SCS-C02 Practice Questions 2 — 50 Questions

Question 1

During an incident response, a security engineer needs to collect memory and disk forensics from a running EC2 Windows instance without causing the instance to crash. The engineer has AWS Systems Manager SSM Agent installed. Which method should the engineer use?

Accepted Answer

Use AWS Systems Manager Inventory to collect memory and disk information.. Option B is correct because AWS Systems Manager Inventory can collect both memory and disk forensics from a running EC2 Windows instance without causing it to crash. The SSM Agent, already installed, allows Inventory to gather metadata such as running processes (memory) and file system details (disk) via the AWS-CollectInventory document, which is designed for live data collection without rebooting or halting the instance.

Answer

Create an AMI of the instance.

Answer

Use AWS Backup to create a backup of the instance.

Answer

Create an EBS snapshot of the root volume.

Question 2

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all API calls in the organization are logged and retained for at least one year. Which AWS services or features should be used to meet these requirements? (Choose TWO.)

Accepted Answer

Amazon S3 lifecycle policy to transition logs to S3 Glacier after one year.. Option C is correct because an Amazon S3 lifecycle policy can automatically transition CloudTrail log objects from S3 Standard to S3 Glacier after one year, meeting the retention requirement cost-effectively. Option E is correct because AWS CloudTrail with an organization trail logs all API calls across all accounts in the AWS Organization, ensuring comprehensive logging.

Answer

Amazon GuardDuty with threat detection enabled.

Answer

AWS Config with recording enabled for all resources.

Answer

VPC Flow Logs for all VPCs.

Question 3

A security engineer is investigating a potential data exfiltration incident. The engineer notices large volumes of data being transferred from an Amazon S3 bucket to an external IP address. Which AWS services can be used to detect and alert on such behavior? (Choose THREE.)

Accepted Answer

Amazon CloudWatch Logs with S3 access log analysis.. Amazon CloudWatch Logs can ingest and analyze S3 access logs, which record detailed information about requests made to an S3 bucket, including the source IP address, request type, and bytes transferred. By analyzing these logs with CloudWatch Logs Insights or metric filters, you can detect large data transfers to external IPs and trigger alerts via CloudWatch Alarms, making it a valid detection and alerting mechanism for data exfiltration.

Answer

AWS Config with compliance rules.

Answer

VPC Flow Logs.

Question 4

A security engineer reviews the CloudTrail log entry in the exhibit. The engineer notices that an EC2 instance was launched using an AdminRole. Which additional information would help determine if this is a legitimate action or a potential compromise?

Accepted Answer

The source IP address 203.0.113.50 is from an unexpected geographic location not associated with the company.. The source IP address 203.0.113.50 is from an unexpected geographic location not associated with the company. In CloudTrail, the `sourceIPAddress` field records the originating IP of the API call. If an AdminRole is used from an IP outside the company's known CIDR ranges or geographic regions, it strongly indicates a potential compromise—such as stolen credentials or an attacker using the role from an unauthorized network. This is a key indicator of anomalous behavior in threat detection.

Answer

The AMI ID ami-0abcdef1234567890 is not a standard Amazon-provided AMI.

Answer

The instance type m5.xlarge is unusually large compared to previous launches.

Answer

The security group sg-0123456789abcdef0 allows inbound SSH from 0.0.0.0/0.

Question 5

A security engineer is analyzing the VPC Flow Logs entry in the exhibit. The log shows traffic from an internal IP to an external IP. Which potential security concern should the engineer investigate?

Accepted Answer

An EC2 instance is attempting to connect to an external host on port 3389 (RDP).. The VPC Flow Logs entry shows outbound traffic from an internal IP to an external IP on destination port 3389, which is the default port for Remote Desktop Protocol (RDP). RDP outbound from an EC2 instance to an external host is a security concern because it could indicate an attacker using the instance as a pivot point to connect to an external command-and-control server or to exfiltrate data via an RDP tunnel. The log direction (src internal, dst external) and port 3389 specifically point to an outbound RDP attempt, not inbound scanning or DDoS.

Answer

The instance is participating in a DDoS attack against the external IP.

Answer

An external host is scanning the internal network on port 443.

Answer

The security group allows inbound RDP from 0.0.0.0/0.

Question 6

A security engineer is implementing automated incident response. The engineer wants to use AWS Lambda to automatically remediate GuardDuty findings. What is the recommended pattern to trigger the Lambda function?

Accepted Answer

Configure an Amazon EventBridge rule to match GuardDuty findings and invoke the Lambda function.. Amazon EventBridge is the recommended pattern because it natively integrates with AWS GuardDuty to receive all finding events in near real-time. By configuring an EventBridge rule that matches GuardDuty finding types (e.g., 'UnauthorizedAccess:EC2/SSHBruteForce'), you can directly invoke a Lambda function for automated remediation without polling or intermediate services. This pattern is serverless, event-driven, and follows AWS best practices for decoupled incident response.

Answer

Subscribe the Lambda function to an SNS topic that GuardDuty publishes findings to.

Answer

Use CloudWatch Logs subscription filter to trigger Lambda on GuardDuty log entries.

