SCS-C02 Practice Test 5 — 10 Questions

Question 1

Refer to the exhibit. A security engineer reviews this CloudFormation template. The bucket is intended to be private. What is the security issue in the configuration?

Accepted Answer

The PublicAccessBlock configuration is missing the BlockPublicPolicy setting.. The PublicAccessBlock configuration in the template is missing the BlockPublicPolicy setting. Without BlockPublicPolicy enabled, a bucket policy that grants public read access (Effect: Allow, Principal: *, Action: s3:GetObject) can be applied to the bucket, overriding the intended private configuration. The other PublicAccessBlock settings (BlockPublicAcls, IgnorePublicAcls, RestrictPublicBuckets) do not block bucket policies; only BlockPublicPolicy does. The security issue is that the bucket policy, though present, would be blocked if BlockPublicPolicy were enabled, but since it is missing, the bucket becomes publicly accessible.

Answer

The bucket does not have versioning enabled.

Answer

The bucket policy grants public read access to the bucket, which overrides the PublicAccessBlock configuration.

Answer

The bucket policy uses an incorrect resource ARN.

Question 2

A security engineer is configuring a VPC for a highly sensitive application. The VPC must not have a route to the internet, but the application needs to periodically download security patches from a specific domain (patches.example.com). Which solution meets these requirements with minimal operational overhead?

Accepted Answer

Use a VPC endpoint for Amazon S3 and DynamoDB to download patches.. It uses VPC endpoints for Amazon S3 (and optionally DynamoDB) to provide private connectivity to AWS services without requiring an internet gateway. By storing the security patches in an S3 bucket with a custom domain alias (e.g., patches.example.com), the application can download patches through the VPC endpoint, meeting the requirement of no internet route and minimizing operational overhead. Options A and D require an internet gateway, which creates a route to the internet. Option C does not provide access to an external domain like patches.example.com.

Answer

Launch a proxy server in a public subnet and configure the application to use the proxy.

Answer

Create a VPC interface endpoint for AWS Systems Manager and use Systems Manager Patch Manager to apply patches.

Answer

Deploy a NAT gateway in a public subnet and add a route to the NAT gateway for the private subnet.

Question 3

A company runs a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application processes sensitive customer data. The Security team has enabled VPC Flow Logs, CloudTrail, and GuardDuty. Recently, the team received a GuardDuty finding indicating a potential SSH brute force attack originating from an external IP address 203.0.113.50 targeting one of the EC2 instances. The Security Engineer needs to automatically isolate the affected instance and capture forensic evidence for analysis. The company has strict requirements: the instance must be isolated immediately, and a snapshot of the EBS volume must be taken before any remediation actions are taken. The instance is part of an Auto Scaling group, and the Security Engineer wants to minimize manual intervention. The Security Engineer has access to AWS Systems Manager and AWS Lambda. Which combination of steps should the Security Engineer implement to meet the requirements?

Accepted Answer

Configure Amazon EventBridge to detect the GuardDuty finding and invoke an AWS Lambda function. The Lambda function first calls the EC2 CreateSnapshot API to capture a forensic snapshot of the instance's EBS volume. Then, it uses AWS Systems Manager Automation to run a pre-defined automation document that isolates the instance by modifying the instance's security group to only allow traffic from a trusted management IP, and then stops the instance.. It uses EventBridge to directly detect the GuardDuty finding, which triggers a Lambda function that first takes an EBS snapshot (forensic capture) via the CreateSnapshot API before any remediation. Then it uses Systems Manager Automation to isolate the instance by modifying the security group to allow only a trusted management IP and stops the instance, ensuring isolation without destroying the instance. This sequence satisfies the strict requirement that a snapshot must be taken before any remediation actions, and it minimizes manual intervention by automating the entire response.

Answer

Use AWS Systems Manager to automatically connect to the instance via EC2 Instance Connect, run commands to capture forensic data, and then modify the security group to deny all inbound traffic.

Answer

Create a CloudWatch Logs metric filter on the VPC Flow Logs for the attacker IP. When the metric breaches a threshold, trigger an SNS topic that runs an AWS Systems Manager Automation document to isolate the instance and take an EBS snapshot.

Answer

Configure a CloudWatch Events rule to detect the GuardDuty finding and invoke an AWS Lambda function. The Lambda function terminates the EC2 instance and then takes a snapshot of the EBS volume for forensic analysis.

Question 4

A company is designing a VPC with public and private subnets. The web servers in the public subnets must be accessible from the internet on port 443, but the database servers in the private subnets should only be accessible from the web servers on port 3306. Which combination of security group rules and network ACL rules should be used to meet these requirements with the least administrative overhead?

Accepted Answer

Use security groups for all tiers; add an inbound rule to the database security group allowing traffic from the web security group on port 3306.. Security groups are stateful and support referencing other security groups as a source, which allows you to permit traffic from the web security group to the database security group on port 3306 without needing to specify IP addresses. This approach minimizes administrative overhead as security group rules are automatically applied to all instances associated with the group, and changes propagate without updating network ACLs or CIDR ranges. The web security group can have an inbound rule allowing HTTPS (port 443) from the internet (0.0.0.0/0), while the database security group only allows inbound MySQL/Aurora (port 3306) from the web security group, meeting the access requirements precisely.

Answer

Use security groups for all tiers; add an inbound rule to the web security group allowing internet traffic on port 443, and add an outbound rule to the web security group allowing traffic to the database security group on port 3306.

Answer

Use security groups for the web tier and network ACLs for the database tier; add an inbound rule to the database network ACL allowing traffic from the web subnet CIDR on port 3306.

Answer

Use security groups for the web tier and network ACLs for the database tier; add an inbound rule to the database network ACL allowing all traffic from the web security group.

