SCS-C02 Practice Exam 55 — 20 Questions

Question 1

A security engineer is investigating a potential security incident involving an EC2 instance that was used to launch an outbound DDoS attack. The engineer needs to determine the source of the attack and the commands executed on the instance. Which logs should be analyzed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

EC2 instance OS logs (e.g., /var/log/secure) and CloudTrail logs for API calls that launched the instance. The EC2 instance's OS logs (e.g., auditd logs, bash history) contain the exact commands executed and user authentication events, which are essential for identifying the source and actions of the attacker. CloudTrail logs for API calls that launched the instance provide the identity of the principal (IAM user/role), source IP, and the time the instance was created, linking the instance to the initiating entity. Together, these logs allow the engineer to trace both the operational commands on the instance and the administrative actions that created it.

Answer

VPC Flow Logs and Network ACL logs

Answer

S3 server access logs and CloudWatch Logs

Answer

AWS CloudTrail and AWS Config history

Question 2

A company has enabled AWS CloudTrail in all accounts and regions, with log file validation enabled. The security team needs to verify that a specific log file has not been modified since it was delivered. Which action should be taken?

Accepted Answer

Use the AWS CLI `validate-logs` command with the digest file from the S3 bucket.. CloudTrail log file validation creates a hash of each log file and stores it in a digest file. To verify that a specific log file has not been altered since delivery, you must use the AWS CLI `validate-logs` command, which compares the hash in the digest file against the current hash of the log file. This command also validates the digital signature of the digest file itself, ensuring end-to-end integrity.

Answer

Query the log files using Amazon CloudWatch Logs Insights.

Answer

Enable S3 server-side encryption with AWS KMS (SSE-KMS) on the CloudTrail bucket.

Answer

Enable S3 Object Lock on the bucket to prevent modifications.

Question 3

A company is designing a hybrid cloud architecture with an AWS Direct Connect connection. The company wants to ensure that traffic to and from the VPC goes through the Direct Connect connection and not over the internet. Which configuration should be used?

Accepted Answer

Attach a Virtual Private Gateway to the VPC and update the route tables to point to the Direct Connect virtual interface.. A Virtual Private Gateway (VGW) is the AWS-side anchor for an AWS Direct Connect private virtual interface (VIF). By attaching the VGW to the VPC and updating the VPC route tables to point the destination CIDR (e.g., the on-premises network) to the Direct Connect VIF, all traffic between the VPC and the on-premises network is forced through the Direct Connect link, bypassing the internet entirely.

Answer

Create a VPC Endpoint for each AWS service.

Answer

Set up a VPN connection over the internet as a backup.

Answer

Configure the Direct Connect connection and assign public IPs to instances.

Question 4

A company uses AWS CloudTrail to log API activity across multiple accounts. The security team wants to ensure that any S3 bucket created with public read access is detected within minutes. Which solution is MOST efficient?

Accepted Answer

Create an Amazon EventBridge rule that matches CloudTrail CreateBucket API calls and triggers a Lambda function that inspects the bucket's public access settings and alerts if public.. It uses an Amazon EventBridge rule to capture the CloudTrail `CreateBucket` API call in near real-time, then triggers a Lambda function to immediately inspect the bucket's public access settings. This approach detects public buckets within minutes without polling or batch processing, making it the most efficient solution for the stated requirement.

Answer

Use AWS Config rules to check S3 bucket public access settings and trigger an AWS Lambda function to send alerts.

Answer

Use S3 server access logs and run a daily script to parse the logs for PutBucketAcl actions.

Answer

Enable CloudTrail log file validation and use Athena to query logs hourly for CreateBucket events with public ACLs.

Question 5

A security engineer needs to monitor AWS account activity for suspicious API calls and receive alerts. Which AWS service should the engineer use to meet this requirement?

Accepted Answer

AWS CloudTrail with CloudWatch Alarms. AWS CloudTrail records all API calls made to the AWS environment, providing a detailed audit trail of account activity. By sending these logs to Amazon CloudWatch, you can create metric filters that match suspicious API call patterns and trigger CloudWatch Alarms to send notifications via SNS. This combination directly meets the requirement to monitor and alert on specific API calls.

