SCS-C02 Practice Exam 51 — 20 Questions

Question 1

A security engineer is designing a VPC with public and private subnets. The private subnets will host databases that should not have direct internet access. Which three components are required to provide outbound internet access for these databases? (Choose THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

An internet gateway attached to the VPC.. Option B is correct because an internet gateway (IGW) attached to the VPC is the fundamental component that enables any communication between the VPC and the internet; the NAT gateway itself requires an IGW to forward traffic outbound. Option E is correct because a NAT gateway must be deployed in a public subnet (one whose route table points to the IGW) so it can translate private subnet traffic to the internet while preventing inbound connections to the databases. Option C is correct because the private subnet route tables must contain a default route (0.0.0.0/0) targeting the NAT gateway, which is how the databases' outbound packets are directed to the NAT for translation. Option A is not required because AWS WAF is a layer 7 web application firewall that protects web applications and does not enable or provide outbound internet access. Option D is not required because a VPC gateway endpoint for S3 only provides private connectivity to Amazon S3 and does not provide general outbound internet access.

Answer

AWS WAF attached to the NAT gateway.

Answer

A VPC gateway endpoint for S3.

Question 2

A company needs to be alerted when root account credentials are used in their AWS account. Which service should be used to create a metric filter and alarm for this event?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs can monitor CloudTrail log events for root account usage by creating a metric filter that matches the `userIdentity.type` field with a value of `Root`. When the filter detects a match, it triggers a CloudWatch alarm to notify the operations team. This is the standard AWS-recommended approach for alerting on root activity.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

AWS CloudTrail

Question 3

A company has a VPC with a public subnet and a private subnet. An Amazon RDS instance is in the private subnet, and an application server is in the public subnet. The security team needs to allow the application server to connect to the RDS instance on port 3306 (MySQL). Which configuration will meet this requirement securely?

Accepted Answer

Add an inbound rule to the RDS security group that allows traffic from the security group of the application server on port 3306.. It uses a security group reference as the source in the inbound rule for the RDS security group. This allows traffic only from the specific application server(s) associated with that security group, regardless of their IP addresses, and automatically scales if the application server is replaced or scaled. This is the most secure and AWS-recommended method for controlling traffic between resources within a VPC.

Answer

Add an inbound rule to the RDS security group that allows traffic from the VPC CIDR on port 3306.

Answer

Add an inbound rule to the RDS security group that allows traffic from the subnet CIDR of the application server on port 3306.

Answer

Add an inbound rule to the RDS security group that allows traffic from 0.0.0.0/0 on port 3306.

Question 4

A company uses AWS CloudTrail to log all API calls across multiple accounts in AWS Organizations. The security team notices that management events are being logged, but data events for Amazon S3 are not appearing in the CloudTrail logs for any account. The team needs to enable data event logging for S3 across all accounts. Currently, the organization trail is configured in the management account, and all member accounts have default CloudTrail configurations. What is the MOST efficient way to enable S3 data event logging for all current and future accounts in the organization?

Accepted Answer

Update the existing organization trail's event selectors in the management account to include S3 data events for all accounts.. An organization trail in the management account can have its event selectors updated to include S3 data events for all accounts in the organization. This change automatically applies to all existing and future member accounts, as organization trails are replicated to all accounts by AWS CloudTrail. No additional configuration is needed in member accounts, making it the most efficient approach.

Answer

Ask each member account to create a new trail in their own account with S3 data events enabled.

Answer

Enable S3 server access logging on all S3 buckets across the organization and aggregate logs in a central S3 bucket.

Answer

Create a new organization trail in the management account with S3 data events enabled, and share it with member accounts.

Question 5

Which THREE are best practices for securing AWS CloudTrail log files? (Choose three.)

Accepted Answer

Restrict access to the S3 bucket using a bucket policy that requires MFA and encryption.. Restricting access to the S3 bucket with a bucket policy that requires MFA (Multi-Factor Authentication) and encryption (e.g., aws:MultiFactorAuthPresent and aws:SecureTransport conditions) ensures that only authenticated and authorized users can access CloudTrail logs, and that data is encrypted in transit. This prevents unauthorized deletion or modification of log files, which is critical for maintaining an immutable audit trail.

Answer

Deliver logs to an S3 bucket in the same region as the trail.

Answer

Set a lifecycle policy to delete logs after 30 days.

