SCS-C02 Practice Exam 54 — 20 Questions

Question 1

A security engineer is analyzing a potential security incident involving an Amazon RDS for MySQL database. The engineer suspects that a SQL injection attack was successful. Which AWS service can the engineer use to review the actual SQL queries that were executed against the database?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon RDS Audit Logs. Amazon RDS for MySQL supports audit logs that capture detailed records of database activities, including the actual SQL queries executed. By enabling the `audit_log` plugin and configuring the `server_audit_events` parameter, the engineer can review the exact SQL statements that were run, which is essential for identifying a SQL injection attack. This is the only AWS service that provides query-level visibility into RDS database operations.

Answer

VPC Flow Logs

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Question 2

A security engineer is tasked with ensuring that all S3 buckets in an AWS account have versioning enabled. The engineer needs to identify buckets that do not have versioning enabled. Which AWS service is BEST suited for this task?

Accepted Answer

AWS Config. AWS Config is the best-suited service because it continuously evaluates resource configurations against desired rules. You can use the managed rule 's3-bucket-versioning-enabled' to identify buckets that do not have versioning enabled, and AWS Config will flag them as non-compliant. This provides an automated, scalable way to audit all buckets in an account.

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Answer

IAM Access Analyzer

Question 3

A company has a single AWS account with multiple IAM users. The administrator created an IAM policy that allows all users to launch EC2 instances, but only if they use a specific AMI ID (ami-12345678) and a specific instance type (t3.micro). The policy uses a condition that checks the EC2 instance type and AMI ID. However, a user is able to launch an EC2 instance with a different AMI ID and a larger instance type. The administrator reviews the policy and confirms that the condition is correctly written. What is the most likely reason that the policy is not working as expected?

Accepted Answer

The policy does not include an explicit deny statement for non-compliant launches.. The most likely reason is that the user has another IAM policy attached (e.g., a managed policy or group policy) that allows ec2:RunInstances without the condition. IAM evaluates all policies; if any allow statement grants the action, the action is permitted unless explicitly denied. The conditional allow only restricts when that specific statement is used, but a separate unconditional allow overrides the condition. Adding an explicit deny for non-compliant launches would block them regardless of other policies.

Answer

The condition keys used (ec2:InstanceType and ec2:ImageId) are not supported for the RunInstances action in IAM policies.

Answer

The policy is attached to the user but must also be attached to the IAM group.

Answer

The condition is written incorrectly; it should use StringLike instead of StringEquals.

Question 4

A company has a requirement to detect and alert on S3 objects that contain personally identifiable information (PII) being shared publicly. Which AWS service should be used?

Accepted Answer

Amazon Macie. Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover, classify, and protect sensitive data such as personally identifiable information (PII) stored in Amazon S3. It can automatically generate alerts when S3 objects containing PII are made publicly accessible, meeting the requirement to detect and alert on such events.

Answer

Amazon CloudWatch

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Question 5

A startup is building a web application on AWS. They have an Application Load Balancer (ALB) in front of EC2 instances in an Auto Scaling group. They want to protect the application from common web exploits like SQL injection and cross-site scripting. They also need to allow only traffic from certain geographic regions. Which AWS service should they use to achieve these requirements?

Accepted Answer

AWS WAF. AWS WAF is a web application firewall that protects against common web exploits like SQL injection and cross-site scripting. It also allows you to create geo-match conditions to allow or block traffic based on geographic regions, meeting both requirements.

Answer

AWS Shield Advanced

Answer

Security groups on the ALB

Answer

Network ACLs on the ALB subnets

Question 6

A company's security team discovers that an IAM role has been assumed from an unexpected external AWS account. Which AWS service can be used to analyze the trust policy and identify unintended access?

Accepted Answer

AWS IAM Access Analyzer. AWS IAM Access Analyzer analyzes resource-based policies, including IAM role trust policies, to identify resources shared with external entities. It can detect when a role's trust policy allows an unexpected external AWS account to assume it, providing findings that highlight unintended access.

Answer

AWS CloudTrail Insights

Answer

AWS Config

Answer

AWS Security Hub

Question 7

During an incident response, a security engineer needs to capture a forensic image of an EC2 instance's root volume for analysis. The instance is running and cannot be stopped. What is the recommended approach to capture the volume without stopping the instance?

Accepted Answer

Create a snapshot while the volume is attached to the instance.. The correct approach is to create a snapshot of the EBS root volume while it is still attached to the running instance (Option C). Snapshots can be taken of in-use volumes without stopping the instance, providing a point-in-time copy for forensic analysis. Option B is incorrect because you cannot detach the root volume of a running instance without first stopping it, which contradicts the requirement not to stop the instance.

Answer

Use the dd command via AWS Systems Manager to create a raw image and store it in S3.

Answer

Detach the volume from the instance, create a snapshot, and then attach it to a forensic analysis instance.

Answer

Use AWS Systems Manager to run a command that copies the volume content to S3.

Question 8

Refer to the exhibit. A user named John encrypts a file using the AWS CLI. John then tries to decrypt the file but receives an AccessDenied error. John has full administrator permissions in IAM. What is the most likely cause?