Answer

VPC Flow Logs

Answer

AWS Config with AWS Config Rules

Answer

Amazon GuardDuty

Question 6

A company uses AWS CloudTrail to log all management events and data events for S3. The security team wants to detect any PutObject API calls that upload objects with server-side encryption disabled. Which solution is MOST efficient?

Accepted Answer

Enable CloudTrail data events for S3 and create a CloudWatch metric filter to alert on PutObject calls without the x-amz-server-side-encryption header.. CloudTrail data events for S3 capture PutObject API calls, including request parameters. A CloudWatch metric filter can be configured to match PutObject events that lack the 'x-amz-server-side-encryption' header, indicating the object was uploaded without server-side encryption. This approach is efficient as it uses existing logging infrastructure without additional scanning or parsing overhead.

Answer

Use Amazon GuardDuty to detect unencrypted uploads.

Answer

Use Amazon Macie to scan S3 objects for missing encryption.

Answer

Enable S3 server access logs and parse them with Amazon Athena.

Question 7

A security engineer needs to ensure that all data stored in an Amazon S3 bucket is encrypted at rest. The bucket must use server-side encryption with a key managed by the customer (SSE-C). What must the engineer include in the PUT request to enforce this?

Accepted Answer

x-amz-server-side-encryption-customer-algorithm and x-amz-server-side-encryption-customer-key. SSE-C requires the client to provide both the encryption algorithm and the encryption key in the PUT request headers. The `x-amz-server-side-encryption-customer-algorithm` header must be set to `AES256`, and the `x-amz-server-side-encryption-customer-key` header must contain the base64-encoded 256-bit key. Without these headers, S3 will not apply customer-provided encryption keys, and the object will not be encrypted with SSE-C.

Answer

x-amz-server-side-encryption: AES256

Answer

x-amz-server-side-encryption: aws:kms

Answer

x-amz-server-side-encryption-bucket-key-enabled: true

Question 8

A company's security team is investigating a potential security incident. They have enabled CloudTrail and CloudWatch Logs. They want to receive real-time alerts when an IAM user creates a new access key. Which combination of services should be used to achieve this?

Accepted Answer

CloudTrail with CloudWatch Logs, metric filter, alarm, and SNS topic. CloudTrail logs API calls like CreateAccessKey to CloudWatch Logs. A metric filter on the event name 'CreateAccessKey' triggers a CloudWatch alarm that publishes to an SNS topic, enabling real-time notifications. This is the standard AWS architecture for real-time alerting on specific IAM actions.

Answer

AWS Config rules with an SNS topic

Answer

Amazon GuardDuty with an SNS topic

Answer

CloudTrail with Lambda function invocation

Question 9

A security engineer is configuring automated response to a GuardDuty finding of type 'UnauthorizedAccess:EC2/SSHBruteForce'. The engineer needs to isolate the compromised instance by modifying the security group to deny all inbound traffic. Which AWS service should be used to orchestrate this response?

Accepted Answer

AWS Systems Manager Automation. AWS Systems Manager Automation is the correct service because it provides a pre-built runbook, AWS-IsolateInstanceEC2, specifically designed to isolate an EC2 instance by modifying its security group to deny all inbound traffic. This runbook can be triggered directly by a CloudWatch Events rule that matches the GuardDuty finding, enabling fully automated incident response without custom code. Systems Manager Automation also supports cross-account and cross-region execution, making it suitable for enterprise-scale response orchestration.

Answer

AWS Lambda

Answer

AWS CloudFormation

Answer

AWS Config

Question 10

A security engineer needs to restrict outbound traffic from a VPC to only allow HTTPS traffic to specific domains (e.g., api.example.com). The VPC has a NAT gateway in a public subnet. What is the most secure way to implement this restriction?

