SCS-C02 Practice Exam 52 — 20 Questions

Question 1

A company is designing a shared services VPC architecture with multiple VPCs connected via a transit gateway. The security engineer needs to ensure that all traffic between VPCs is inspected by a centralized firewall appliance deployed in the shared services VPC. What configuration is required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure transit gateway route tables to route all inter-VPC traffic through the firewall appliance.. A transit gateway can use separate route tables to control traffic flow. By configuring the transit gateway route tables to point the default route (0.0.0.0/0) or specific inter-VPC CIDR ranges to a network interface of the centralized firewall appliance in the shared services VPC, all traffic between VPCs is forced through the firewall for inspection. This design ensures that the firewall acts as a central inspection point without requiring VPC peering or complex routing.

Answer

Create VPC peering connections between each VPC and the shared services VPC.

Answer

Use security groups to route traffic through the firewall.

Answer

Deploy a Gateway Load Balancer (GWLB) in the shared services VPC and register the firewall as a target.

Question 2

A developer needs to grant an IAM user access to a specific S3 bucket only. Which IAM policy element should be used to restrict access to that bucket?

Accepted Answer

Resource. The Resource element in an IAM policy specifies the AWS resource(s) to which the policy statement applies. For an S3 bucket, you use the bucket's ARN (e.g., arn:aws:s3:::bucket-name) or its objects (arn:aws:s3:::bucket-name/*) in the Resource field to restrict access to that specific bucket. This directly scopes the permissions to the intended bucket, ensuring the IAM user can only perform allowed actions on that resource.

Answer

Principal

Answer

Condition

Answer

Action

Question 3

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The security team requires that all traffic between the ALB and EC2 instances be encrypted. Which configuration ensures this requirement is met?

Accepted Answer

Use an HTTPS listener on the ALB and configure the target group with HTTPS.. It ensures end-to-end encryption between the ALB and EC2 instances. By configuring an HTTPS listener on the ALB, traffic from clients to the ALB is encrypted. Then, by setting the target group protocol to HTTPS, the ALB re-encrypts the traffic before forwarding it to the EC2 instances, fulfilling the security team's requirement that all traffic between the ALB and EC2 instances be encrypted.

Answer

Use a TCP listener on the ALB and a TCP target group.

Answer

Configure security group inbound rules to allow only HTTPS traffic.

Answer

Use an HTTP listener on the ALB and HTTP on the target group.

Question 4

A company uses Amazon RDS for its database. The security team needs to detect when a database instance is started or stopped outside of maintenance windows. Which AWS service should the team use to monitor these API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API activity in your AWS account, including StartDBInstance and StopDBInstance calls from the RDS service. By monitoring CloudTrail logs, the security team can detect when a database instance is started or stopped outside of maintenance windows, as each API call is logged with a timestamp and user identity. CloudTrail is specifically designed for auditing API calls, making it the appropriate tool for this use case.

Answer

Amazon CloudWatch

Answer

Amazon GuardDuty

Answer

AWS Config

Question 5

Which TWO of the following are valid options for encrypting data at rest in Amazon S3? (Choose 2.)

Accepted Answer

SSE-S3. SSE-S3 is correct because it provides server-side encryption where Amazon S3 manages the encryption keys entirely. When you upload an object, S3 encrypts it using AES-256 before writing to disk and decrypts it when you access it, with no additional configuration needed beyond enabling the header `x-amz-server-side-encryption: AES256`.

Answer

SSL/TLS encryption

Answer

IAM policy encryption

Answer

CloudHSM client-side encryption

Question 6

A company wants to detect and alert on suspicious IAM role usage, such as a role being assumed from an unusual geographic location. Which AWS service should be used to generate the alerts?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is the correct choice because it is a threat detection service that continuously monitors for suspicious activity, including unusual IAM role usage such as a role being assumed from an anomalous geographic location. It uses machine learning, anomaly detection, and integrated threat intelligence to analyze CloudTrail management events and VPC flow logs, generating alerts (findings) for deviations from baseline behavior. This directly meets the requirement to detect and alert on suspicious role assumptions without needing to write custom rules.

