode on attachments, which enables asymmetric routing for inspection. Option A is wrong because VPC Peering does not support central inspection. Option B is wrong because placing the appliance in a public subnet is not secure and does not leverage Transit Gateway. Option C is wrong because route tables alone do not force traffic to the appliance if asymmetric routing is not handled.

Answer

Use VPC Peering connections between all VPCs and route traffic through the inspection VPC.

Answer

Place the network appliance in a public subnet of the inspection VPC and use internet gateways for routing.

Answer

Use Transit Gateway with route tables that point to the network appliance's ENI for all inter-VPC traffic.

Question 11

A company wants to allow an EC2 instance to access a DynamoDB table without traversing the internet. Which AWS feature should be used?

Accepted Answer

VPC Gateway Endpoint for DynamoDB. Option A is correct because VPC Gateway Endpoint for DynamoDB allows private connectivity. Option B is wrong because VPC Peering is for VPC-to-VPC. Option C is wrong because NAT Gateway is for internet access. Option D is wrong because ClassicLink is for EC2-Classic, deprecated.

Answer

VPC Peering

Answer

ClassicLink

Answer

NAT Gateway

Question 12

A company wants to restrict access to an S3 bucket so that only requests from a specific VPC endpoint are allowed. Which policy element should be used in the S3 bucket policy?

Accepted Answer

aws:SourceVpce. The aws:SourceVpce condition key limits access to requests originating from a specific VPC endpoint. Option C is correct. Option A (aws:SourceIp) is for IP addresses, not VPC endpoints. Option B (aws:SourceVpc) is for entire VPCs, not specific endpoints. Option D (aws:Referer) is for HTTP referer headers.

Answer

aws:Referer

Answer

aws:SourceVpc

Answer

aws:SourceIp

Question 13

A company wants to store audit logs for a minimum of 7 years to meet compliance requirements. The logs are stored in Amazon S3. Which action should be taken to ensure logs are not deleted before 7 years?

Accepted Answer

Create an S3 bucket policy that denies s3:DeleteObject unless the object age is greater than 7 years.. An S3 bucket policy denying s3:DeleteObject if the object age is less than 7 years can prevent premature deletion. Option B is correct. Lifecycle policy (A) transitions objects, doesn't prevent deletion. Versioning (C) helps with overwrites but not deletion. MFA Delete (D) adds protection but doesn't enforce time-based retention.

Answer

Enable MFA Delete on the bucket.

Answer

Configure an S3 Lifecycle policy to transition objects to Glacier after 7 years.

Answer

Enable S3 Versioning to preserve all versions of objects.

Question 14

A company is using AWS CloudFormation to deploy infrastructure. Which method ensures that sensitive data, such as database passwords, is not exposed in the template or outputs?

Accepted Answer

Use a dynamic reference to a Systems Manager Parameter Store parameter.. Using dynamic references to AWS Systems Manager Parameter Store or Secrets Manager keeps secrets out of templates. Option B is correct. Hardcoding (A) exposes secrets. Outputs (C) are visible. NoEcho (D) hides in console but not from API.

Answer

Use the 'NoEcho' property on the password parameter.

Answer

Store the password in the template outputs.

Answer

Hardcode the password in the template and use the 'NoEcho' property.

Question 15

Which TWO actions can help protect against DDoS attacks at the network layer?

Accepted Answer

Use AWS WAF to filter malicious requests.. AWS Shield Advanced (A) provides DDoS protection, and using AWS WAF (B) helps filter malicious traffic. Option A and B are correct. Security groups (C) are stateful firewalls, not DDoS protection. NACLs (D) are stateless firewalls. VPC peering (E) is for connectivity.

Answer

Configure security groups to restrict inbound traffic.

Answer

Configure network ACLs to deny all inbound traffic.

Answer

Use VPC peering to distribute traffic.