SCS-C02 Practice Test 50 — 15 Questions

Question 1

A company has an Amazon S3 bucket that stores sensitive data. The security team wants to ensure that all access to the bucket is made only via HTTPS. Which policy should be used?

Accepted Answer

Add a bucket policy that denies access when aws:SecureTransport is false.. The condition `aws:SecureTransport` evaluates to `false` when the request is made over HTTP instead of HTTPS. By adding a bucket policy that denies all S3 actions when `aws:SecureTransport` is `false`, the company enforces HTTPS-only access at the policy level, regardless of how the request originates.

Answer

Enable CloudFront with HTTPS-only viewer protocol policy.

Answer

Use a VPC endpoint for S3 with a bucket policy that restricts access to the VPC endpoint.

Answer

Enable 'Block public access' on the bucket.

Question 2

Refer to the exhibit. A security engineer is reviewing the bucket encryption configuration. The bucket is used to store sensitive data. The company policy requires that all objects be encrypted using AWS KMS with a customer managed key. What should the engineer do to meet the policy?

Accepted Answer

Update the bucket encryption configuration to use SSEAlgorithm: aws:kms and specify a KMS key ID. The company policy requires AWS KMS with a customer managed key, which corresponds to SSE-KMS with SSEAlgorithm set to aws:kms and an explicit KMS key ID (or ARN) in the bucket's default encryption configuration. Updating the bucket encryption configuration via PutBucketEncryption with the KMS key ARN satisfies the requirement for all newly uploaded objects.

Answer

Enable the bucket key and set SSEAlgorithm to AES256

Answer

Use client-side encryption with a KMS key

Answer

Add a bucket policy that requires kms:Encrypt permission for all PutObject requests

Question 3

A security engineer notices that an EC2 instance is sending outbound traffic to a known malicious IP address. The engineer needs to immediately block the traffic and capture a packet capture for forensic analysis. Which combination of actions should the engineer take?

Accepted Answer

Add a network ACL deny rule for the malicious IP, and enable VPC Traffic Mirroring.. A network ACL (NACL) is a stateless firewall that operates at the subnet level, allowing immediate blocking of traffic to/from a specific IP address without affecting the instance's security group rules. Enabling VPC Traffic Mirroring captures a full packet-level copy of the traffic for forensic analysis, which is superior to VPC Flow Logs (which only capture metadata). This combination provides both rapid containment and deep forensic data.

Answer

Use Amazon GuardDuty to block the IP and enable VPC Traffic Mirroring.

Answer

Stop the EC2 instance and enable VPC Flow Logs.

Answer

Modify the security group to deny outbound traffic to the IP, and enable VPC Flow Logs.

Question 4

A security team wants to receive real-time notifications when an IAM user makes a change to a security group. Which AWS service should be used to trigger the notification?

Accepted Answer

AWS CloudTrail with Amazon CloudWatch Events. AWS CloudTrail captures API calls made by IAM users, including changes to security groups (e.g., AuthorizeSecurityGroupIngress, RevokeSecurityGroupEgress). By sending these CloudTrail events to Amazon CloudWatch Events (now part of Amazon EventBridge), you can create a rule that matches specific API calls and triggers a notification via SNS, Lambda, or other targets in real time.

Answer

AWS Config

Answer

Amazon S3 event notifications

Answer

Amazon GuardDuty

Question 5

A company uses AWS Organizations with multiple accounts. The security team wants to centrally collect and analyze VPC Flow Logs from all accounts. What is the MOST efficient way to achieve this?

Accepted Answer

Configure VPC Flow Logs to deliver to a central S3 bucket in the security account, and use a bucket policy that grants the source accounts permission to write.. It uses a central S3 bucket in the security account with a bucket policy that grants the PutObject permission to the VPC Flow Logs delivery service from each source account. This is the most efficient approach as it avoids per-account configuration overhead, eliminates the need for cross-account replication, and provides a single location for centralized analysis using services like Amazon Athena or Amazon QuickSight.

Answer

Use AWS Firewall Manager to deploy VPC Flow Logs and aggregate logs in a single account.

Answer

Configure VPC Flow Logs to deliver to a central CloudWatch Logs log group in the management account.

