SCS-C02 Practice Test 49 — 15 Questions

Question 1

Which TWO actions are valid ways to restrict access to an Amazon S3 bucket using a bucket policy? (Choose two.)

Accepted Answer

Use the aws:SourceIp condition key to allow access only from a specific IP range.. The `aws:SourceIp` condition key in an S3 bucket policy allows you to restrict access based on the requester's IP address. This is a standard AWS IAM condition that evaluates the source IP of the request, enabling you to permit or deny access from a specific CIDR range. It is commonly used to limit S3 bucket access to a corporate network or a known set of public IPs.

Answer

Use the iam:RoleName condition key to allow access only from a specific IAM role.

Answer

Use the aws:SourceVpce condition key to allow access only from a specific VPC.

Answer

Use the kms:EncryptionContext condition key to require that objects are encrypted with a specific KMS key.

Question 2

A company wants to ensure that all S3 buckets are encrypted at rest. Which THREE services can be used to detect and alert on unencrypted buckets?

Accepted Answer

AWS Config. AWS Config can evaluate S3 bucket configurations against managed rules like 's3-bucket-server-side-encryption-enabled' to detect unencrypted buckets. When a bucket violates the rule, AWS Config can trigger an Amazon SNS notification or invoke a Lambda function for remediation, enabling real-time alerting.

Answer

Amazon CloudWatch Logs Insights

Answer

Amazon VPC Flow Logs

Question 3

A company has a security requirement to automatically isolate an Amazon EC2 instance that is generating high network traffic to a known malicious IP address. The company uses Amazon GuardDuty and AWS Lambda. Which combination of services and configurations should be used to achieve the isolation?

Accepted Answer

Use Amazon GuardDuty to send findings to Amazon CloudWatch Events, which triggers an AWS Lambda function that modifies the security group to remove the instance.. Amazon GuardDuty generates findings for threats like communication with known malicious IPs, and these findings can be sent to Amazon CloudWatch Events (now Amazon EventBridge). CloudWatch Events can then trigger an AWS Lambda function that modifies the security group associated with the EC2 instance to remove its inbound/outbound rules, effectively isolating the instance. This automated workflow meets the security requirement without manual intervention.

Answer

Use VPC Flow Logs to send logs to CloudWatch Logs, then create a metric filter that triggers a Lambda function.

Answer

Use Amazon GuardDuty to send findings to AWS Systems Manager Automation to run a document that isolates the instance.

Answer

Use AWS Config rules to detect the traffic and invoke a Lambda function to change the security group.

Question 4

Your organization uses AWS Organizations with 50 member accounts. You are the security administrator for the root account. You have enabled AWS CloudTrail in all accounts and centralized the logs in an S3 bucket in the root account. You also enabled Amazon GuardDuty in the root account and have delegated an administrator account. Recently, you received an alert from GuardDuty about a potential credential compromise in a member account. The finding indicates that an IAM user in that account made an API call from an unusual IP address. You need to quickly gather all CloudTrail events for that user from the last 30 days across all accounts. The logs are stored in a single S3 bucket with a prefix structure like 'AWSLogs//CloudTrail////'. What is the MOST efficient way to query these logs?

Accepted Answer

Use Amazon Athena to query the CloudTrail logs by creating a table partitioned by account, region, and date.. Amazon Athena is the most efficient way to query CloudTrail logs stored in S3 because it allows you to run SQL queries directly on the data without moving or downloading it. By creating a table partitioned by account, region, and date, you can quickly filter for the specific IAM user's events across all 50 accounts for the last 30 days, leveraging partition pruning to scan only the relevant log files. This approach minimizes data scanned and cost, while providing near-instant results.

Answer

Enable AWS CloudTrail Lake and create a new event data store that includes the historical logs.

Answer

Download all log files from the S3 bucket for the last 30 days and parse them locally.

Answer

Use Amazon CloudWatch Logs Insights to query the logs from the member account.

Question 5

A company wants to restrict access to an S3 bucket so that only traffic from a specific VPC can download objects. Which combination of actions should the company take? (Choose TWO.)

Accepted Answer

Create an S3 bucket policy that allows access only from the VPC using the aws:SourceVpc condition.. To restrict access to an S3 bucket so that only traffic from a specific VPC can download objects, the correct combination is to create an S3 bucket policy that uses the aws:SourceVpc condition (Option C) and create a VPC endpoint for Amazon S3 in the VPC (Option E). The bucket policy with aws:SourceVpc ensures that only requests originating from the specified VPC are allowed, while the VPC endpoint enables private connectivity between the VPC and S3 without traversing the internet. Option A (Internet gateway) would make the VPC publicly accessible and is not required for private access. Option B (NAT gateway) is used for outbound internet access from private subnets, not for restricting access to S3. Option D (security group) cannot be attached to an S3 bucket; security groups apply to EC2 instances or other resources, not to S3.

Answer

Attach an Internet gateway to the VPC and route traffic through it.

Answer

Attach a security group to the S3 bucket.

