SCS-C02 Practice Questions 2 — 50 Questions

Question 1

A security engineer is designing a solution to automatically remediate non-compliant resources in an AWS account. The engineer needs to trigger an AWS Lambda function when an EC2 instance is launched without the required tags. Which AWS service should be used to detect the non-compliant resource and invoke the Lambda function?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Config. (AWS Config) is correct because AWS Config rules evaluate the compliance of AWS resources against desired configurations and can automatically trigger an AWS Lambda function for remediation when a resource is non-compliant (e.g., an EC2 instance launched without required tags). Option A (AWS CloudTrail) is incorrect as it records API activity but does not evaluate resource compliance or trigger remediation. Option C (Amazon GuardDuty) is incorrect as it is a threat detection service that identifies malicious activity, not compliance violations. Option D (AWS Systems Manager) is incorrect as it provides operational management capabilities like patching and automation, not compliance rule evaluation.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS Systems Manager

Question 2

A company has a VPC with a public subnet and a private subnet. The public subnet contains a NAT gateway and a bastion host. The private subnet contains a web server that needs to be patched via the internet. The security engineer has configured the route tables: the public subnet route table has a default route to the Internet Gateway, and the private subnet route table has a default route to the NAT gateway. The web server can successfully initiate outbound connections to the internet to download patches. However, the security team notices that the web server is also receiving inbound connections from the internet on port 80. The web server's security group allows inbound HTTP from 0.0.0.0/0. What should the engineer do to prevent inbound internet traffic while still allowing outbound patching?

Accepted Answer

Modify the web server's security group to remove the inbound HTTP rule from 0.0.0.0/0.. Removing the inbound HTTP rule from the security group will block inbound traffic from the internet, while outbound traffic is still allowed because security groups are stateful and allow return traffic for outbound-initiated connections. Option A is incorrect because changing the route table would break outbound connectivity. Option C is incorrect because the NAT gateway already handles outbound traffic; changing it would not help. Option D is incorrect because a network ACL would affect all traffic and could block return traffic for outbound connections.

Answer

Change the private subnet's route table to have a default route to the Internet Gateway instead of the NAT gateway.

Answer

Replace the NAT gateway with a NAT instance and configure it to block inbound traffic.

Answer

Add a network ACL to the private subnet that denies inbound HTTP traffic.

Question 3

A company wants to encrypt data in transit between an on-premises data center and AWS over a VPN connection. Which AWS service or feature should be used?

Accepted Answer

AWS Site-to-Site VPN. WS Site-to-Site VPN (Option C). AWS Site-to-Site VPN creates encrypted tunnels between an on-premises data center and AWS, securing data in transit. Option A (AWS Route 53 Resolver) is a DNS resolution service and does not encrypt network traffic. Option B (AWS Certificate Manager, ACM) is used to provision and manage SSL/TLS certificates for applications, not for VPN encryption. Option D (Amazon API Gateway) is for creating and managing APIs, not for encrypting data in transit between sites.

Answer

AWS Route 53 Resolver

Answer

AWS Certificate Manager (ACM)

Answer

Amazon API Gateway

Question 4

An organization has a requirement to retain all AWS CloudTrail logs for at least 7 years for compliance. Currently, logs are stored in an S3 bucket with default settings. What is the MOST cost-effective way to meet the retention requirement?

Accepted Answer

Configure S3 lifecycle policy to transition objects to S3 Glacier after 30 days and expire after 7 years.. The most cost-effective because it uses an S3 lifecycle policy to transition objects to S3 Glacier after 30 days (reducing storage costs for older logs) and then expires (deletes) them after 7 years to meet the retention requirement. Option A is wrong because storing logs directly in S3 Glacier Deep Archive is not cost-effective for logs that may be accessed occasionally and does not automatically expire after 7 years without additional policy. Option B is wrong because simply deleting after 7 years does not take advantage of cheaper storage tiers. Option C is wrong because CloudTrail trails do not have a retention setting; retention must be managed via S3 lifecycle policies.

Answer

Use S3 Glacier Deep Archive immediately.

Answer

Set an S3 lifecycle policy to delete objects after 7 years.

Answer

Set the CloudTrail trail to store logs in an S3 bucket with 7-year retention.

Question 5

An organization uses AWS Organizations and wants to restrict the use of specific EC2 instance types across all member accounts. Which policy type should be used to enforce this restriction?