Answer

AWS IAM Access Analyzer

Answer

AWS CloudTrail

Answer

Amazon CloudWatch

Question 7

Refer to the exhibit. A security engineer runs the get-trail-status command for a CloudTrail trail. The engineer notices that LatestCloudWatchLogsDeliveryTime is null. What does this indicate?

Accepted Answer

The trail is not configured to deliver logs to CloudWatch Logs.. LatestCloudWatchLogsDeliveryTime being null indicates the trail has never delivered logs to a CloudWatch Logs log group — in other words, CloudWatch Logs delivery is not configured for this trail. If delivery were configured and functioning, this field would contain the timestamp of the most recent delivery. A null value specifically means no delivery has occurred, not that delivery failed.

Answer

The trail has stopped logging.

Answer

The trail is not delivering logs to S3.

Answer

The digest delivery has failed.

Question 8

A company uses AWS Organizations with multiple accounts. The security team wants to centralize VPC Flow Logs from all accounts into a single S3 bucket in the security account. The flow logs are created in the member accounts and sent to the centralized bucket. However, the security team notices that flow logs from some member accounts are not being delivered. What is the most likely cause?

Accepted Answer

The S3 bucket policy does not grant write permissions to the member accounts.. VPC Flow Logs are delivered to an S3 bucket using the flow log publisher's IAM role, but the destination bucket must also have a bucket policy that explicitly grants the necessary permissions (e.g., s3:PutObject) to the member accounts' log delivery service. Without this policy, the S3 bucket will reject write requests from member accounts, causing flow logs to fail silently.

Answer

The member accounts need an IAM role with permissions to write to the centralized bucket.

Answer

CloudTrail must be enabled in each member account before VPC Flow Logs can be sent to a centralized bucket.

Answer

VPC Flow Logs cannot be aggregated across multiple AWS accounts.

Question 9

A company uses AWS CloudTrail and wants to ensure that any modification to the trail itself is detected immediately. What should be done?

Accepted Answer

Create a CloudWatch Events rule that matches the StopLogging or UpdateTrail API calls and sends an alert. CloudWatch Events (now part of Amazon EventBridge) can be configured with a rule that matches specific API calls like StopLogging or UpdateTrail via CloudTrail. When such an API call is made, the rule triggers an action such as sending an SNS notification or invoking a Lambda function, enabling immediate detection of trail modifications. This approach directly monitors the control plane operations that alter the trail's configuration.

Answer

Configure Amazon GuardDuty to monitor for trail modifications

Answer

Enable CloudTrail Insights to detect unusual activity

Answer

Enable S3 event notifications on the trail's S3 bucket

Question 10

Which THREE components are required to set up a client VPN for remote access to a VPC? (Choose 3.)

Accepted Answer

Client VPN endpoint. A Client VPN endpoint is required as the entry point for remote clients to connect to the VPC. It manages authentication, encryption (using TLS 1.2), and routing for client connections. Without this component, there is no VPN server to accept and authenticate client traffic.

Answer

Virtual Private Gateway

Answer

Customer Gateway

Question 11

A security engineer is investigating a potential data breach and finds this CloudTrail log entry. What does this entry indicate?

Accepted Answer

A user decrypted data using a KMS key. The CloudTrail entry shows a Decrypt API call against a KMS key, which indicates a principal used the key to decrypt ciphertext. This is the standard CloudTrail event emitted when KMS performs a cryptographic decryption operation.

Answer

A user encrypted data using a KMS key

Answer

An anonymous user accessed the KMS key

Answer

The KMS key was deleted

Question 12

A security team needs to be alerted when an IAM user generates a console login failure. Which combination of AWS services should be used to meet this requirement?