Question 6

A company wants to monitor CPU utilization of their EC2 instances and receive an alert when utilization exceeds 80% for 5 consecutive minutes. Which AWS service should be used to set up this metric alarm?

Accepted Answer

Amazon CloudWatch Alarms. Amazon CloudWatch Alarms is the correct service because it is specifically designed to monitor CloudWatch metrics, such as EC2 CPU utilization, and trigger actions (e.g., SNS notifications) when a metric crosses a defined threshold for a specified number of consecutive evaluation periods. In this scenario, you would create a CloudWatch Alarm on the `CPUUtilization` metric with a threshold of 80%, set the period to 1 minute, and configure the alarm to evaluate 5 consecutive datapoints (periods) to meet the '5 consecutive minutes' requirement.

Answer

Amazon Inspector

Answer

AWS Config

Answer

AWS CloudTrail

Question 7

A security engineer is investigating a potential credential compromise. An IAM user's access key was used to launch EC2 instances in a region where the user has never operated before. The engineer wants to quickly identify all API calls made by this user in the last 24 hours, including the source IP addresses. Which AWS service or feature should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made by IAM users, including the source IP address, user identity, and request details. By querying CloudTrail logs for the specific IAM user's access key over the last 24 hours, the engineer can identify every EC2-related and other API call, along with the originating IP addresses, enabling rapid investigation of the potential credential compromise.

Answer

VPC Flow Logs

Answer

AWS Trusted Advisor

Answer

Amazon CloudWatch Logs

Question 8

A company is migrating sensitive data to Amazon S3. The data must be encrypted at rest using keys managed by the company. The company also requires an audit trail of key usage. Which solution meets these requirements?

Accepted Answer

Use SSE-KMS with a customer-managed key and enable CloudTrail for KMS.. SSE-KMS with a customer-managed key and CloudTrail for KMS. This solution meets both requirements: the company manages its own keys (customer-managed CMK) and CloudTrail logs every KMS API call, providing an audit trail of key usage. Option A (SSE-S3) uses Amazon-managed keys, so no customer control or audit trail. Option B (SSE-C) requires the customer to manage keys themselves but does not integrate with CloudTrail for key usage auditing; also, storing keys in Secrets Manager does not provide an audit trail of KMS key usage. Option D (CloudHSM) can be used, but it requires more complex setup for auditing; SSE-KMS with CloudTrail is the simpler and more direct solution.

Answer

Use SSE-S3 with default encryption.

Answer

Use SSE-C and store the keys in AWS Secrets Manager.

Answer

Use AWS CloudHSM to generate and store keys, and use Amazon S3 with SSE-KMS.

Question 9

Refer to the exhibit. An AWS Config rule checks that S3 buckets deny HTTP requests. The bucket 'my-bucket' is reported as non-compliant. Which change would make the bucket compliant?

Accepted Answer

Add the bucket ARN to the Resource element in the policy.. The bucket policy denies actions when 'aws:SecureTransport' is false (HTTP). However, the policy only applies to the bucket's objects (arn:aws:s3:::my-bucket/*), not to the bucket itself. To deny HTTP requests to the bucket as well, the resource should include the bucket ARN (arn:aws:s3:::my-bucket). The rule likely checks that both bucket and objects are denied.

Answer

Add a bucket policy that allows only HTTPS requests.

Answer

Change the Effect to Allow.

Answer

Remove the Condition element from the policy.

Question 10

A company wants to securely share an Amazon S3 object with an external partner. The partner needs to download the object using an HTTP GET request. The object must be accessible for only 24 hours. What is the most secure way to grant access?

Accepted Answer

Generate a presigned URL for the object with an expiration of 24 hours.. A presigned URL grants time-limited, secure access to a specific S3 object without exposing AWS credentials. The partner can download the object via HTTP GET within the 24-hour expiration window. Option A is incorrect because sharing IAM user credentials is insecure and provides broader access than needed. Option B is incorrect because making the object public exposes it to anyone, violating security. Option D is incorrect because creating an IAM user is unnecessary; the presigned URL alone provides the required access, and adding a user credential undermines security.

Answer

Create a new IAM user with read access to the object and share the access key and secret key.

Answer

Make the object publicly readable and share the object URL.

Answer

Create a new IAM user with read access to the object, then generate a presigned URL for the object.

