SCS-C02 Practice Exam 56 — 20 Questions

Question 1

A company has multiple AWS accounts managed through AWS Organizations. The security team needs to ensure that no EC2 instances are launched without an approved Amazon Machine Image (AMI). Which governance control should be implemented?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a service control policy (SCP) that denies ec2:RunInstances unless the AMI ID is in an approved list.. A service control policy (SCP) is the correct governance control because it operates at the AWS Organizations level, allowing the security team to enforce a deny on ec2:RunInstances across all member accounts unless the AMI ID matches an approved list. SCPs are account permission boundaries that cannot be overridden by IAM policies within the account, ensuring that no user or role can launch an EC2 instance with an unapproved AMI, even if they have full administrative privileges. This provides a preventive control that blocks non-compliant actions before they occur, which is more robust than detective or reactive measures.

Answer

Deploy an AWS Config rule that triggers a Lambda function to terminate non-compliant instances.

Answer

Use AWS CloudTrail to monitor instance launches and alert the security team.

Answer

Use an IAM policy that restricts ec2:RunInstances to approved AMIs.

Question 2

A security engineer is troubleshooting connectivity issues from an EC2 instance in a private subnet to an S3 bucket. The instance has a security group allowing outbound HTTPS (443) to 0.0.0.0/0, and the subnet's network ACL allows outbound HTTPS to 0.0.0.0/0. However, requests to S3 are timing out. Which additional configuration is most likely required?

Accepted Answer

Add a VPC Gateway Endpoint for S3 and update the route table. An EC2 instance in a private subnet has no route to the internet, so it cannot reach S3's public endpoints even though the security group and NACL allow outbound HTTPS. The correct fix is to create a VPC Gateway Endpoint for S3 and add a route in the subnet's route table pointing S3 traffic to the endpoint. This keeps traffic on the AWS private network and avoids the need for a NAT gateway.

Answer

Attach an IAM role to the EC2 instance with S3 permissions

Answer

Modify the security group to allow traffic to the S3 region-specific IP range

Answer

Configure a TLS termination proxy

Question 3

A company stores data in Amazon S3 and wants to ensure that objects are encrypted at rest. The security team decides to use server-side encryption with AWS KMS (SSE-KMS). Which additional benefit does SSE-KMS provide over SSE-S3?

Accepted Answer

Separate permissions for key usage and audit of key usage. SSE-KMS provides separate permissions for key usage and allows auditing of key usage via AWS CloudTrail. Option A is incorrect because both SSE-S3 and SSE-KMS use the same AES-256 encryption algorithm for encryption and decryption. Option B is incorrect because SSE-KMS incurs additional costs for KMS API calls, making it more expensive per object than SSE-S3. Option D is incorrect because both options use the same strong encryption algorithm (AES-256).

Answer

Faster encryption and decryption

Answer

Lower cost per object

Answer

Stronger encryption algorithm

Question 4

A security engineer needs to audit all access to a KMS customer managed key. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records every API call made to KMS, including Encrypt, Decrypt, GenerateDataKey, CreateKey, and key policy changes, capturing the caller identity, source IP, timestamp, and request parameters. This makes CloudTrail the authoritative service for auditing KMS key usage and access.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Question 5

A security engineer needs to ensure that all data in transit between an Application Load Balancer (ALB) and EC2 instances is encrypted. What configuration is required?

Accepted Answer

Configure the target group to use HTTPS protocol.. Encryption in transit between an ALB and its targets is controlled by the target group protocol, not the listener. Setting the target group to HTTPS makes the ALB initiate TLS connections to the EC2 instances, encrypting the backend leg. The listener protocol only governs the client-to-ALB leg.

Answer

Configure the security group to allow traffic on port 443.

Answer

Configure the ALB listener with HTTPS protocol.

Answer

Configure the ALB to terminate TLS connections.

Question 6

A company uses Amazon GuardDuty and AWS Security Hub. The security team has configured a custom insight in Security Hub to track findings related to S3 bucket exposures. They want to automatically remediate these findings by applying an S3 bucket policy that blocks public access. The team has created a Lambda function that applies the bucket policy and configured Security Hub to send findings to the Lambda function via a custom action. However, when a new finding is generated, the Lambda function is invoked but fails to apply the policy because it does not have permission to modify the S3 bucket. The Lambda function's execution role has permissions to modify S3 bucket policies, but the function is in the same account as the bucket. What should the team check?