Answer

Set up VPC Flow Logs in each account to deliver to local S3 buckets, then use S3 replication to copy to a central bucket.

Question 6

A company uses Amazon GuardDuty to detect threats. The security team wants to be alerted when GuardDuty generates a finding with a severity level of HIGH or CRITICAL. Which AWS service should the team use to send notifications based on GuardDuty findings?

Accepted Answer

Amazon EventBridge and Amazon Simple Notification Service (SNS). Amazon EventBridge can capture GuardDuty findings as events using a rule that matches the 'GuardDuty Finding' event type. The rule can then invoke an SNS topic to send email or SMS notifications. This is the recommended pattern because EventBridge provides native integration with GuardDuty and supports filtering by finding severity using event patterns, while SNS handles the actual notification delivery.

Answer

Amazon Simple Queue Service (SQS)

Answer

AWS Lambda

Answer

Amazon CloudWatch Logs and Amazon Simple Notification Service (SNS)

Question 7

Which TWO are best practices for managing IAM policies? (Select TWO.)

Accepted Answer

Grant least privilege by using specific actions and resources. The principle of least privilege is a foundational security best practice in AWS IAM. By specifying exact actions (e.g., s3:GetObject) and resources (e.g., arn:aws:s3:::example-bucket/*) instead of using wildcards, you minimize the blast radius of a compromised credential or misconfigured policy. This aligns with the AWS Well-Architected Framework's security pillar, which mandates granting only the permissions required to perform a task.

Answer

Use wildcards (*) to simplify policy management

Answer

Use inline policies instead of managed policies

Answer

Use SCPs to enforce permissions

Question 8

A security engineer is configuring Amazon GuardDuty in a multi-account environment using AWS Organizations. The engineer wants to ensure that all member accounts send findings to the delegated administrator account. However, some member accounts are not sending findings. What is the most likely cause?

Accepted Answer

GuardDuty is not enabled in the member accounts, or they have not accepted the invitation.. GuardDuty requires that each member account has the service explicitly enabled and has accepted the invitation from the delegated administrator account. Without these steps, the member accounts cannot send findings to the administrator, even if AWS Organizations is configured correctly. The delegated administrator can only manage findings from accounts that have completed the onboarding process.

Answer

The GuardDuty service-linked role is missing in the member accounts.

Answer

AWS CloudTrail is not enabled in the member accounts.

Answer

VPC Flow Logs are not enabled in the member accounts.

Question 9

A security engineer needs to monitor for unauthorized API calls in real-time. Which combination of services should be used?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Logs with metric filters. AWS CloudTrail records all API calls in an AWS account, and CloudWatch Logs can ingest those logs. By creating metric filters on CloudWatch Logs, you can define patterns that match unauthorized API calls (e.g., AccessDenied errors) and trigger alarms in real time. This combination provides the necessary logging and real-time monitoring capability.

Answer

Amazon S3 event notifications and AWS Lambda

Answer

AWS Config and Amazon SNS

Answer

Amazon GuardDuty and AWS CloudTrail

Question 10

A company has a requirement to detect and respond to threats in near real-time by analyzing VPC Flow Logs. The logs are generated in a VPC and sent to CloudWatch Logs. What is the MOST efficient way to analyze these logs for suspicious patterns and trigger automated responses?

Accepted Answer

Use Amazon Kinesis Data Analytics for real-time analysis and AWS Lambda for automated response. Amazon Kinesis Data Analytics can process streaming VPC Flow Logs from CloudWatch Logs in near real-time using SQL or Apache Flink, enabling immediate detection of suspicious patterns. AWS Lambda can then be triggered to automate incident response actions, such as updating security groups or isolating instances, making this the most efficient solution for near real-time threat detection and response.

Answer

Stream logs to Amazon Elasticsearch Service and use Kibana alerts

Answer

Use S3 event notifications to trigger Lambda functions on new log files

Answer

Export logs to S3 and use Amazon Athena queries with scheduled rules

Question 11

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The Security Engineer needs to ensure that traffic between VPCs is inspected by a central network appliance. Which architecture should the Engineer implement?