Accepted Answer

Service control policy (SCP). Service control policies (SCPs) are used in AWS Organizations to centrally control permissions for all accounts in the organization. SCPs allow you to restrict the maximum permissions for member accounts, including denying specific EC2 instance types. Resource-based policies are attached to resources, not accounts, and cannot enforce account-wide restrictions. IAM policies are applied to users/roles but can be overridden by administrators unless bounded by SCPs. CloudFormation policies are for stack resources and do not apply across accounts.

Answer

Resource-based policy

Answer

IAM policy

Answer

AWS CloudFormation policy

Question 6

A company wants to receive real-time notifications when specific API calls are made in their AWS account, such as creating a new IAM user. Which AWS service should be used to trigger a notification based on CloudTrail events?

Accepted Answer

Amazon EventBridge. Amazon EventBridge is the correct service because it can ingest CloudTrail events in near real-time and use event rules to match specific API calls, such as CreateUser, and then route those events to targets like SNS topics to send notifications. EventBridge provides a serverless event bus that directly integrates with CloudTrail, enabling you to react to API activity without custom polling or additional infrastructure.

Answer

AWS Config

Answer

Amazon Inspector

Answer

Amazon VPC Flow Logs

Question 7

A security engineer notices that an IAM user has been performing suspicious actions in an AWS account. The engineer needs to generate a credential report to identify the age of the user's access keys. Which AWS CLI command should the engineer run?

Accepted Answer

aws iam generate-credential-report && aws iam get-credential-report. The engineer must first generate the credential report using 'aws iam generate-credential-report' and then retrieve it with 'aws iam get-credential-report'. The report contains the age of access keys. Option A is incorrect because 'get-account-authorization-details' retrieves information about account entities, not credential age. Option C is incorrect because 'generate-service-last-accessed-details' is used to find out which services an IAM entity has accessed, not key age. Option D is incorrect because 'list-access-keys' lists keys but does not provide the key age; the credential report includes creation dates.

Answer

aws iam get-account-authorization-details

Answer

aws iam generate-service-last-accessed-details

Answer

aws iam list-access-keys --user-name suspectUser

Question 8

A company wants to ensure that all Amazon S3 bucket policies comply with a security baseline that prohibits public read access. Which TWO methods can be used to detect non-compliant buckets? (Choose TWO.)

Accepted Answer

Use IAM Access Analyzer to review bucket policies for public access.. IAM Access Analyzer reviews resource policies to identify resources shared with an external entity. For S3 buckets, it can analyze bucket policies and detect if they grant public read access (i.e., access to 'Principal': '*'). This directly identifies non-compliant buckets against the security baseline that prohibits public read access.

Answer

Enable AWS CloudTrail to monitor GetPublicAccessBlock calls.

Answer

Use Amazon Inspector to scan bucket policies.

Answer

Use AWS Trusted Advisor to check S3 bucket permissions.

Question 9

A company is designing a data protection strategy for Amazon EBS volumes. Which TWO practices should be implemented? (Choose TWO.)

Accepted Answer

Enable encryption by default for new EBS volumes. For data protection of Amazon EBS volumes, enable encryption by default (A) to ensure all new volumes are encrypted. Regular snapshots of EBS volumes stored in a different region (D) provide disaster recovery capability. Option E (EBS multi-attach) is intended for high availability, not data protection, and does not directly protect data. Options B and C are incorrect: S3 Object Lock is for S3 objects, not EBS snapshots; automated backups for RDS are for RDS databases, not EBS volumes.

Answer

Use S3 Object Lock to prevent deletion of snapshots

Answer

Enable automated backups for Amazon RDS

Answer

Use EBS multi-attach for high availability

Question 10

A company stores sensitive data in Amazon S3. The security team needs to ensure that data is encrypted at rest and that access is logged. Which TWO actions meet these requirements?

Accepted Answer

Enable S3 server access logs. (Enable S3 server access logs) and Option D (Enable default encryption on the S3 bucket) are correct. Default encryption ensures data is encrypted at rest. Server access logs record requests to the bucket. Option A is wrong because VPC Flow Logs capture network traffic, not S3 access. Option C is wrong because CloudTrail logs data events only if explicitly enabled. Option E is wrong because IAM Access Analyzer analyzes resource policies, not logging access.

Answer

Enable VPC Flow Logs for the VPC

Answer

Enable AWS CloudTrail to log data events

Answer

Enable AWS IAM Access Analyzer

Question 11

A company uses AWS Organizations to manage multiple accounts. The security team wants to enable CloudTrail for all accounts and centrally store logs. What is the most efficient way to achieve this?