Accepted Answer

Check the S3 bucket policy for any explicit deny statements that might block the Lambda function's role.. The Lambda function's execution role already has IAM permissions to modify S3 bucket policies, and it operates in the same account as the bucket, so cross-account trust is not the issue. An explicit Deny statement in the S3 bucket policy overrides any Allow granted by IAM policies, including the Lambda role's permissions. Therefore, the team must inspect the bucket policy for explicit denies that block the role from calling PutBucketPolicy. This is the only remaining cause consistent with the symptoms.

Answer

Add the Lambda function's execution role to the bucket's Access Control List (ACL).

Answer

Ensure that the Lambda function's execution role has a trust policy that allows Security Hub to assume it.

Answer

Verify that the S3 bucket's block public access settings are not preventing the policy update.

Question 7

A security team needs to analyze historical CloudTrail logs across multiple AWS accounts to detect patterns of suspicious activity. Which solution provides the MOST cost-effective and scalable analysis?

Accepted Answer

Aggregate logs into a central S3 bucket and query with Amazon Athena. Aggregating CloudTrail logs into a central S3 bucket and querying with Amazon Athena is the most cost-effective and scalable solution because Athena uses a serverless, pay-per-query model with no infrastructure to manage, and it can directly analyze large volumes of structured log data stored in S3 using standard SQL. This approach avoids the cost of provisioning and maintaining dedicated clusters (as with Redshift or Elasticsearch) and avoids the per-GB ingestion and storage fees of CloudWatch Logs Insights, making it ideal for historical analysis across multiple accounts.

Answer

Stream logs to Amazon Elasticsearch Service and use Kibana

Answer

Load logs into Amazon Redshift for analysis

Answer

Use Amazon CloudWatch Logs Insights across all accounts

Question 8

A security engineer is troubleshooting an issue where CloudTrail logs for a single AWS account are not being delivered to the centralized S3 bucket in the logging account. The engineer has verified that the CloudTrail trail is enabled, the S3 bucket policy allows CloudTrail to write, and the bucket exists. However, no log files have been delivered for the past 6 hours. The engineer checks the CloudTrail console and sees that the trail status shows 'Logging' but the latest log file time is from 8 hours ago. The engineer suspects a permission issue but cannot find any explicit deny in the bucket policy. What is the MOST likely cause of this issue?

Accepted Answer

The KMS key policy used by the S3 bucket does not grant CloudTrail permission to use the key.. If the S3 bucket is encrypted with SSE-KMS, CloudTrail must have permission to use the KMS key to encrypt the logs. If the KMS key policy does not grant CloudTrail the necessary permissions (kms:GenerateDataKey and kms:Decrypt), CloudTrail cannot write logs, even if the S3 bucket policy allows it. The trail status may still show 'Logging' because the trail is enabled, but delivery fails silently. This is the most likely cause given the symptoms.

Answer

The CloudTrail trail is not configured to deliver to a cross-account bucket.

Answer

The CloudTrail trail is configured with a role that does not have S3 full access.

Answer

The S3 bucket is in a different region than the CloudTrail trail.

Question 9

A security team notices that an IAM user has permissions to launch EC2 instances but should not have access to certain instance types. Which IAM policy condition key should be used to restrict this?

Accepted Answer

ec2:InstanceType. The ec2:InstanceType condition key allows you to restrict IAM users to launching only specific EC2 instance types (e.g., t2.micro, m5.large) by evaluating the instance type value in the RunInstances API call. This is the correct key to enforce a policy that denies access to certain instance types while permitting others.

Answer

ec2:ResourceTag

Answer

ec2:Tenancy

Answer

ec2:InstanceProfile

Question 10

A company wants to log all API calls made in their AWS account for auditing. Which AWS service should be enabled to capture these logs?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls made in an AWS account, including the identity, time, source IP, and request details, which is exactly what is needed for auditing. Enabling CloudTrail captures management and, optionally, data events across services. This makes it the correct service for logging all API calls.

