SCS-C02 Practice Exam 52 — 20 Questions

Question 1

An organization has a VPC with public and private subnets. A NAT Gateway is deployed in a public subnet to allow instances in private subnets to access the internet. The security team notices that instances in a private subnet can reach the internet, but cannot initiate connections to an on-premises network connected via AWS Direct Connect. The on-premises network advertises a specific route. What is the most likely cause?

Accepted Answer

The private subnet route table has a route for the on-premises CIDR pointing to the NAT Gateway.. Option A is correct because a more specific route to the on-premises network via the NAT Gateway may override the Direct Connect route in the route table. Option B is wrong because Security Groups do not affect outbound traffic initiated by instances. Option C is wrong because NACLs are stateless but would affect both directions. Option D is wrong because the internet gateway is not involved in Direct Connect traffic.

Answer

The security group assigned to the instances does not allow outbound traffic to the on-premises network.

Answer

The network ACL on the private subnet is blocking inbound traffic from the on-premises network.

Answer

The internet gateway is not attached to the VPC.

Question 2

A security engineer is tasked with implementing network segmentation for a multi-tier application. The web tier must be accessible from the internet, but the application tier must only be accessible from the web tier. The database tier must only be accessible from the application tier. All tiers are in the same VPC. Which design meets these requirements?

Accepted Answer

Create a security group for each tier. Configure inbound rules to allow traffic only from the preceding tier's security group.. Option B is correct because security groups can be referenced in inbound rules of other security groups, allowing the web tier SG to allow inbound from the ALB SG, the app tier SG to allow inbound from the web tier SG, and the database tier SG to allow inbound from the app tier SG. Option A is wrong because using CIDR blocks is less granular and does not scale. Option C is wrong because public subnets expose the application tier to the internet. Option D is wrong because NACLs are stateless and require more rules.

Answer

Use a single security group for all instances and use IAM policies to restrict access.

Answer

Place each tier in separate subnets and use network ACLs with CIDR blocks to allow traffic between tiers.

Answer

Place all instances in public subnets and restrict access using security groups.

Question 3

A security team notices that an S3 bucket containing sensitive data is publicly accessible. The bucket policy is as follows:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*"
    }
  ]
}

Which step should be taken to secure the bucket while maintaining access for authorized users?

Accepted Answer

Delete the public bucket policy and attach a new policy that allows access only through a VPC Endpoint.. Option B is correct because removing the public access and using a VPC Endpoint with a bucket policy that restricts access to the endpoint ensures only authorized users within the VPC can access the bucket. Option A is wrong because an IAM role alone does not prevent public access. Option C is wrong because the bucket policy already allows public access. Option D is wrong because blocking all public access prevents even authorized users if they are not in the VPC.

Answer

Use AWS Config to automatically block all public access.

Answer

Create an IAM role with S3 access and assign it to the bucket.

Answer

Add a Deny statement for any IP address outside the corporate network.

Question 4

A company wants to block traffic from a specific IP address range from accessing an Application Load Balancer (ALB). Which AWS feature should be used?

Accepted Answer

AWS WAF. Option B is correct because AWS WAF can be associated with an ALB to filter traffic based on IP addresses. Option A is wrong because security groups cannot be associated with ALBs in the same way as EC2. Option C is wrong because Network ACLs operate at the subnet level, not directly on the ALB. Option D is wrong because Route53 does not filter traffic.

Answer

Network ACL

Answer

Security Group for the ALB

Answer

Route53

Question 5

A security engineer is designing a web application that will run on EC2 instances behind an Application Load Balancer (ALB). The application must be protected from common web exploits like SQL injection and cross-site scripting. Which AWS service should be used to provide this protection?

Accepted Answer

AWS WAF. Option B is correct because AWS WAF is a web application firewall that protects against common web exploits. Option A is wrong because Shield Advanced provides DDoS protection, not application-layer attacks. Option C is wrong because Network ACLs are stateless firewalls at the subnet level. Option D is wrong because Security Groups are stateful firewalls at the instance level.

Answer

Network ACLs

Answer

Security Groups

Answer

AWS Shield Advanced

Question 6

Which THREE of the following are characteristics of IAM roles? (Choose 3.)

Accepted Answer

Roles can be assumed by IAM users in another AWS account.. Roles are assumed by trusted entities, provide temporary credentials, and can be used by AWS services.

Answer

Roles have long-term credentials like access keys.

Answer

Roles require a password for assumption.

Question 7

A developer needs to grant an IAM user the ability to launch EC2 instances with specific tags. Which IAM condition key should be used to enforce that the instance is tagged with 'Environment=Production'?

Accepted Answer

aws:RequestTag. aws:RequestTag is used to enforce tags at creation. Option B is for existing tags. Option C is for EC2-specific resource tags. Option D is for source IP.

Answer

aws:ResourceTag

Answer

aws:SourceIp

Answer

ec2:ResourceTag

Question 8

A security engineer runs the IAM policy simulator with a custom policy. The output shows the above. Which statement is true about the policy?