Answer

Have the Lambda function poll the EC2 instance metadata for threat indicators.

Question 7

A company uses AWS Systems Manager Patch Manager to patch EC2 instances. During a security incident, the security team needs to quickly patch a critical vulnerability across all Windows instances in a specific AWS region. Which steps should the team take? (Choose TWO.)

Accepted Answer

Assign the patch baseline to the instances by specifying a patch group.. Option A is correct because assigning a custom patch baseline to instances via a patch group allows the security team to target specific Windows instances for patching. Patch Manager uses patch groups to associate instances with a specific patch baseline, ensuring only the desired instances receive the critical patch. This approach provides granular control over which instances are patched during an incident.

Answer

Tag all instances with 'PatchGroup=Critical' to include them in the patching.

Answer

Use the AWS-provided default patch baseline for Windows.

Answer

Use SSM Run Command to execute a script that downloads and installs the patch.

Question 8

A company wants to use AWS CloudTrail to monitor data events for all S3 buckets. Which THREE steps are necessary? (Choose THREE.)

Accepted Answer

Specify an S3 bucket to store the log files. Option A is correct because CloudTrail requires a destination S3 bucket to store the log files it generates. Without specifying a bucket, the trail cannot persist logs, and this bucket must have appropriate bucket policies to allow CloudTrail to write logs. This is a mandatory step when creating any trail, whether for management or data events.

Answer

Create a CloudWatch Events rule to forward data events

Answer

Enable CloudTrail Insights to detect unusual data access

Question 9

A security engineer wants to capture all DNS queries made by EC2 instances to detect potential data exfiltration. Which AWS service should be used to log the DNS requests?

Accepted Answer

Use Route 53 Resolver DNS Firewall with query logging. Route 53 Resolver DNS Firewall with query logging is the correct choice because it is specifically designed to log all DNS queries made by EC2 instances that use the Route 53 Resolver. This service captures the domain names being queried, the source IP, and the response, enabling detection of DNS-based data exfiltration (e.g., DNS tunneling). It integrates directly with the VPC's DNS resolver, ensuring all outbound DNS traffic from EC2 instances is logged without additional agents.

Answer

Use Amazon GuardDuty

Answer

Enable VPC Flow Logs

Answer

Enable AWS CloudTrail

Question 10

A company uses AWS CloudTrail to log management events in all regions. The security team notices that some API calls made by an IAM user are not appearing in the CloudTrail event history. What is the most likely reason?

Accepted Answer

CloudTrail event history only retains events for 90 days; older events are not visible. D is correct because CloudTrail event history only retains the last 90 days of events. If the API calls were made more than 90 days ago, they would no longer appear in the event history, even though the trail itself may still be delivering log files to an S3 bucket for longer-term storage. The security team is likely looking at the event history rather than querying the S3 bucket or using Athena for older events.

Answer

The user used the AWS Management Console, not the CLI

Answer

The trail is configured for a single region only

Answer

The API calls were read-only and excluded by default

Question 11

A company requires real-time analysis of AWS CloudTrail logs to detect unauthorized API calls. The logs are stored in Amazon S3. Which architecture minimizes latency and cost?

Accepted Answer

Send CloudTrail logs to Amazon CloudWatch Logs, then use a subscription filter to Amazon Kinesis Data Firehose delivering to Amazon OpenSearch Service. Option B is correct because it provides the lowest-latency path for real-time analysis: CloudTrail logs are delivered to CloudWatch Logs in near real-time, and a subscription filter streams them to Kinesis Data Firehose, which buffers and delivers directly to Amazon OpenSearch Service for immediate indexing and search. This architecture avoids batch processing, minimizes data movement overhead, and uses managed services that scale automatically, keeping both latency and cost low.

Answer

Use AWS Glue to crawl S3 and load into Amazon Redshift for analysis

Answer

Query CloudTrail logs directly using Amazon Athena

Answer

Configure S3 event notifications to invoke an AWS Lambda function that writes to Amazon OpenSearch Service

Question 12

Which TWO AWS services provide native integration with Amazon CloudWatch Logs for real-time monitoring of application logs? (Choose TWO.)

Accepted Answer

Amazon EC2. Amazon EC2 is correct because it can be configured to send application logs to CloudWatch Logs via the CloudWatch Logs agent or unified CloudWatch agent, enabling real-time monitoring, search, and alerting on log data. AWS Lambda is correct because it natively integrates with CloudWatch Logs: every Lambda function execution automatically streams its logs to a CloudWatch Logs group, providing real-time visibility into function output and errors.

Answer

Amazon S3

Answer

Amazon Route 53

Answer

AWS CloudTrail

Question 13

A security engineer needs to centrally collect and analyze AWS CloudTrail logs from multiple accounts. Which service is designed for this purpose?

Accepted Answer

Use AWS Organizations to create a CloudTrail trail that applies to all accounts. Option D is correct because AWS Organizations allows you to create a single CloudTrail trail that applies to all accounts in the organization, centrally collecting management and data events into a single S3 bucket (and optionally CloudWatch Logs). This eliminates the need to manually configure trails in each account and ensures consistent logging across the entire organization, meeting the requirement for central collection and analysis.