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Answer

Amazon S3 server access logs

Question 11

Refer to the exhibit. A security engineer is troubleshooting a decryption failure. The command uses the AWS CLI to decrypt a file. The decryption fails with an 'AccessDeniedException' error. The IAM user has the following policy attached:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "kms:Decrypt",
      "Resource": "*"
    }
  ]
}

What is the most likely cause of the failure?

Accepted Answer

The KMS key policy does not grant the IAM user decrypt permission. KMS decryption requires permission from BOTH the IAM identity-based policy AND the KMS key policy. Even though the IAM policy grants kms:Decrypt on '*', the key policy must also explicitly allow the IAM user (or their account with the right conditions) to use the key. If the key policy does not grant access, the request fails with AccessDeniedException regardless of the IAM policy.

Answer

The IAM user does not have permission to call kms:Decrypt on the specific key

Answer

The ciphertext blob is not valid

Answer

The IAM user is not authorized to use the AWS CLI

Question 12

A company uses AWS KMS to encrypt data in Amazon RDS. The security team needs to ensure that the KMS key cannot be deleted accidentally. Which action should be taken?

Accepted Answer

Add a statement to the key policy that denies the kms:ScheduleKeyDeletion action.. A key policy statement that explicitly denies kms:ScheduleKeyDeletion prevents any principal from scheduling the key for deletion, which is the strongest guard against accidental deletion. Explicit deny in a key policy overrides any allow, so even administrators cannot schedule deletion.

Answer

Create an alias for the key.

Answer

Enable automatic key rotation.

Answer

Use a multi-Region key.

Question 13

An organization has a VPC with public and private subnets. A NAT Gateway is deployed in a public subnet to allow instances in private subnets to access the internet. The security team notices that instances in a private subnet can reach the internet, but cannot initiate connections to an on-premises network connected via AWS Direct Connect. The on-premises network advertises a specific route. What is the most likely cause?

Accepted Answer

The private subnet route table has a route for the on-premises CIDR pointing to the NAT Gateway.. The most likely cause is that the private subnet's route table has a route for the on-premises CIDR pointing to the NAT Gateway instead of the Direct Connect virtual private gateway (VGW) or transit gateway. A NAT Gateway only translates traffic to the internet — it cannot forward traffic to on-premises networks, so the route is misdirected and the connection fails.

Answer

The security group assigned to the instances does not allow outbound traffic to the on-premises network.

Answer

The network ACL on the private subnet is blocking inbound traffic from the on-premises network.

Answer

The internet gateway is not attached to the VPC.

Question 14

A security auditor needs to view a list of all IAM users, including their last activity timestamps, for a compliance review. Which AWS service provides this information natively?

Accepted Answer

AWS IAM credential report. The AWS IAM credential report is a native feature that generates a CSV containing all IAM users, their access keys, password status, MFA status, and key rotation dates including last activity timestamps. It is specifically designed for auditing user credentials and activity, making it the correct choice for a compliance review of last activity.

Answer

AWS CloudTrail

Answer

IAM Access Analyzer

Answer

AWS Config

Question 15

A company uses an AWS Network Firewall to inspect traffic between subnets in a VPC. The security team wants to ensure that all traffic from the web tier to the database tier passes through the firewall. The web servers are in subnet A, and the database servers are in subnet B. What routing configuration is required?

Accepted Answer

Add a route in the route table for subnet A with destination subnet B CIDR and target the firewall endpoint. Add a similar route in subnet B's route table with destination subnet A CIDR and target the firewall endpoint.. AWS Network Firewall is a stateful, managed firewall that inspects traffic only when that traffic is explicitly routed to its firewall endpoint. To inspect east-west traffic between subnet A (web tier) and subnet B (database tier), both directions must be routed through the firewall endpoint. This means adding a route in subnet A's route table for the destination subnet B CIDR pointing to the firewall endpoint, and a reciprocal route in subnet B's route table for the destination subnet A CIDR pointing to the firewall endpoint. This ensures that traffic from A to B and B to A is symmetrically inspected, which is required for stateful inspection to work correctly.