Accepted Answer

The KMS key policy does not grant John the kms:Decrypt permission.. The most likely cause is that the KMS key policy does not grant John the kms:Decrypt permission. Even though John has full administrator permissions in IAM, KMS key policies are resource-based policies that must explicitly allow the principal to use the key. If the key policy does not grant John decrypt permissions, access is denied.

Answer

The ciphertext blob is malformed because it was not base64-decoded before decryption.

Answer

John's IAM policy denies the kms:Decrypt action.

Answer

The key ID used for encryption is different from the key used for decryption.

Question 9

A company has a multi-account AWS Organization with 50 accounts. The security team uses AWS CloudTrail to log all API calls and sends the logs to a central S3 bucket in the security account. The team wants to ensure that any attempt to disable CloudTrail logging or delete the trail is detected and automatically remediated within 5 minutes. They have configured an AWS Config rule that triggers an AWS Lambda function when the CloudTrail configuration changes. However, the Lambda function is not being invoked when they test by stopping the trail. The Lambda function's IAM role has permissions to start and update CloudTrail. CloudTrail logs show that the Config rule is evaluating the resource, but the Lambda function is not triggered. What is the most likely cause?

Accepted Answer

The AWS Config service does not have permission to invoke the Lambda function.. AWS Config uses a service-linked role or a configured IAM role to invoke the Lambda function as the remediation action. If the Config service does not have permission to invoke the Lambda function — typically because the Lambda function's resource-based policy does not grant config.amazonaws.com the lambda:InvokeFunction permission, or the Config service role lacks the necessary trust — the rule will evaluate the resource but the remediation action will silently fail to trigger the Lambda. The question states the Lambda role already has CloudTrail permissions, so the missing link is Config's ability to invoke Lambda.

Answer

The S3 bucket policy does not allow CloudTrail to write logs.

Answer

The Lambda function's IAM role does not have permission to modify CloudTrail.

Answer

The CloudTrail trail does not have permission to send logs to the S3 bucket.

Question 10

During an incident response, a security engineer needs to collect memory forensics from a running EC2 instance without shutting it down. The instance is running Amazon Linux 2. Which tool is MOST appropriate?

Accepted Answer

LiME (Linux Memory Extractor). LiME (Linux Memory Extractor) is the most appropriate tool for capturing volatile memory from a running Amazon Linux 2 EC2 instance without shutting it down. It is specifically designed to dump RAM contents to a file or over a network, minimizing the footprint on the target system and ensuring the integrity of the forensic acquisition.

Answer

tcpdump

Answer

Volatility

Answer

dd command to capture /dev/mem

Question 11

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all CloudTrail trails are enabled and logging to a central S3 bucket. They need to detect any account that disables or modifies its CloudTrail trail. Which approach meets these requirements with the least operational overhead?

Accepted Answer

Use AWS Config rules with an aggregator in the management account to evaluate CloudTrail configuration across all accounts.. AWS Config rules with an aggregator in the management account can evaluate CloudTrail configuration across all accounts in AWS Organizations without deploying per-account resources. The aggregator collects configuration snapshots and changes from member accounts, allowing a single managed rule (e.g., cloud-trail-enabled) to detect when a trail is disabled or modified. This approach minimizes operational overhead because it uses native AWS services with no custom code or cross-account IAM roles to manage.

Answer

Enable CloudTrail Insights in all accounts to detect unusual activity.

Answer

Enable IAM Access Analyzer in each account to monitor CloudTrail changes.

Answer

Create a Lambda function that periodically checks CloudTrail status in each account via the API.

Question 12

Your company has a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The security team enabled AWS CloudTrail and Amazon GuardDuty. GuardDuty generates a finding 'Recon:EC2/PortProbeUnprotectedPort' for an EC2 instance that does not exist in the account. Upon investigation, you realize that the finding is triggered by a misconfigured Network Load Balancer (NLB) that is exposing a port to the internet. The NLB is used by the API Gateway. You need to reduce false positives for this specific finding. What should you do?

Accepted Answer

Create a suppression rule in GuardDuty to filter out findings for the NLB's public IP and port.. GuardDuty suppression rules allow you to filter out findings that are known false positives based on specific criteria, such as the public IP and port of the NLB. Since the NLB is intentionally exposing a port for API Gateway, the port probe finding is expected behavior, not a real threat. Suppressing findings for that specific combination reduces noise without disabling GuardDuty for the entire account.

Answer

Change the NLB to an Application Load Balancer.

Answer

Enable AWS Shield Advanced to block the probes.

Answer

Disable GuardDuty for the account.

Question 13

A security engineer applies the above S3 bucket policy. An application tries to upload an object with the header "x-amz-server-side-encryption: AES256". What will happen?

Accepted Answer

The upload fails because the encryption header does not match 'aws:kms'.. The bucket policy explicitly requires the condition that the encryption header equals 'aws:kms', which enforces SSE-KMS. When the application sends 'x-amz-server-side-encryption: AES256' (which requests SSE-S3), the request does not satisfy the policy condition, so S3 denies the upload with an AccessDenied error. The policy's condition is a hard gate, not a preference.