Accepted Answer

CloudTrail, Amazon CloudWatch Logs, and CloudWatch Alarms. CloudTrail captures IAM console login failures as CloudTrail events, which can be streamed to CloudWatch Logs. A CloudWatch Alarm can then be configured to trigger on a metric filter that matches the specific 'ConsoleLogin' event with a 'Failure' status, enabling real-time alerting via Amazon SNS.

Answer

CloudTrail and Amazon S3

Answer

AWS Config and Amazon SNS

Answer

Amazon GuardDuty and AWS Lambda

Question 13

A security engineer notices that an IAM user has been inactive for 90 days. What is the best way to identify and disable such users?

Accepted Answer

Use IAM Credential Report and disable users with no activity in 90 days. The IAM Credential Report provides a comprehensive CSV export of all IAM users in the account, including the `password_last_used` and `access_key_last_used_date` columns. This allows a security engineer to directly identify users who have had no activity for 90 days and then disable them by applying an IAM policy with a `Deny` effect or removing their credentials. It is the most straightforward, native, and accurate method for this specific task.

Answer

Use CloudTrail to identify users with no recent events

Answer

Use AWS Config rule to detect inactive users

Answer

Use AWS Organizations to disable users

Question 14

An application running on Amazon EC2 needs to access an S3 bucket containing sensitive data. The security team wants to avoid storing long-term AWS credentials on the instance. How should the EC2 instance be configured to access S3 securely?

Accepted Answer

Assign an IAM role with S3 permissions to the EC2 instance via an instance profile.. Assigning an IAM role to an EC2 instance via an instance profile is the AWS-recommended way to grant AWS service permissions without embedding long-term credentials. The instance profile delivers temporary, automatically rotated credentials through the EC2 Instance Metadata Service (IMDS) at 169.254.169.254, which the SDK/CLI retrieves transparently. This satisfies the security team's requirement to avoid storing long-term AWS credentials on the instance while still allowing least-privilege S3 access.

Answer

Store IAM user access keys in the instance's user data.

Answer

Attach a KMS key policy that allows the instance to decrypt S3 objects.

Answer

Generate S3 pre-signed URLs for all objects the instance needs to access.

Question 15

A developer needs to grant an EC2 instance access to an S3 bucket. Which is the most secure way to provide credentials to the EC2 instance?

Accepted Answer

Create an IAM role and attach it to the EC2 instance profile. It uses an IAM role attached to an EC2 instance profile, which allows the instance to obtain temporary, automatically rotated credentials from the AWS STS service via the instance metadata service (IMDS). This eliminates the need to hardcode, store, or manage long-term access keys, significantly reducing the risk of credential exposure.

Answer

Store AWS access keys in the application code

Answer

Store the keys in an S3 bucket and download them at startup

Answer

Use environment variables to store the keys

Question 16

A company uses AWS Systems Manager Session Manager to provide SSH access to EC2 instances without needing to open inbound ports. The security team wants to ensure that all session activity is logged and that only authorized users can start sessions. Which combination of actions should be taken? (Choose TWO.)

Accepted Answer

Enable AWS CloudTrail to log StartSession API calls.. Option B is correct because Session Manager records session activity through the StartSession API, and enabling AWS CloudTrail captures those API calls for auditing who started sessions and when. Option D is correct because IAM policies scoping the ssm:StartSession action to specific users or roles enforce authorization, ensuring only approved principals can initiate sessions. Option A is incorrect because Session Manager does not rely on SSH key pairs; it uses the SSM Agent and IAM credentials, so requiring SSH keys does not meet the logging or authorization goal. Option C is incorrect because VPC Flow Logs capture IP traffic metadata, not the session-level activity or API authorization events the team needs. Option E is incorrect because Session Manager is designed to avoid inbound ports and security groups restricting inbound traffic to Session Manager endpoints is neither required nor how access control is enforced.

Answer

Configure the EC2 instances to require SSH key pairs for authentication.

Answer

Enable VPC Flow Logs to monitor network traffic.

Answer

Use security groups to restrict inbound traffic to the Session Manager endpoints.