Accepted Answer

Deploy an AWS Network Firewall in the VPC and configure domain filtering rules.. AWS Network Firewall provides stateful, application-layer inspection that can filter outbound HTTPS traffic based on domain names (SNI/TLS hostnames), not just IP addresses. This allows you to restrict traffic to specific domains like api.example.com even if their IP addresses change, which is more secure and manageable than IP-based rules. Security groups and network ACLs cannot filter by domain name, and VPC endpoints are for specific AWS services, not general HTTPS domains.

Answer

Configure security group egress rules to allow HTTPS to 0.0.0.0/0.

Answer

Configure network ACL outbound rules to allow HTTPS to the IP addresses of the allowed domains.

Answer

Create a VPC endpoint for Amazon S3 and route traffic through it.

Question 11

A security engineer is investigating a potential security incident involving an EC2 instance that was used to launch an outbound DDoS attack. The engineer needs to determine the source of the attack and the commands executed on the instance. Which logs should be analyzed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The AWS Region where the API call was made.. CloudTrail logs capture management-plane API calls, including the AWS Region where the call was made (via the 'awsRegion' field). VPC Flow Logs only capture network-level metadata (IP addresses, ports, protocols) and have no visibility into the AWS Region of an API call because they operate at Layer 3/4 of the OSI model and do not log control-plane events. Therefore, the Region information is uniquely available in CloudTrail.

Answer

The payload of the API request.

Answer

The destination IP address and port of the network traffic.

Question 12

A company needs to securely store database credentials used by a Lambda function. The credentials must be automatically rotated. Which service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is specifically designed to securely store, manage, and automatically rotate database credentials and other secrets throughout their lifecycle. It natively supports automatic rotation for Amazon RDS, Redshift, and DocumentDB databases without requiring custom code, and it integrates directly with Lambda via the AWS SDK to retrieve secrets on demand.

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Key Management Service (KMS)

Answer

AWS Systems Manager Parameter Store

Question 13

An AWS Lambda function needs to read from a DynamoDB table. What is the best practice for granting the Lambda function the necessary permissions?

Accepted Answer

Create an IAM role with the necessary permissions and attach it as the Lambda function's execution role.. The best practice for granting a Lambda function permissions to DynamoDB is to create an IAM role with the necessary permissions and attach it as the function's execution role. Lambda assumes this role at runtime, and the AWS SDK automatically uses temporary credentials from the role, eliminating the need to manage long-term keys. This follows the principle of least privilege and avoids embedding secrets.

Answer

Use a resource-based policy on the DynamoDB table to allow the Lambda function.

Answer

Create an IAM user with the necessary permissions and assign it to the Lambda function.

Answer

Embed the IAM user's access key and secret key in the Lambda function code.

Question 14

A company is using Amazon GuardDuty to detect threats. They notice that GuardDuty is generating a high volume of 'UnauthorizedAccess:EC2/SSHBruteForce' findings from an internal EC2 instance that is used for vulnerability scanning. The security team wants to reduce false positives without disabling GuardDuty entirely. What should they do?

Accepted Answer

Create a suppression rule for findings originating from the vulnerability scanner's IP address.. Amazon GuardDuty's suppression rules allow you to filter out findings based on criteria such as IP address, without disabling the detector or any finding types. By creating a suppression rule that matches the vulnerability scanner's IP address, you automatically archive and suppress future 'UnauthorizedAccess:EC2/SSHBruteForce' findings from that specific source, reducing false positives while maintaining full threat detection coverage for all other instances.

Answer

Change the security group of the vulnerability scanner to block SSH traffic.

Answer

Disable GuardDuty for the subnet where the vulnerability scanner is located.

Answer

Disable the 'UnauthorizedAccess:EC2/SSHBruteForce' finding type in GuardDuty.

Question 15

A company has a VPC with public and private subnets. The private sub host Amazon RDS instances. To allow the RDS instances to access the internet for software updates without exposing them to inbound internet traffic, what should be configured?