Question 11

A company has a multi-account AWS Organization with 50 accounts. The security team wants to monitor for unauthorized IAM role assumption across all accounts. They have enabled AWS CloudTrail in all accounts and are delivering logs to a central S3 bucket in the security account. They also have Amazon GuardDuty enabled in all accounts. The security team wants a centralized dashboard to visualize cross-account role assumption events. They have limited budget and want to use existing services. What should they do?

Accepted Answer

Use Amazon Athena to query CloudTrail logs in S3 and visualize with Amazon QuickSight.. Amazon Athena can query CloudTrail logs stored in S3 using standard SQL, and Amazon QuickSight can create visualizations from Athena query results. This leverages existing services without additional cost for Amazon QuickSight (pay-per-session pricing) and minimal cost for Athena (based on data scanned). Option B is incorrect because AWS Config aggregator provides a view of resource configuration across accounts, not API call analysis. Option C is incorrect because CloudWatch Logs Insights cannot directly query logs stored in S3; it requires logs to be in CloudWatch Logs. Option D is incorrect because Amazon Elasticsearch Service incurs additional costs and complexity, which the company wants to avoid.

Answer

Use AWS Config aggregator to view cross-account IAM role creation.

Answer

Use Amazon CloudWatch Logs Insights to query logs from the central S3 bucket.

Answer

Use Amazon Elasticsearch Service to index CloudTrail logs from S3 and visualize with Kibana.

Question 12

A company is designing a network architecture for a critical application that must meet strict compliance requirements. The application consists of Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The instances need to access an Amazon RDS database in a different VPC. The company wants to minimize exposure to the internet. Which solution should the company use?

Accepted Answer

Use a VPC Peering connection between the two VPCs.. VPC Peering establishes a private, direct network connection between two VPCs using AWS's internal infrastructure, with no exposure to the internet. Traffic stays within the AWS global network, meeting strict compliance requirements for minimizing internet exposure. This allows EC2 instances in the application VPC to communicate with the RDS database in the database VPC securely and with low latency, using private IP addresses.

Answer

Use a site-to-site VPN connection between the VPCs.

Answer

Use a NAT gateway in the database VPC and route traffic through it.

Answer

Use an internet gateway and route traffic over the internet with security groups.

Question 13

A company uses AWS CloudTrail to log management events. The security team wants to be alerted when an IAM user creates a new access key. Which solution would meet this requirement with the least operational overhead?

Accepted Answer

Create an Amazon EventBridge rule that matches the CreateAccessKey event and triggers an Amazon SNS notification.. Amazon EventBridge can directly capture CloudTrail API calls (like CreateAccessKey) as events and route them to an SNS topic for notification, requiring no custom code or polling. This serverless, event-driven approach minimizes operational overhead by eliminating the need to manage log groups, metric filters, or scheduled scripts.

Answer

Create a CloudWatch Logs metric filter on the CloudTrail log group for CreateAccessKey events and set an alarm.

Answer

Write a Python script that uses the CloudTrail LookupEvents API and run it on a scheduled basis using Amazon EventBridge Scheduler.

Answer

Develop a custom AWS Lambda function that queries CloudTrail logs in S3 every hour.

Question 14

Refer to the exhibit. A security engineer reviews the AWS WAF web ACL configuration. What is the effect of this configuration?

Accepted Answer

It blocks IPs that send more than 2000 requests and allows requests containing '

Answer

It allows all traffic because the rules are misconfigured.

Answer

It blocks both SQL injection and XSS attacks.

Answer

It blocks SQL injection attacks and allows XSS attacks.

Question 15

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via AWS Site-to-Site VPN. Security engineers need to ensure that traffic between VPCs is inspected by a third-party firewall appliance deployed in a centralized inspection VPC. Which architecture should be used?

Accepted Answer

Create a central inspection VPC with the firewall appliance. Configure Transit Gateway route tables to route traffic between VPCs through the inspection VPC.. Transit Gateway route tables can force traffic between VPCs through the inspection VPC by attaching the firewall appliance and using specific routing entries. Option A is incorrect because security groups only control traffic at the instance level and cannot redirect traffic to an inspection appliance. Option B is incorrect because VPC Peering does not support transitive routing, so traffic between two VPCs cannot go through a third VPC. Option C is incorrect because Network ACLs are stateless and can only filter traffic based on IP/port, not route traffic through an inspection appliance.