Accepted Answer

Use Transit Gateway with appliance mode enabled on the attachments to the inspection VPC, and route inter-VPC traffic through the inspection VPC.. Enabling appliance mode on the Transit Gateway attachments to the inspection VPC forces the Transit Gateway to preserve the source and destination MAC addresses of packets, ensuring that asymmetric routing does not cause the network appliance to drop traffic. By routing inter-VPC traffic through the inspection VPC, the appliance can inspect all packets, and appliance mode ensures that return traffic is sent back through the same appliance, maintaining stateful inspection.

Answer

Use VPC Peering connections between all VPCs and route traffic through the inspection VPC.

Answer

Place the network appliance in a public subnet of the inspection VPC and use internet gateways for routing.

Answer

Use Transit Gateway with route tables that point to the network appliance's ENI for all inter-VPC traffic.

Question 12

Refer to the exhibit. A security engineer applied the bucket policy shown. What is the effect of this policy?

Accepted Answer

Only GetObject requests that use HTTP are denied.. The bucket policy includes a Deny statement for s3:GetObject requests that are not using HTTPS. The condition `aws:SecureTransport` is set to false, meaning the request is over HTTP. Therefore, any GetObject request made over HTTP is denied. PutObject requests are not affected, and GetObject requests over HTTPS are allowed regardless of IP address.

Answer

All PutObject requests are denied.

Answer

Only GetObject requests from specific IP ranges are denied.

Answer

All GetObject requests to the bucket are denied.

Question 13

A security engineer notices that an EC2 instance in a private subnet is able to make outbound connections to the internet. The instance does not have a public IP, and there is no NAT gateway or instance in the VPC. What is the most likely cause?

Accepted Answer

The VPC has an egress-only internet gateway for IPv6 traffic.. An egress-only internet gateway (EIGW) allows outbound IPv6 traffic from instances in a private subnet without requiring a public IPv4 address or NAT. Since the instance is making outbound connections to the internet and has no public IP or NAT, and the VPC likely has IPv6 enabled, the EIGW is the most plausible cause. Option D is incorrect because a default route to an internet gateway requires the instance to have a public IPv4 address for return traffic, which contradicts the scenario.

Answer

The instance has a public IP assigned automatically via Auto-assign Public IP.

Answer

The instance is using a VPC endpoint (Gateway type) for S3.

Answer

The subnet's route table has a default route (0.0.0.0/0) pointing to an internet gateway.

Question 14

A company uses AWS KMS to encrypt data in Amazon S3. The security team wants to ensure that when an object is retrieved, it is automatically decrypted. They have configured the S3 bucket to use SSE-KMS with a customer managed key. However, when a user downloads an object using the AWS CLI, the object is still encrypted. The IAM policy for the user includes kms:Decrypt permission. What is the MOST likely reason for this issue?

Accepted Answer

The KMS key policy does not allow the user to decrypt.. The most likely reason is that the KMS key policy does not allow the user to decrypt. Even though the user's IAM policy includes kms:Decrypt, KMS requires that both the IAM policy and the key policy grant permission. Since the key policy is separate, it may not include the user as a principal. Option B is incorrect because SSE-C is not indicated. Option C is incorrect because s3:GetObject is needed but the issue is decryption. Option D is incorrect because encryption context is not required for automatic decryption via S3; S3 manages it transparently.

Answer

The user is using SSE-C instead of SSE-KMS.

Answer

The user does not have s3:GetObject permission.

Answer

The user is not specifying the correct encryption context in the request.

Question 15

A security engineer configured the S3 bucket policy shown above for CloudTrail log delivery, but CloudTrail is not delivering logs. What is the MOST likely reason?

Accepted Answer

The policy does not include s3:GetBucketAcl permission.. CloudTrail requires the s3:GetBucketAcl permission on the destination S3 bucket to verify that the bucket policy grants the necessary access. Without this permission, CloudTrail cannot confirm it has write access and will fail to deliver logs. The bucket policy must explicitly allow the CloudTrail service principal to perform GetBucketAcl and PutObject actions.

Answer

The bucket is in the wrong region.

Answer

The resource ARN is incorrect.

Answer

The bucket does not have default encryption enabled.