Accepted Answer

Create a NAT gateway in a public subnet and add a route to the NAT gateway in the private subnet route table.. A NAT gateway in a public subnet allows instances in private subnets to initiate outbound traffic to the internet (e.g., for software updates) while preventing any unsolicited inbound connections from the internet. Adding a route in the private subnet's route table that points 0.0.0.0/0 to the NAT gateway enables this outbound-only internet access for the RDS instances.

Answer

Use a VPN connection to an on-premises network that has internet access.

Answer

Set up a VPC peering connection to a VPC with internet access.

Answer

Attach an internet gateway to the private subnet route table.

Question 16

A company is designing a network architecture for a critical application that must be highly available and secure. Which TWO actions should be taken to ensure high availability of the network infrastructure?

Accepted Answer

Deploy resources across multiple Availability Zones.. Deploying resources across multiple Availability Zones (AZs) ensures that if one AZ experiences a failure (e.g., power outage, network disruption), the application can continue serving traffic from another AZ. This is the foundational principle of high availability in AWS, as each AZ is isolated but connected via low-latency links, allowing for fault tolerance without single points of failure.

Answer

Use a single internet gateway for the VPC.

Answer

Use a single Availability Zone for all resources to reduce complexity.

Answer

Place all instances in a public subnet for easy access.

Question 17

A security engineer needs to ensure that all traffic to an EC2 instance in a VPC is inspected by a network firewall appliance. The firewall is deployed in a separate subnet. What is the MOST secure and scalable way to route traffic through the firewall?

Accepted Answer

Use a Gateway Load Balancer with a Gateway Load Balancer endpoint in each subnet.. A Gateway Load Balancer (GWLB) with a Gateway Load Balancer endpoint in each subnet provides transparent, scalable, and highly available traffic inspection. GWLB operates at Layer 3 (IP packets) and uses GENEVE encapsulation to forward traffic to the firewall appliance without modifying the source/destination IP addresses, ensuring all traffic to the EC2 instance is inspected. This architecture scales horizontally by adding more firewall instances behind the GWLB and avoids single points of failure.

Answer

Configure a NAT gateway in the firewall subnet and route all traffic through it.

Answer

Use an Application Load Balancer in front of the firewall.

Answer

Create a transit gateway and route traffic through the firewall subnet.

Question 18

A company has an Amazon S3 bucket that stores sensitive data. The security team needs to ensure that all access to the bucket is encrypted in transit. Which condition should be added to the bucket policy?

Accepted Answer

aws:SecureTransport. The `aws:SecureTransport` condition key in an S3 bucket policy enforces that all requests to the bucket must be made over HTTPS (TLS). When set to `false`, any HTTP request is denied, ensuring data is encrypted in transit. This directly addresses the security team's requirement to encrypt all access to the bucket during transmission.

Answer

aws:SourceIp

Answer

s3:x-amz-server-side-encryption

Answer

aws:UserAgent

Question 19

A security engineer is configuring a security group for a web server that should only accept HTTPS traffic from the internet. Which inbound rule should be set?

Accepted Answer

TCP port 443 from 0.0.0.0/0. HTTPS uses TCP port 443, so an inbound security group rule allowing TCP 443 from 0.0.0.0/0 permits HTTPS traffic from any internet source. This is the standard configuration for a public web server that must accept secure web traffic. Security groups are stateful, so return traffic is automatically allowed without an outbound rule.

Answer

TCP port 3389 from 0.0.0.0/0

Answer

TCP port 22 from 0.0.0.0/0

Answer

TCP port 80 from 0.0.0.0/0

Question 20

Which THREE AWS services can be used to authenticate users for accessing AWS resources?

Accepted Answer

AWS Single Sign-On. AWS Single Sign-On (SSO) is a service that centrally manages access to multiple AWS accounts and business applications, authenticating users via an external identity provider (IdP) such as Microsoft Active Directory or Okta. It allows users to sign in once and gain federated access to assigned AWS resources, making it a valid authentication service for AWS resource access.

Answer

AWS Secrets Manager

Answer

AWS CloudTrail