Answer

Configure each account to send logs to a central S3 bucket

Answer

Enable Amazon GuardDuty in each account and aggregate findings

Answer

Use Amazon CloudWatch Logs to stream logs from each account to a central account

Question 14

A security engineer notices that an IAM role has a trust policy allowing any AWS account to assume it. Which attack is this misconfiguration most likely to enable?

Accepted Answer

Unauthorized access by an external attacker. Option C is correct because an IAM role trust policy that allows any AWS account (i.e., `"Principal": {"AWS": "*"}`) to assume the role means that any user or service in any AWS account can call the STS `AssumeRole` API to obtain temporary credentials for the role. This directly enables unauthorized access by an external attacker who can discover the role ARN and assume it, gaining all permissions attached to the role.

Answer

Logging bypass via CloudTrail

Answer

Cross-service confused deputy attack

Answer

Privilege escalation by attaching additional policies

Question 15

A company uses AWS CloudTrail and wants to ensure that any modification to the trail itself is detected immediately. What should be done?

Accepted Answer

Create a CloudWatch Events rule that matches the StopLogging or UpdateTrail API calls and sends an alert. Option C is correct because CloudWatch Events (now part of Amazon EventBridge) can be configured with a rule that matches specific API calls like StopLogging or UpdateTrail via CloudTrail. When such an API call is made, the rule triggers an action such as sending an SNS notification or invoking a Lambda function, enabling immediate detection of trail modifications. This approach directly monitors the control plane operations that alter the trail's configuration.

Answer

Configure Amazon GuardDuty to monitor for trail modifications

Answer

Enable CloudTrail Insights to detect unusual activity

Answer

Enable S3 event notifications on the trail's S3 bucket

Question 16

A security engineer needs to capture all network traffic between EC2 instances in a VPC for forensic analysis. Which TWO services should be used together? (Choose TWO.)

Accepted Answer

Amazon VPC Flow Logs. Amazon VPC Flow Logs capture IP traffic information for network interfaces in a VPC, including metadata such as source/destination IPs, ports, protocols, and packet accept/reject decisions. To perform forensic analysis on this raw flow log data, you can use Amazon Athena to query the logs directly from S3 using standard SQL, enabling efficient filtering and pattern detection across large volumes of network traffic.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon GuardDuty

Question 17

A security engineer needs to monitor cross-account access to resources. Which THREE AWS services can be used to log or detect such access? (Choose THREE.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail is correct because it logs all API calls made to the AWS environment, including cross-account access events such as AssumeRole, GetFederationToken, or any action performed by an IAM role from another account. These logs capture the source identity, target resource, and request parameters, enabling security engineers to detect and audit cross-account activity.

Answer

Amazon VPC Flow Logs

Answer

Amazon Inspector

Question 18

Refer to the exhibit. A security engineer reviews a CloudTrail log entry. What is the MOST concerning security issue?

Accepted Answer

The root user is performing actions. Option B is correct because the root user is performing actions. In AWS, the root user has unrestricted access to all resources and services, and its use should be strictly limited to a few account-level tasks (e.g., closing the account, changing support plans). Routine API calls by the root user violate the principle of least privilege and indicate a serious security misconfiguration, as there is no way to audit or restrict root user permissions. CloudTrail logs showing root user activity for non-essential operations are a red flag for potential credential compromise or lack of proper IAM governance.

Answer

The security group rule allows SSH from 0.0.0.0/0

Answer

The API call failed as indicated by null response elements

Answer

The request came from an external IP address

Question 19

Refer to the exhibit. A security engineer reviews the CloudTrail trail configuration. What is a security concern?

Accepted Answer

The logs are not encrypted with a customer-managed KMS key. The security concern is that the CloudTrail logs are not encrypted with a customer-managed KMS key. By default, CloudTrail encrypts log files using SSE-S3 (S3-managed keys), which does not provide the customer with control over key rotation, access policies, or the ability to audit key usage. Using a customer-managed KMS key ensures that only authorized principals can decrypt the logs, and it enables fine-grained access control and audit trails via CloudTrail and CloudWatch Logs, which is critical for compliance and security monitoring.

Answer

The trail is not multi-region

Answer

Log file validation is not enabled

Answer

CloudWatch Logs integration is missing

Question 20

A developer needs to grant an IAM user read-only access to an S3 bucket named 'my-bucket'. Which policy should be attached to the IAM user?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::my-bucket/*"}]}. Option D is correct because it grants the s3:GetObject permission on the 'my-bucket/*' resource, which allows the IAM user to read (download) objects from the bucket. For read-only access, the user needs both s3:ListBucket (to list objects) and s3:GetObject (to retrieve objects), but the question asks for a policy that grants read-only access; while D alone is insufficient for full read-only access (it lacks ListBucket), it is the only option that provides a read action on the bucket's objects. The other options either grant write access, full access, or only list permissions without read capability.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::my-bucket"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:*","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:PutObject","Resource":"arn:aws:s3:::my-bucket/*"}]}