Accepted Answer

The policy contains a statement that explicitly denies iam:DeleteUser.. The simulator indicates 'explicitDeny' for DeleteUser, meaning a deny statement exists. Option A is correct. Option B is wrong because there is a deny. Option C is wrong because CreateUser is allowed. Option D is wrong because simulator shows explicit deny.

Answer

The policy allows iam:DeleteUser but denies iam:CreateUser.

Answer

The policy allows all actions by default.

Answer

The policy has no effect because the simulator returned errors.

Question 9

A company has a policy that all IAM users must rotate their access keys every 90 days. How can this be enforced?

Accepted Answer

Use AWS Config to check key age and automatically deactivate old keys. IAM access key last used information can be used with a custom policy and a condition that denies access if the key is older than 90 days. However, there is no built-in IAM policy condition for key age. Option C is correct because you can use AWS Config rules to check key age and trigger notifications, but the question asks for enforcement. Option A is wrong because IAM does not have a built-in key rotation policy. Option B is wrong because password policy is for passwords, not access keys. Option D is wrong because CloudTrail is for logging, not enforcement.

Answer

Use an IAM password policy to set the key rotation period

Answer

Use AWS CloudTrail to monitor key usage and send alerts

Answer

Use an IAM policy with a condition for key age

Question 10

A security engineer is troubleshooting an issue where an IAM policy allows access to S3 but the user is denied access to a specific bucket. The policy has the following statement:

{
  "Effect": "Allow",
  "Action": "s3:*",
  "Resource": "*"
}

What is the most likely cause of the denial?

Accepted Answer

An explicit deny statement in a different policy (e.g., SCP, permissions boundary) is overriding the allow.. Option A is correct because an explicit deny in a separate policy, such as a service control policy (SCP) or a permissions boundary, overrides any allow. Option B is wrong because the user's own policy is an allow. Option C is wrong because S3 bucket policies are resource-based and can deny access. Option D is wrong because IAM policies are evaluated as a whole; there is no implicit deny for specific buckets unless a deny exists.

Answer

The policy statement is too broad and AWS automatically denies access to specific buckets.

Answer

The S3 bucket has a bucket policy that denies access to the user.

Answer

The policy is attached to the user but the user is assuming a role that does not have S3 permissions.

Question 11

A security engineer is reviewing AWS CloudTrail logs and notices repeated `UnauthorizedOperation` errors for `ec2:RunInstances` from a specific IAM user. The user has a policy that allows `ec2:RunInstances` with a condition `aws:RequestedRegion` set to `us-east-1`. The engineer confirms the user is launching instances in `us-east-1`. What is the most likely cause of the error?

Accepted Answer

The user is using an AWS CLI command that does not include the `--region` parameter, causing the request to go to a global endpoint.. Option B is correct because the condition key `aws:RequestedRegion` checks the region endpoint used, but if the user is using a global endpoint or the request includes a different region parameter, it may fail. Option A is wrong because even if the instance type is not supported, the error would be different. Option C is wrong because service-linked roles do not affect RunInstances authorization. Option D is wrong because the user already has a policy; an additional policy is not needed.

Answer

The user does not have a service-linked role for EC2.

Answer

The IAM policy lacks a `Resource` element specifying which instances can be launched.

Answer

The user is trying to launch an instance type that is not supported in us-east-1.

Question 12

Which TWO are valid methods to secure data at rest in Amazon S3? (Choose TWO.)

Accepted Answer

Enabling default encryption on the S3 bucket.. Options B and D are correct. Server-side encryption (SSE-S3, SSE-KMS, SSE-C) and S3 Block Public Access are both methods to secure data at rest. Option A is wrong because bucket policies control access but do not encrypt data. Option C is wrong because versioning helps with data recovery, not encryption. Option E is wrong because MFA Delete adds protection for deletion, not encryption.

Answer

Enabling MFA Delete.

Answer

Enabling S3 Versioning.

Answer

Configuring an S3 bucket policy to restrict access to specific IP addresses.

Question 13

A security engineer is configuring a VPC with public and private subnets. The engineer wants to ensure that the private subnet instances cannot initiate outbound connections to the internet but can receive responses from the internet if initiated from within the VPC. Which TWO configurations should be used?

Accepted Answer

Configure the private subnet security group to allow inbound traffic from the public subnet's security group.. Options A and D are correct. A NAT Gateway allows outbound internet but not inbound; however the question says cannot initiate outbound. So a NAT Gateway is not needed. The correct approach is to not have a route to the internet for private subnet, and use a security group that allows inbound traffic only from the public subnet. Option B is wrong because Internet Gateway is for public subnets. Option C is wrong because it allows outbound. Option E is wrong because Network ACLs are stateless and would need rules for both directions.

Answer

Attach an Internet Gateway to the VPC and add a route to it in the private subnet route table.