Answer

Add a route in the route table associated with subnet A that sends all traffic to the firewall endpoint.

Answer

Add a route in the route table associated with subnet B that sends all traffic to the firewall endpoint.

Answer

Associate both subnets with the same route table and add a route to the firewall endpoint for all traffic.

Question 16

A company uses an IAM role to allow an EC2 instance to access an S3 bucket. The instance is launched in a VPC with a VPC endpoint for S3. The IAM role has a policy that grants s3:GetObject on the bucket. However, the application on the instance receives 'Access Denied' errors when trying to read objects. What is the MOST likely cause?

Accepted Answer

The VPC endpoint policy for S3 does not allow the required action.. When an EC2 instance accesses S3 through a VPC endpoint (gateway endpoint), both the IAM role policy and the VPC endpoint policy must allow the action. The default endpoint policy allows all, but if a custom policy restricts actions or resources, s3:GetObject can be denied even though the IAM role grants it. This is the most likely cause of the Access Denied error.

Answer

The EC2 instance does not have an encryption key to decrypt the objects.

Answer

The S3 bucket policy does not explicitly allow the IAM role.

Answer

The IAM role is not attached to the EC2 instance profile.

Question 17

A company wants to grant temporary credentials to mobile app users to access their own data in an S3 bucket. Which AWS service should be used to achieve this securely?

Accepted Answer

Amazon Cognito identity pools. Cognito Identity Pools can issue temporary AWS credentials for authenticated users. Option B is wrong because IAM users are not suitable for millions of mobile users. Option C is wrong because KMS is for encryption keys. Option D is wrong because CloudFront is a CDN, not for issuing credentials.

Answer

AWS Key Management Service (KMS)

Answer

IAM users with long-term access keys

Answer

Amazon CloudFront signed URLs

Question 18

A company hosts a web application on EC2 instances behind an Application Load Balancer. The application accesses an S3 bucket to store user uploads. The security team needs to ensure that the EC2 instances can access the S3 bucket without storing AWS credentials on the instances. What should the security team do?

Accepted Answer

Create an IAM role with an S3 access policy and attach it to the EC2 instance profile.. An IAM instance profile with an IAM role grants temporary credentials to EC2 instances. Option A is wrong because storing credentials on instances is insecure. Option B is wrong because it's not a best practice. Option D is wrong because security groups do not grant access to S3.

Answer

Create an IAM user with programmatic access and use those credentials in the application.

Answer

Configure a security group that allows outbound traffic to the S3 bucket.

Answer

Store AWS access keys in a configuration file on the EC2 instances.

Question 19

A security engineer is designing a solution to enforce that all S3 buckets in an AWS account have server-side encryption enabled. The engineer needs to automatically remediate any non-compliant buckets. Which AWS service should be used to implement this requirement?

Accepted Answer

AWS Config with managed rules and auto-remediation. AWS Config continuously evaluates resource configurations against rules, and managed rules such as s3-bucket-server-side-encryption-enabled detect non-compliant buckets; Config remediation actions can then invoke SSM Automation documents or Lambda to automatically re-enable encryption. This provides both detection and automatic remediation in a single managed service, which is exactly what the requirement asks for.

Answer

AWS Lambda with S3 events

Answer

AWS IAM policy to deny PutBucketEncryption without encryption

Answer

AWS CloudTrail

Question 20

A company needs to protect data at rest on Amazon EBS volumes attached to EC2 instances. Which solution provides the most control over the encryption keys?

Accepted Answer

Use a customer managed KMS key with EBS encryption.. A customer managed KMS key gives the account owner full control over the key policy, rotation, grants, and deletion, which is the maximum control available for EBS encryption at rest. AWS managed keys (aws/ebs) are controlled by AWS and cannot be customized or have their policies modified by the customer. Enabling EBS encryption by default only sets a default key but does not by itself provide the most control. Client-side encryption is a different layer and does not address EBS-native encryption key control.

Answer

Encrypt data using client-side encryption before writing to EBS.

Answer

Use an AWS managed KMS key for EBS encryption.

Answer

Enable EBS encryption by default in the account.