SCS-C02 Practice Test 49 — 15 Questions

Question 1

A company is designing a shared services VPC architecture with multiple VPCs connected via a transit gateway. The security engineer needs to ensure that all traffic between VPCs is inspected by a centralized firewall appliance deployed in the shared services VPC. What configuration is required?

Accepted Answer

Configure transit gateway route tables to route all inter-VPC traffic through the firewall appliance.. Option D is correct because transit gateway route tables can be used to route traffic to the firewall appliance for inspection. Option A is wrong because VPC peering would bypass the firewall. Option B is wrong because a GWLB can be used but it is not the only way; transit gateway route tables can also do it. Option C is wrong because security groups are not for routing.

Answer

Create VPC peering connections between each VPC and the shared services VPC.

Answer

Use security groups to route traffic through the firewall.

Answer

Deploy a Gateway Load Balancer (GWLB) in the shared services VPC and register the firewall as a target.

Question 2

A company wants to provide temporary, limited-privilege credentials to users so they can access AWS resources from mobile applications. Which AWS service should the company use?

Accepted Answer

AWS Security Token Service (STS). Option B is correct because AWS STS issues temporary credentials. Option A is wrong because IAM users have long-term credentials. Option C is wrong because Cognito identity pools can use STS but the base service for temporary credentials is STS. Option D is wrong because SSO provides federated access but not temporary credentials for mobile apps directly.

Answer

AWS Single Sign-On (SSO)

Answer

AWS Identity and Access Management (IAM) users

Answer

Amazon Cognito user pools

Question 3

A security engineer needs to ensure that all Amazon S3 buckets in an AWS account have server-side encryption (SSE) enabled. The engineer wants to automatically remediate any bucket that is created without SSE. Which solution should the engineer implement?

Accepted Answer

Use AWS Config with a managed rule (s3-bucket-server-side-encryption-enabled) and an automatic remediation action.. Option A is correct because AWS Config rules can be used to detect non-compliant buckets and trigger remediation actions. Option B is wrong because SCPs can deny creation of buckets without encryption but require careful policy writing. Option C is wrong because IAM policies enforce on principals, not buckets. Option D is wrong because bucket policies can require encryption but only for access, not creation.

Answer

Use S3 bucket policies to deny access to objects without encryption.

Answer

Apply an IAM policy that requires SSE for all S3 actions.

Answer

Create a service control policy (SCP) that denies creation of buckets without encryption.

Question 4

A company is deploying a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The security engineer needs to protect the application from common web exploits such as SQL injection and cross-site scripting. Which TWO services can be used together to achieve this? (Choose TWO.)

Accepted Answer

AWS Shield Advanced. Option A and D are correct. AWS WAF can be associated with ALB to filter web requests. AWS Shield Advanced provides enhanced protection against DDoS attacks. Option B is wrong because CloudFront itself does not provide WAF rules. Option C is wrong because NACLs are not designed for web application layer filtering. Option E is wrong because GuardDuty is for threat detection, not inline prevention.

Answer

Amazon GuardDuty

Answer

Network ACLs

Answer

Amazon CloudFront

Question 5

A company wants to use AWS CloudTrail to log all API calls in an AWS account. The security engineer needs to ensure that the logs are encrypted at rest and are accessible only to authorized personnel. Which THREE steps should the engineer take? (Choose THREE.)

Accepted Answer

Enable server-side encryption on the S3 bucket that stores CloudTrail logs.. Option A, C, and E are correct. Enabling SSE-S3 or SSE-KMS ensures encryption at rest. Using a bucket policy with conditions for HTTPS ensures encryption in transit. Applying an IAM policy to restrict access ensures only authorized personnel can access logs. Option B is wrong because SCPs apply at the organization level, not account-level log access. Option D is wrong because MFA delete does not encrypt logs.

Answer

Enable MFA delete on the S3 bucket.

Answer

Attach a service control policy (SCP) to the root account.

Question 6

A security engineer is designing a network architecture in AWS. The engineer needs to ensure that all outbound traffic from a VPC goes through a centrally managed NAT device for logging and filtering. The VPC has multiple private subnets. Which TWO steps are required to accomplish this? (Choose TWO.)

Accepted Answer

Create a route table for the private subnets with a default route (0.0.0.0/0) pointing to the NAT device.. Option B and D are correct. Configuring the route tables to point to the NAT device ensures traffic goes through it. Placing the NAT device in a public subnet with an internet gateway allows it to reach the internet. Option A is wrong because a transit gateway is not needed. Option C is wrong because a proxy is not required. Option E is wrong because a gateway endpoint is for S3/DynamoDB, not internet traffic.

Answer

Deploy an HTTP forward proxy in the public subnet.

Answer

Set up a transit gateway and attach the VPC to it.

Answer

Create a gateway endpoint for Amazon S3.

Question 7

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all new member accounts automatically deny public access to S3 buckets. Which policy should be attached to the root organizational unit?

Accepted Answer

Attach a service control policy (SCP) to the root OU. Option C is correct because an SCP can deny public access to S3 buckets across all accounts in the organization. Option A is wrong because an IAM policy only applies to IAM users/groups/roles, not accounts. Option B is wrong because a bucket policy is per-bucket, not across accounts. Option D is wrong because a trust policy is for IAM roles, not S3 access control.

Answer

Attach an S3 bucket policy to each bucket

Answer

Attach an IAM policy to the root user

Answer

Attach a trust policy to the OrganizationAccountAccessRole

Question 8

A company wants to automate security assessments of its AWS environment. Which TWO AWS services can be used to perform vulnerability scanning and compliance checks?