Answer

Create a NAT gateway in the VPC for outbound traffic.

Question 6

A company is using AWS CloudTrail to monitor API activity in their account. They have enabled CloudTrail in all regions and are logging to an S3 bucket. The security team wants to ensure that log files are not tampered with after delivery. They enable CloudTrail log file integrity validation. Which additional step must be taken to verify the integrity of the log files?

Accepted Answer

Use the AWS CLI to run the validate-logs command against the log files.. CloudTrail log file integrity validation uses digital signatures (SHA-256 hashing and signing with a private key). To verify integrity, you must use the AWS CLI command 'aws cloudtrail validate-logs' or download the public key and verify manually. Option A (enable S3 versioning) helps protect against accidental deletion or overwriting but does not verify integrity. Option B (use KMS to encrypt logs) protects confidentiality only. Option C (use S3 Object Lock) prevents deletion or modification but does not provide tamper detection or integrity verification.

Answer

Enable S3 versioning on the log bucket.

Answer

Configure the S3 bucket to use server-side encryption with AWS KMS.

Answer

Enable S3 Object Lock on the log bucket.

Question 7

A security engineer is setting up automated incident response for a compromised IAM user. The engineer wants to automatically revoke the user's access keys and attach a deny-all policy when a GuardDuty finding of type 'UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration' is generated. Which services should be used to achieve this automation?

Accepted Answer

Amazon CloudWatch Events and AWS Lambda. Amazon CloudWatch Events (now part of Amazon EventBridge) can capture GuardDuty findings in real-time and trigger a Lambda function to revoke IAM user access keys and attach a deny-all policy. This is the native, event-driven pattern for automated incident response to GuardDuty findings, as CloudWatch Events directly supports GuardDuty as an event source.

Answer

Amazon Simple Notification Service (SNS) and AWS Lambda

Answer

AWS Config and AWS Lambda

Answer

AWS Systems Manager Automation and AWS Lambda

Question 8

A company has a VPC with a public subnet and a private subnet. The public subnet hosts a NAT instance (Amazon Linux) that provides internet access to instances in the private subnet. The security team notices that the NAT instance is receiving high inbound traffic on port 22 from an external IP address. The team wants to block this traffic at the network layer without affecting other traffic. What is the most effective solution?

Accepted Answer

Add a network ACL rule on the public subnet to deny inbound traffic from the specific IP on port 22.. A network ACL (NACL) operates at the subnet level (layer 3/4) and is stateless, meaning it can explicitly deny inbound traffic from a specific IP on port 22 before it reaches the NAT instance. This blocks the traffic at the network layer without affecting other traffic, as NACLs evaluate rules in order and deny rules override allow rules for the specified traffic. Unlike security groups, NACLs do not require the traffic to first reach the instance, making them ideal for blocking unwanted traffic at the subnet boundary.

Answer

Move the NAT instance to a private subnet and use a NAT gateway instead.

Answer

Modify the security group attached to the NAT instance to block inbound SSH from the specific IP.

Answer

Use AWS WAF to block the IP address.

Question 9

A company uses AWS Direct Connect to connect its on-premises data center to AWS. The company has a VPC with public and private subnets. The security team wants to ensure that all traffic between on-premises and the VPC goes through a set of security appliances (firewalls) deployed in the VPC. The appliances are in separate subnets. Currently, traffic is routed directly via the virtual private gateway. What is the MOST secure and scalable way to force traffic through the security appliances?

Accepted Answer

Deploy a Gateway Load Balancer and create Gateway Load Balancer endpoints in each subnet. Update the route tables to point to the endpoints.. Using a Gateway Load Balancer with Gateway Load Balancer endpoints in each subnet allows transparent traffic inspection and scaling. Option A is wrong because a NAT gateway only handles outbound traffic, not bidirectional inspection. Option B is wrong because a transit gateway does not force traffic through appliances; additional routing and appliance VPCs are needed. Option D is wrong because a VPN connection does not inherently route through VPC appliances; it would require custom routing.

Answer

Place the security appliances in a public subnet and route traffic through a NAT gateway.

Answer

Create a transit gateway and attach the Direct Connect virtual interface to it. Then route traffic through the appliance subnets.

Answer

Set up a VPN connection from on-premises to the VPC and route traffic through the appliance subnets.

Question 10

A company wants to protect data stored in Amazon S3 Glacier. The data must be encrypted at rest and the encryption keys must be rotated annually. Which TWO options meet these requirements?

Accepted Answer

Use SSE-KMS with a customer-managed key that has automatic key rotation enabled.. SSE-KMS with a customer-managed key that has automatic key rotation enabled allows annual rotation and meets the encryption requirement. Option E is correct because S3 Glacier's default encryption, SSE-S3, encrypts data at rest and AWS manages key rotation automatically on an annual basis. Option B is incorrect because AWS CloudHSM requires manual key rotation. Option C is incorrect because client-side encryption with the Amazon S3 encryption client does not use server-side encryption and requires manual key management. Option D is incorrect because SSE-C requires you to manage and rotate the keys manually.