Answer

Attach a NAT Gateway to the private subnet and add a route to it.

Answer

Configure the private subnet Network ACL to allow outbound traffic to 0.0.0.0/0.

Question 14

A company has a multi-account AWS environment using AWS Organizations. The security team wants to centrally manage VPC security group rules across all accounts. Which AWS service should they use?

Accepted Answer

AWS Firewall Manager. AWS Firewall Manager can centrally configure and manage security group rules across accounts. Option A is correct. Option B is for network firewall management. Option C is for configuration compliance. Option D is for DNS firewalling.

Answer

AWS Network Firewall

Answer

AWS Config

Answer

Amazon Route 53 Resolver DNS Firewall

Question 15

A security engineer is designing a multi-account strategy using AWS Organizations. The engineer needs to centrally manage network security across all accounts. Which TWO AWS services are most appropriate for this task?

Accepted Answer

AWS Firewall Manager. Option B (AWS Network Firewall) is correct for centrally managing firewall rules. Option D (AWS Firewall Manager) is correct for centrally managing firewall policies across accounts. Option A (Amazon GuardDuty) is threat detection. Option C (AWS WAF) is web application firewall but not for network-level security. Option E (VPC Peering) is a connectivity option, not a management service.

Answer

VPC Peering

Answer

AWS WAF

Answer

Amazon GuardDuty

Question 16

A security engineer is designing a VPC with public and private subnets. The company requires that all outbound traffic from private subnets to the internet must go through a single IP address for whitelisting by third-party services. Which TWO actions should the engineer take?

Accepted Answer

Deploy a NAT Gateway in a public subnet and assign an Elastic IP.. A NAT Gateway in a public subnet with an Elastic IP allows private instances to access the internet using a single IP. Route tables for private subnets must point default route (0.0.0.0/0) to the NAT Gateway.

Answer

Use a VPC Peering connection to a central VPC with an Internet Gateway.

Answer

Deploy a NAT Gateway in a private subnet.

Answer

Configure the private subnet route table with a default route to an Internet Gateway.

Question 17

Which TWO AWS services can be used to centrally manage permissions across multiple AWS accounts?

Accepted Answer

AWS Single Sign-On. AWS Organizations allows policy-based management. AWS SSO provides single sign-on and permission sets. Option C is a single account service. Option D is for resource compliance. Option E is for web application firewall.

Answer

AWS Config

Answer

AWS WAF

Answer

AWS Identity and Access Management (IAM)

Question 18

An organization wants to use AWS Organizations to centrally manage permissions for multiple accounts. Which IAM feature is used to grant cross-account access within the organization?

Accepted Answer

IAM roles. AWS Organizations allows you to use service control policies (SCPs) to centrally control permissions, but for actual cross-account access, IAM roles are still used. Option B is correct because IAM roles allow users in one account to assume a role in another account. Option A is wrong because SCPs are for permission boundaries, not direct access. Option C is wrong because resource-based policies are for specific services, not general cross-account access. Option D is wrong because IAM groups are within a single account.

Answer

Service control policies (SCPs)

Answer

Resource-based policies

Answer

IAM groups

Question 19

A developer needs to allow an EC2 instance to access an S3 bucket. Which is the best practice for granting permissions?

Accepted Answer

Create an IAM role with S3 access and attach it to the EC2 instance profile.. Option B is correct because an IAM role attached to the EC2 instance provides temporary credentials via the instance metadata service, avoiding long-term keys. Option A is wrong because storing keys on the instance is insecure. Option C is wrong because a bucket policy granting access to the instance ID is not a valid principal. Option D is wrong because security groups do not grant IAM permissions.

Answer

Store IAM user access keys in a configuration file on the EC2 instance.

Answer

Use a security group to allow the EC2 instance to access S3.

Answer

Attach an S3 bucket policy that grants access to the EC2 instance ID.

Question 20

A company is designing a security group for a web application that must receive HTTPS traffic from the internet and send traffic to a backend database. The backend database is an Amazon RDS MySQL instance. What is the best practice for configuring the security groups?

Accepted Answer

Web server SG: inbound HTTPS from 0.0.0.0/0. Database SG: inbound MySQL from web server SG.. Option D is correct because the web server security group should allow inbound HTTPS from 0.0.0.0/0, and the database security group should allow inbound MySQL traffic only from the web server security group. Option A is wrong because using the CIDR of the web server is less flexible. Option B is wrong because allowing all traffic is insecure. Option C is wrong because the web server should not allow inbound MySQL.

Answer

Web server SG: inbound HTTPS from 0.0.0.0/0, outbound to database SG on port 3306. Database SG: inbound MySQL from web server CIDR block.

Answer

Web server SG: inbound HTTPS from 0.0.0.0/0, outbound all traffic. Database SG: inbound MySQL from 0.0.0.0/0.

Answer

Web server SG: inbound HTTPS from 0.0.0.0/0, inbound MySQL from database SG. Database SG: outbound MySQL to web server SG.