Answer

Use security groups in each VPC to allow only traffic from the firewall appliance's IP.

Answer

Establish VPC Peering connections between each VPC and the inspection VPC.

Answer

Configure Network ACLs in each VPC to deny traffic that does not originate from the inspection VPC.

Question 16

A company is using Amazon S3 to store confidential documents. They want to ensure that all data is encrypted in transit between the S3 bucket and their on-premises application. Which of the following should be enforced?

Accepted Answer

Add a bucket policy that denies access unless 'aws:SecureTransport' is true.. A bucket policy that denies requests unless `aws:SecureTransport` is true enforces TLS for all access to the bucket, including from on-premises applications. This is the canonical AWS pattern for requiring encryption in transit to S3. The other options either do not enforce TLS or address different concerns (encryption at rest, network path).

Answer

Use Amazon CloudFront with a custom origin pointing to the S3 bucket.

Answer

Use a VPC endpoint for S3.

Answer

Enable default encryption (SSE-S3) on the bucket.

Question 17

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all Amazon S3 buckets across the organization have server-side encryption (SSE-S3 or SSE-KMS) enabled. Which approach should be used to enforce this policy?

Accepted Answer

Create a service control policy (SCP) that denies s3:CreateBucket if the bucket does not have encryption enabled.. Service Control Policies (SCPs) in AWS Organizations allow you to centrally deny API actions across all accounts. By creating an SCP that denies `s3:CreateBucket` unless the request includes encryption parameters (SSE-S3 or SSE-KMS), you enforce encryption at the point of bucket creation, preventing non-compliant buckets from ever being created. This is the only approach that proactively enforces the policy across the entire organization, rather than relying on detection or per-account configurations.

Answer

Create an S3 bucket policy in each account to deny access to unencrypted buckets.

Answer

Use AWS Config rules to detect buckets without encryption and send alerts.

Answer

Create an IAM role in each account that requires encryption when creating buckets.

Question 18

A company uses AWS Organizations with a management account and several member accounts. The security team wants to restrict the use of specific AWS services (e.g., EC2, Lambda) in certain accounts based on the account's environment (dev, test, prod). Which approach should be used to implement this requirement?

Accepted Answer

Use AWS Organizations to tag accounts (e.g., Environment=Dev) and use SCPs with conditions to deny access to services based on tags.. By tagging accounts in AWS Organizations (e.g., Environment=Dev) and using Service Control Policies (SCPs) with conditions based on those tags, the security team can restrict usage of specific AWS services per account environment. SCPs are applied at the organization level and affect all users and roles in the account, providing preventive controls. Option A is incorrect because CloudTrail only logs API calls and does not prevent usage; revoking access after the fact is not a preventive measure. Option B is incorrect because IAM roles are identity-based and do not restrict services at the account level; also, managing roles per account would be cumbersome. Option D is incorrect because AWS Config rules detect non-compliant resource configurations but do not prevent the use of services; they are detective controls.

Answer

Use AWS CloudTrail to monitor API calls and revoke access after the fact.

Answer

Create IAM roles in each account with policies that deny access to services.

Answer

Use AWS Config rules to detect and alert when restricted services are used.

Question 19

A security engineer needs to ensure that all API calls made in an AWS account are captured and retained for auditing purposes. The engineer must be able to query the logs for specific user activity over the past 90 days. Which AWS service should the engineer use to meet these requirements?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made in an AWS account, including the identity, source IP, request parameters, and response elements. By default, CloudTrail stores event history for the last 90 days, which can be queried via the Event History console or API, meeting the requirement to query logs for specific user activity over the past 90 days without additional configuration.

Answer

Amazon VPC Flow Logs

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Question 20

Which TWO are best practices for securing an AWS account's root user? (Choose two.)

Accepted Answer

Enable multi-factor authentication (MFA) on the root user.. Enabling multi-factor authentication (MFA) on the root user adds a second layer of security beyond the password and is the single most effective control to prevent unauthorized access to the most privileged account in an AWS environment. AWS strongly recommends MFA for the root user as it mitigates the risk of credential theft or compromise, which could lead to full account takeover and irreversible damage.

Answer

Share the root user credentials with the security team.

Answer

Delete the root user account.

Answer

Use the root user for daily administrative tasks.