Accepted Answer

Create a CloudTrail trail in the management account and apply it to all accounts in the organization. AWS Organizations allows you to create a single CloudTrail trail in the management account that automatically applies to all member accounts within the organization. This is the most efficient method as it eliminates the need for manual per-account configuration or custom automation, and it ensures consistent logging across the entire organization with centralized log delivery to a single S3 bucket.

Answer

Use an S3 bucket policy to allow cross-account log delivery

Answer

Use AWS Lambda to create trails in each account

Answer

Ask each account admin to create their own CloudTrail trail and deliver to a central S3 bucket

Question 12

A company wants to encrypt data at rest in Amazon S3 using server-side encryption with Amazon S3-managed keys (SSE-S3). What is the minimum permission required for an IAM user to upload an object that will be encrypted with SSE-S3?

Accepted Answer

s3:PutObject. (s3:PutObject) is correct. SSE-S3 does not require any special permissions beyond s3:PutObject; S3 handles the encryption automatically. Option A (s3:PutObjectAcl) is wrong because it is for managing object ACLs, not for uploading. Option B (kms:Decrypt) is wrong because it is not needed for SSE-S3; kms:Decrypt is used for decryption with KMS. Option D (kms:GenerateDataKey) is wrong because it is needed for SSE-KMS, not SSE-S3.

Answer

s3:PutObjectAcl

Answer

kms:Decrypt

Answer

kms:GenerateDataKey

Question 13

A company is designing a data protection strategy for Amazon EFS file systems. The security team requires encryption at rest and in transit. Additionally, the team needs to control which KMS keys can be used to encrypt the file system. Which THREE steps should the team take?

Accepted Answer

Configure a KMS key policy that allows the EFS service to use the key.. You must configure the KMS key policy to allow the EFS service to use the key for encryption at rest. Option B is correct because encryption at rest is enabled by specifying a customer-managed KMS key when creating the EFS file system. Option E is correct because encryption in transit is enabled by using the TLS option when mounting the file system on the client. Option C is incorrect because EFS does not support SSE-S3; it uses KMS for encryption at rest. Option D is incorrect because IAM policies can restrict who can create encrypted file systems, but the question specifically asks about controlling which KMS keys can be used, which is done via KMS key policies, not IAM policies.

Answer

Enable default encryption on the EFS file system using SSE-S3.

Answer

Use an IAM policy to restrict which users can create encrypted file systems.

Question 14

A company has an AWS environment with multiple accounts managed under AWS Organizations. The security team wants to enforce that all newly created S3 buckets in any account have encryption enabled by default. Which approach should the security team take?

Accepted Answer

Create a Service Control Policy (SCP) that denies the creation of S3 buckets without encryption.. A Service Control Policy (SCP) can be applied at the organizational level to deny the creation of S3 buckets without encryption, enforcing the policy across all accounts proactively. Option A is wrong because AWS Config rules are reactive and only detect violations after buckets are created. Option B is wrong because S3 default encryption is a bucket-level setting that must be configured per bucket, not an organization-wide enforcement. Option C is wrong because IAM policies are account-specific and cannot be centrally enforced across all accounts in the organization.

Answer

Use AWS Config rules to detect unencrypted buckets and send alerts.

Answer

Enable S3 default encryption in each account's S3 settings.

Answer

Apply an IAM policy to the root user of each account to enforce bucket encryption.

Question 15

A security engineer is troubleshooting an issue where an EC2 instance cannot access an S3 bucket via a VPC endpoint. The bucket policy allows access only from the VPC endpoint. The instance has an IAM role that grants s3:GetObject on the bucket. The EC2 instance receives an AccessDenied error. What is the most likely cause?

Accepted Answer

The bucket policy does not include the aws:SourceVpce condition.. The AccessDenied error occurs because the S3 bucket policy must include the aws:SourceVpce condition to allow access from the specific VPC endpoint. Without this condition, the bucket policy denies all requests that do not originate from the endpoint, regardless of IAM permissions. Option B is correct because the missing condition is the most likely cause.

Answer

The IAM role does not have sufficient permissions.

Answer

The VPC endpoint policy is blocking the request.

Answer

The EC2 instance's security group does not allow outbound traffic to S3.