Answer

Use AWS CloudHSM to generate a key and encrypt data before uploading to Glacier.

Answer

Use client-side encryption with the Amazon S3 encryption client.

Answer

Use SSE-C with keys stored in AWS Secrets Manager and rotate keys annually.

Question 11

A company has a VPC with multiple subnets across multiple Availability Zones. The security team wants to inspect all traffic between subnets for malicious activity. Which AWS service should be used?

Accepted Answer

AWS Network Firewall. AWS Network Firewall is a managed stateful firewall service that can inspect all traffic between subnets within a VPC, including east-west traffic, for malicious activity. It provides deep packet inspection (DPI) at Layers 3–7, supporting Suricata-compatible rules to detect and block threats like malware or intrusion attempts. This makes it the correct choice for the security team's requirement to inspect inter-subnet traffic.

Answer

VPC Flow Logs

Answer

AWS WAF

Answer

Security groups

Question 12

Which TWO are IAM best practices? (Choose two.)

Accepted Answer

Use conditions in IAM policies to restrict access based on tags or IP addresses.. Using conditions in IAM policies (e.g., `aws:SourceIp`, `aws:RequestTag`) allows you to enforce fine-grained access control based on contextual attributes like IP addresses or resource tags. This follows the principle of least privilege by restricting permissions to only the necessary scope, reducing the attack surface. For example, you can deny access to S3 buckets unless the request originates from a corporate IP range.

Answer

Avoid using IAM roles and instead attach policies directly to users.

Answer

Use the root user for everyday administrative tasks.

Answer

Grant broad permissions to all users to simplify management.

Question 13

A company has a multi-account AWS environment using AWS Organizations. The security team has enabled AWS CloudTrail with an organization trail that delivers logs to a centralized S3 bucket in the management account. They have also enabled Amazon GuardDuty in all accounts. Recently, they noticed that some EC2 instances in a member account are exhibiting unusual network behavior, such as outbound traffic to known malicious IP addresses. The security engineer needs to quickly determine the source of the traffic and identify which EC2 instances are affected. The engineer has access to the management account and the member account. Which course of action should the engineer take to most efficiently investigate this incident?

Accepted Answer

Use Amazon Detective to investigate the GuardDuty findings and analyze VPC Flow Logs to identify the affected instances.. Amazon Detective is purpose-built to investigate and analyze GuardDuty findings, automatically ingesting VPC Flow Logs, CloudTrail, and GuardDuty data to build a behavior graph that pinpoints affected EC2 instances and traffic sources. It correlates the malicious-IP finding with the specific instance and network path in a few clicks, which is exactly the 'quickly determine source and affected instances' requirement. This is the most efficient investigative path because Detective already has the data pre-processed and linked to the finding.

Answer

Use AWS Config to review the configuration changes of the EC2 instances and identify any anomalies.

Answer

Use Amazon Inspector to scan the EC2 instances for vulnerabilities and correlate with network traffic.

Answer

Query the VPC Flow Logs stored in the centralized S3 bucket using Amazon Athena to find the source IP and affected instances.

Question 14

A company uses Amazon GuardDuty to detect threats. The security team wants to receive real-time notifications for all GuardDuty findings with a severity of HIGH or CRITICAL. What is the MOST efficient way to achieve this?

Accepted Answer

Create a CloudWatch Events rule that matches GuardDuty findings with severity HIGH or CRITICAL and targets an SNS topic.. Amazon GuardDuty integrates natively with Amazon CloudWatch Events (now part of Amazon EventBridge) to emit findings as events. By creating a CloudWatch Events rule that filters for findings with a severity value of 7.0 or higher (HIGH or CRITICAL), you can directly target an Amazon SNS topic to send real-time notifications. This approach is the most efficient as it avoids intermediate storage or polling, providing near-instantaneous alerting with minimal latency and operational overhead.

Answer

Use the GuardDuty console to set up email alerts for high-severity findings.

Answer

Configure GuardDuty to export findings to an S3 bucket and use S3 event notifications to trigger an SNS topic.

Answer

Stream GuardDuty findings to CloudWatch Logs and create a metric filter to trigger an alarm.

Question 15

A company uses Amazon CloudWatch Logs to collect application logs from EC2 instances. The security team wants to create an alarm that triggers when a specific error pattern appears in the logs. They have set up a metric filter and an alarm. However, the alarm is not triggering even though the error pattern exists in the logs. What is the most likely cause?

Accepted Answer

The metric filter is only applied to log events that occur after the filter is created.. CloudWatch Logs metric filters are not retroactive: they only evaluate log events that are ingested after the filter is created. If the error pattern existed in the logs before the metric filter was created, those events will not generate metric data points, so the alarm will not trigger based on historical events. This is the most likely cause of the alarm not firing.

Answer

The log group retention period is set to 1 day.

Answer

The metric filter uses a custom namespace that is not allowed.

Answer

The metric filter was created before the log group.