Accepted Answer

Amazon Inspector. Option A (Amazon Inspector) is correct for vulnerability scanning. Option D (AWS Security Hub) is correct for compliance checks. Option B (AWS Config) tracks resource changes but does not scan vulnerabilities. Option C (AWS Shield) is for DDoS protection. Option E (AWS WAF) is for web application firewall.

Answer

AWS Shield

Answer

AWS WAF

Answer

AWS Config

Question 9

A security engineer notices that an IAM role allows 'iam:PassRole' to an EC2 instance. What security risk does this present?

Accepted Answer

The instance can launch new resources with a more privileged role.. PassRole allows an entity to pass a role to an AWS service. If the role has broad permissions, the instance can escalate privileges. Option A is not directly related. Option B is about data encryption. Option D is about logging.

Answer

The instance can modify IAM policies.

Answer

The instance can stop CloudTrail logging.

Answer

The instance can decrypt data encrypted with KMS keys.

Question 10

Which TWO IAM policy conditions can be used to enforce that API calls originate from a specific AWS region? (Choose TWO.)

Accepted Answer

aws:RequestedRegion. The correct answers are B and C. aws:RequestedRegion is the condition key to check the region in the request. aws:SourceIp can be used to restrict IP addresses, but not directly region. However, there is also a condition key aws:Region that can be used in some services, but aws:RequestedRegion is the standard for most services. Option A is wrong because there is no aws:Region condition. Option D is wrong because ec2:Region is specific to EC2. Option E is wrong because aws:SourceIp is for IP, not region.

Answer

ec2:Region

Answer

aws:UserAgent

Answer

aws:SourceIp

Answer

aws:Region

Question 11

An IAM user reports that they are unable to launch an EC2 instance in a specific VPC. The user has an IAM policy that allows ec2:RunInstances for all resources. The VPC has a network ACL that allows all inbound and outbound traffic. What is the most likely cause of the failure?

Accepted Answer

The IAM policy does not grant permission to use the subnet.. Option D is correct because the user needs to specify a subnet when launching an instance, and the IAM policy may not grant permission for the specific subnet if it has a condition. However, the more likely cause is that the user does not have permission to use the subnet resource. Option A is wrong because the VPC is not a resource that requires IAM permissions for the instance launch; the instance is launched into a subnet. Option B is wrong because security groups do not affect the ability to launch instances. Option C is wrong because network ACLs do not affect the ability to launch instances.

Answer

The IAM policy does not grant permission to use the VPC.

Answer

The security group associated with the instance is blocking the launch.

Answer

The network ACL is blocking the launch request.

Question 12

A security engineer is investigating a potential security incident in an AWS account. The engineer needs to determine which user or role performed a specific API call that created a new security group. Which THREE AWS tools can the engineer use to find this information? (Choose THREE.)

Accepted Answer

AWS CloudTrail event history. Option A, D, and E are correct. CloudTrail logs all API calls, including who made the call. CloudTrail event history provides a view of the last 90 days. AWS Config records configuration changes, including security group creation. Option B is wrong because CloudWatch Logs does not capture API calls unless specifically configured. Option C is wrong because VPC Flow Logs capture network traffic, not API calls.

Answer

Amazon CloudWatch Logs

Answer

VPC Flow Logs

Question 13

A security engineer is investigating a potential breach. The engineer notices that an EC2 instance's security group allows inbound SSH (port 22) from 0.0.0.0/0. The instance is in a public subnet and has a public IP address. However, the engineer finds that SSH access is only possible from a specific IP address. What is the most likely explanation?

Accepted Answer

The network ACL denies inbound SSH from all IPs except the specific IP. Option D is correct because a network ACL (NACL) can override security group rules if it denies inbound traffic. Option A is wrong because security groups are stateful; the inbound rule would allow traffic. Option B is wrong because if the NACL allowed traffic, it wouldn't explain the restriction. Option C is wrong because security group rules are evaluated; the rule allowing all traffic would still apply.

Answer

The network ACL allows inbound SSH from 0.0.0.0/0

Answer

The security group rule is being overridden by a more restrictive security group attached to the same instance

Answer

The security group rule is being evaluated but the instance's operating system firewall is blocking SSH

Question 14

A company is designing a VPC with public and private subnets in two Availability Zones. They need to ensure that instances in the private subnets can access the internet for software updates but cannot be directly accessed from the internet. Which AWS service or feature should be used to meet this requirement?

Accepted Answer

NAT Gateway. Option B is correct because a NAT Gateway allows instances in private subnets to initiate outbound traffic to the internet while preventing inbound traffic from the internet. Option A is wrong because an Internet Gateway is used for public subnets and allows inbound traffic. Option C is wrong because a VPN connection is for site-to-site connectivity, not internet access. Option D is wrong because a VPC Peering connection connects VPCs, not to the internet.

Answer

VPC Peering

Answer

AWS VPN

Answer

Internet Gateway

Question 15

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via AWS Site-to-Site VPN. Security engineers need to ensure that traffic between VPCs is inspected by a third-party firewall appliance deployed in a centralized inspection VPC. Which architecture should be used?

Accepted Answer

Create a central inspection VPC with the firewall appliance. Configure Transit Gateway route tables to route traffic between VPCs through the inspection VPC.. Option B is correct because Transit Gateway route tables can be used to force traffic through the inspection VPC by attaching the firewall appliance to a VPC and using blackhole routes or specific routing. Option A is wrong because Network ACLs are stateless and cannot perform deep packet inspection. Option C is wrong because VPC Peering does not support transitive routing. Option D is wrong because security groups are stateful but do not provide advanced firewall capabilities.

Answer

Use security groups in each VPC to allow only traffic from the firewall appliance's IP.

Answer

Establish VPC Peering connections between each VPC and the inspection VPC.

Answer

Configure Network ACLs in each VPC to deny traffic that does not originate from the inspection VPC.