Question 5

A security engineer is investigating a potential data exfiltration incident. The engineer needs to determine whether an IAM user in account A accessed an S3 bucket in account B. The engineer has access to both accounts. Which combination of steps should the engineer take to identify the cross-account access?

Accepted Answer

Enable CloudTrail in account B and check the S3 event history for the bucket.. To identify cross-account access to an S3 bucket, enable CloudTrail in the account that owns the bucket (account B) and configure a trail with data events for S3 object-level operations. This captures the IAM user ARN from account A in the CloudTrail event. S3 server access logging (Option A) can also provide similar details, but CloudTrail is the recommended approach for auditing API calls. Ensure data events are enabled for the bucket.

Answer

Enable S3 server access logging on the bucket in account B and check the logs.

Answer

Enable CloudTrail in account A and check the S3 event history.

Answer

Enable CloudWatch Logs in account A and check the S3 access logs.

Question 6

A security engineer is troubleshooting why CloudTrail is not delivering logs to an S3 bucket. The bucket policy allows CloudTrail to write objects, and the trail is configured with the correct bucket name. However, no log files appear. What is the most likely cause?

Accepted Answer

The S3 bucket uses AWS KMS server-side encryption (SSE-KMS) and the KMS key policy does not grant CloudTrail permission to use the key.. When CloudTrail is configured to deliver logs to an S3 bucket that uses SSE-KMS, CloudTrail must have explicit permission to use the KMS key for encrypting the log files. Even if the bucket policy allows CloudTrail to write objects, the KMS key policy must grant the `kms:GenerateDataKey` and `kms:Decrypt` actions to the CloudTrail service principal. Without these permissions, CloudTrail cannot encrypt the logs, and delivery fails silently—no log files appear.

Answer

The S3 bucket has an S3 Object Lock configuration that prevents writes.

Answer

The S3 bucket is in a different AWS Region from the trail.

Answer

CloudTrail is not enabled in the AWS Region where the S3 bucket resides.

Question 7

A company is using Amazon EC2 instances in a VPC with a security group that allows inbound SSH from 0.0.0.0/0. A security engineer needs to restrict SSH access to only the company's public IP range (203.0.113.0/24) while maintaining all other existing rules. What is the MOST efficient way to accomplish this?

Accepted Answer

Modify the existing security group rule to change the source from 0.0.0.0/0 to 203.0.113.0/24.. Modifying the existing security group rule's source from 0.0.0.0/0 to 203.0.113.0/24 directly restricts inbound SSH to the company's public IP range without affecting any other rules. Security groups are stateful and rule changes apply immediately, making this the most efficient approach as it requires only a single edit to the existing rule.

Answer

Disable SSH and use AWS Systems Manager Session Manager to connect to instances.

Answer

Create a network ACL with an inbound rule allowing SSH from 203.0.113.0/24 and deny all other traffic.

Answer

Create a new security group rule allowing SSH from 203.0.113.0/24 and keep the existing rule.

Question 8

A company has a requirement to retain AWS CloudTrail logs for 7 years for compliance. The logs are stored in an S3 bucket. The company wants to reduce storage costs by automatically moving older logs to a cheaper storage class. Which solution should the company implement?

Accepted Answer

Configure an S3 Lifecycle policy to transition objects from S3 Standard to S3 Glacier after a specified number of days.. An S3 Lifecycle policy can automatically transition CloudTrail logs from S3 Standard to S3 Glacier after a specified number of days, meeting the 7-year retention requirement while reducing storage costs. S3 Glacier is designed for long-term archival at low cost, and lifecycle rules can be configured to transition objects directly or through intermediate classes like S3 Standard-IA. S3 Intelligent-Tiering (Option A) also automatically optimizes costs and supports archival tiers, but it works based on access patterns, not fixed age-based rules, and incurs per-object monitoring fees. For compliance-driven, age-based retention, a Lifecycle policy is the more direct and cost-effective solution.

Answer

Use S3 Intelligent-Tiering to automatically move logs to the most cost-effective access tier.

Answer

Move logs to S3 Standard-IA after 30 days.

Answer

Use S3 Batch Operations to manually copy logs to S3 Glacier.

Question 9

A security engineer discovers an Amazon GuardDuty finding of type 'UnauthorizedAccess:EC2/SSHBruteForce' for an EC2 instance. The instance is part of an Auto Scaling group and has a public IP address. What is the MOST effective immediate step to mitigate the threat?

Accepted Answer

Detach the instance from the Auto Scaling group and terminate it.. The instance is compromised and part of an Auto Scaling group. Detaching it first prevents the Auto Scaling group from immediately replacing it with a new instance that might inherit the same vulnerability, allowing for forensic analysis. Terminating it after detachment stops the SSH brute force attack at its source without risking automatic re-provisioning of a similarly exposed instance.

Answer

Modify the network ACL to block SSH traffic from the attacker's IP.

Answer

Terminate the instance without detaching it from the Auto Scaling group.

Answer

Update the security group to restrict SSH access to known IP addresses.

Question 10

A company wants to restrict access to an Amazon S3 bucket so that only users from a specific AWS account can upload objects. Which policy mechanism should be used?

Accepted Answer

Create a bucket policy with a condition that checks the aws:SourceAccount condition key.. A bucket policy with the `aws:SourceAccount` condition key allows you to restrict access to a specific AWS account. When users from the allowed account upload objects, the condition evaluates the source account ID, ensuring only requests originating from that account are permitted. This is the recommended approach for cross-account access control in S3, as it directly enforces the account-level restriction at the bucket policy level.

Answer

Attach an IAM policy to the bucket that denies access to all users except those from the allowed account.

Answer

Generate a pre-signed URL for each upload request.

Answer

Configure the bucket ACL to grant access only to the allowed account's canonical user ID.