Question 16

A company has a multi-account AWS environment with 50 accounts. The security team uses AWS CloudTrail to log management events in each account and delivers logs to a centralized S3 bucket in the security account. Recently, the team noticed that some CloudTrail logs are missing from the central bucket for a few accounts. The logs appear to be delivered intermittently. The security engineer checks the CloudTrail configuration in one of the affected accounts and sees that the trail is configured to deliver to the central bucket. The bucket policy in the security account allows CloudTrail to write from all accounts. The engineer also checks the CloudTrail console and sees that the trail status is 'Logging'. What is the MOST likely cause of the intermittent log delivery?

Accepted Answer

The CloudTrail trail is using Kinesis Data Firehose for delivery, which has a throughput limit.. The most likely cause is that the CloudTrail trail is configured to deliver logs via Kinesis Data Firehose, which has a throughput limit. If the volume of log data exceeds the Firehose stream's capacity, some logs may fail to be delivered, resulting in intermittent missing logs. Option A is incorrect because S3 default encryption (SSE-S3) does not interfere with CloudTrail writes; CloudTrail can write to encrypted buckets. Option B is incorrect because a lifecycle policy deletes objects after they are stored, not during delivery, so it would not cause intermittent missing logs. Option D is incorrect because CloudTrail does not use SQS for log delivery; it delivers directly to S3 or via Firehose.

Answer

The S3 bucket has default encryption enabled, which interferes with CloudTrail writes.

Answer

The S3 bucket has a Lifecycle policy that deletes objects prematurely.

Answer

The CloudTrail trail in each account is not associated with an SQS queue, causing delivery failures.

Question 17

A company is using AWS Organizations to manage multiple accounts. The security team wants to prevent the creation of Amazon EC2 instances with public IP addresses in all accounts. Which TWO actions should the team take to implement this control using Service Control Policies (SCPs)?

Accepted Answer

Create an SCP with a Deny effect for ec2:RunInstances where the request parameter ec2:AssociatePublicIpAddress is true.. An SCP with a Deny effect for ec2:RunInstances can use the condition key ec2:AssociatePublicIpAddress to block instance creation when a public IP is requested. Option D is correct because attaching the SCP to the root OU ensures it applies to all accounts in the organization. Option A is wrong because the condition key ec2:LaunchTemplate is used to restrict based on launch templates, not public IP assignment. Option B is wrong because SCPs do not add IAM policies; they set permission boundaries that deny or allow actions. Option E is wrong because SCPs can deny actions based on tags but the condition key for public IP is ec2:AssociatePublicIpAddress, not a tag.

Answer

Use the condition key 'ec2:LaunchTemplate' to deny public IPs.

Answer

Create an SCP that adds an IAM policy to deny ec2:RunInstances.

Answer

Create an SCP that requires the tag 'PublicIP' to be set to 'false'.

Question 18

A company is required to audit all changes to IAM policies. Which AWS service should be used to record these changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API activity in your AWS account, including all IAM policy changes made via the AWS Management Console, SDKs, CLI, or AWS services. Each event is captured as a CloudTrail event with details such as the identity making the request, the time of the request, and the request parameters, enabling a complete audit trail of IAM policy modifications.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

Amazon S3

Answer

IAM Access Analyzer

Question 19

Refer to the exhibit. A security engineer is reviewing this IAM policy attached to a user. The user reports that they are able to stop and start instances, but they cannot terminate instances. However, the engineer notices that there is no explicit deny for termination. Why is the user unable to terminate instances?

Accepted Answer

The policy does not include an explicit Allow for ec2:TerminateInstances.. IAM policies operate on an explicit allow model. Even though there is no explicit deny for ec2:TerminateInstances, the user is unable to terminate instances because the policy does not include an explicit Allow action for ec2:TerminateInstances. Without an explicit Allow, the default behavior is to deny the action, regardless of whether a deny statement is present.

Answer

The second statement's Resource is set to '*' but the Action list does not include termination.

Answer

The first statement's Resource element is too restrictive and does not include the termination API call.

Answer

The policy has a syntax error that prevents termination from being evaluated.

Question 20

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. Which component should be added to the VPC to enable this?

Accepted Answer

NAT gateway. (NAT gateway). A NAT gateway enables instances in a private subnet to initiate outbound traffic to the internet for tasks like software updates, while preventing inbound traffic from the internet. Option A (Internet gateway) is incorrect because it is used for public subnets to allow direct internet access. Option B (VPN connection) is used for secure connectivity to an on-premises network, not for outbound internet access. Option C (VPC peering connection) is used to connect two VPCs, not to provide internet access.

Answer

Internet gateway

Answer

VPN connection

Answer

VPC peering connection