Answer

The upload succeeds because the policy allows SSE-S3.

Answer

The upload succeeds because the object is encrypted.

Answer

The upload fails because the header is missing.

Question 14

A security engineer reviews the trust policy of an IAM role. Which accounts can assume this role?

Accepted Answer

Account 111111111111. The trust policy of the IAM role specifies a principal of "111111111111" as the trusted entity. This means only accounts explicitly listed in the Principal element can assume the role. Since the policy does not include account 123456789012 or allow any AWS account, only account 111111111111 is authorized to assume the role.

Answer

Only the root user of account 123456789012

Answer

Account 123456789012

Answer

Any AWS account

Question 15

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that no IAM user in any account can create access keys. Which policy type should be used to enforce this restriction across all accounts?

Accepted Answer

Service Control Policy (SCP). Service Control Policies (SCPs) in AWS Organizations define the maximum permissions for all IAM principals in member accounts. An SCP that denies the iam:CreateAccessKey action applied at the organization or OU level prevents any IAM user in any account from creating access keys, regardless of their identity-based policies. This is the correct mechanism for enforcing restrictions across all accounts.

Answer

IAM identity-based policy

Answer

Resource-based policy

Answer

Permissions boundary

Question 16

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The ALB is configured to terminate SSL/TLS and forward traffic to the instances over HTTP. The security team wants to ensure that the instances only accept traffic from the ALB, not from any other source. How can this be achieved?

Accepted Answer

Configure the instance security group to allow HTTP traffic only from the ALB's security group.. Referencing the ALB's security group in the instance security group rule allows traffic only from the ALB, regardless of the ALB's IP address changes. This leverages AWS security group referencing, which is a managed and scalable way to restrict traffic to a specific source security group. The ALB's security group acts as a logical identifier, ensuring that only traffic forwarded by the ALB reaches the instances.

Answer

Configure the instance security group to allow HTTP traffic only from the VPC CIDR block.

Answer

Configure the network ACL on the instance's subnet to allow HTTP traffic only from the ALB's private IP address.

Answer

Configure the instance security group to allow HTTP traffic only from the subnet CIDR block where the ALB resides.

Question 17

A security engineer is reviewing AWS CloudTrail logs and finds that an IAM user 'developer1' deleted an S3 bucket. The engineer needs to determine the source IP address of the delete operation. Which field in the CloudTrail log record contains this information?

Accepted Answer

sourceIPAddress. The `sourceIPAddress` field in a CloudTrail log record captures the IP address from which the API call was made. For S3 bucket deletion via the AWS Management Console, AWS CLI, or SDK, this field records the originating IP address, enabling the security engineer to trace the delete operation back to its source.

Answer

userIdentity

Answer

requestParameters

Answer

eventTime

Question 18

A company uses AWS CloudTrail to log all API calls. During an incident investigation, the security team needs to identify who deleted an S3 bucket. CloudTrail logs are stored in a centralized S3 bucket with server-side encryption using AWS KMS. Which additional step is required to ensure the CloudTrail logs can be queried quickly for this investigation?

Accepted Answer

Use Amazon Athena with a table defined over the S3 bucket. Amazon Athena allows you to query CloudTrail logs directly in S3 using standard SQL without needing to move or transform the data. Since the logs are already in a centralized S3 bucket, defining a table over that location enables fast, ad-hoc queries to identify the specific DeleteBucket event, including who performed it and when. This approach is cost-effective and avoids additional streaming or storage costs.

Answer

Enable CloudTrail Lake

Answer

Stream logs to CloudWatch Logs and use CloudWatch Logs Insights

Answer

Enable Amazon GuardDuty

Question 19

A company wants to monitor for suspicious IAM activity, such as a user creating access keys without authorization. Which THREE AWS services can be used together to detect and alert on this activity in real-time? (Choose THREE.)

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is correct because it can ingest and monitor log data from AWS CloudTrail in real-time. By creating a CloudWatch Logs metric filter on CloudTrail logs for events like CreateAccessKey, you can trigger an alarm that sends notifications via SNS when unauthorized access key creation occurs. This enables real-time detection and alerting for suspicious IAM activity.

Answer

Amazon Inspector

Answer

AWS Trusted Advisor

Question 20

A security engineer needs to analyze large volumes of VPC Flow Logs stored in Amazon S3 to identify anomalous traffic patterns. Which approach is MOST cost-effective and scalable?

Accepted Answer

Use Amazon Athena with partitioned data in S3.. Amazon Athena is the most cost-effective and scalable solution for querying large volumes of VPC Flow Logs stored in S3 because it uses a serverless, pay-per-query model with no infrastructure to manage. By partitioning the data (e.g., by date or region), Athena minimizes the amount of data scanned per query, directly reducing costs while enabling complex SQL-based analysis for anomaly detection.

Answer

Use AWS Glue to catalog and query the logs.

Answer

Download the logs to an EC2 instance and use grep commands.

Answer

Use Amazon QuickSight to directly query the logs.