Question 17

Refer to the exhibit. A security engineer runs this CloudWatch Logs Insights query on a log group. What is the purpose of this query?

Accepted Answer

Retrieve the 20 most recent log events that contain 'ERROR' or 'WARN'.. The CloudWatch Logs Insights query uses `filter @message like /(?i)(ERROR|WARN)/` to match log events containing either 'ERROR' or 'WARN' (case-insensitive), then `sort @timestamp desc` orders them by most recent first, and `limit 20` restricts the output to the top 20 results. This retrieves the 20 most recent log events that contain either term, making option B correct.

Answer

Retrieve the 20 most recent log events that contain only 'ERROR'.

Answer

Display all log events grouped by log level.

Answer

Count the number of ERROR and WARN events in the last hour.

Question 18

A company is designing a data protection strategy for its Amazon S3 bucket that stores sensitive customer data. The bucket must be encrypted at rest using a customer managed key (CMK) that is stored in AWS KMS. The company also needs to ensure that only authorized users can decrypt objects. Which TWO actions should the company take?

Accepted Answer

Modify the KMS key policy to allow only the authorized IAM roles to use the key. Option B is correct because the KMS key policy is the primary resource-based access control for a customer managed key, so modifying it to allow only the authorized IAM roles to use the key ensures that no other principals can call kms:Decrypt or otherwise use the CMK to access the encrypted S3 objects. Option C is correct because even if the key policy permits a role, the caller still needs an identity-based IAM policy granting kms:Decrypt on that specific CMK, so attaching such a policy to the authorized users is required for them to decrypt the objects. Together, the key policy and the IAM policy satisfy the requirement that only authorized users can decrypt data encrypted with the CMK. Option A does not belong because S3 server-side encryption with KMS does not use encryption context in the s3:GetObject request in the way described, and denying based on encryption context is not the mechanism for restricting decryption to authorized users. Option D does not belong because a VPC endpoint and bucket policy control network/API access to S3, not who can decrypt with the KMS CMK. Option E does not belong because SSE-C uses a customer-provided key rather than a CMK stored in AWS KMS, which contradicts the stated requirement.

Answer

Create a bucket policy that denies s3:GetObject unless the request includes a specific encryption context

Answer

Create a VPC endpoint for S3 and use bucket policies to restrict access to the endpoint

Answer

Use SSE-C with a customer-provided key

Question 19

Refer to the exhibit. The security team is investigating a security incident in us-west-2 region. They notice that management events from us-west-2 are not appearing in the CloudTrail logs. Based on the exhibit, what is the most likely reason?

Accepted Answer

The trail is not a multi-region trail. The exhibit shows a single-region CloudTrail trail. A single-region trail only logs events in the region where it is created. Since management events from us-west-2 are not appearing, the trail must have been created in a different region. To capture events from us-west-2, the trail would need to be multi-region. Therefore, the most likely reason is that the trail is not a multi-region trail.

Answer

The S3 bucket is in a different region

Answer

The trail is not logging data events

Answer

The trail does not have log file validation enabled

Question 20

A company wants to centralize security logs from multiple AWS accounts into a single S3 bucket. The logging accounts (e.g., security, production) each have their own CloudTrail trails. Which configuration is required to allow cross-account log delivery?

Accepted Answer

Create an S3 bucket policy in the destination account that allows the CloudTrail service principal to write objects.. CloudTrail cross-account log delivery requires the destination S3 bucket to have a bucket policy that explicitly grants the CloudTrail service principal (`cloudtrail.amazonaws.com`) permission to write objects (e.g., `s3:PutObject`). This allows CloudTrail in any source account to deliver logs directly to the bucket without needing IAM roles or shared credentials, as the service principal authenticates on behalf of the source account.

Answer

Create an IAM role in the destination account with write permissions and allow CloudTrail in source accounts to assume that role.

Answer

Use a customer-managed KMS key in the destination account and share it with the source accounts.

Answer

Configure S3 bucket ACLs to grant write access to the source account IDs.