SCS-C02 Practice Exam 57 — 20 Questions

Question 1

A company uses AWS Systems Manager Session Manager to manage EC2 instances. The security team wants to ensure that all SSH sessions are logged and that commands are recorded. What should be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable session logging in the Session Manager preferences to send logs to Amazon S3 and CloudWatch Logs. Session Manager preferences allow logging session activity to Amazon S3 and CloudWatch Logs, which records all commands run during SSH sessions. Option B is incorrect because security groups control network access, not logging. Option C is incorrect because CloudTrail logs API calls to Systems Manager, not the commands executed within a session. Option D is incorrect because an IAM policy only controls permissions to start sessions, not the logging of session activity.

Answer

Configure the security group to allow inbound SSH from the Session Manager service

Answer

Enable AWS CloudTrail to log Systems Manager API calls

Answer

Create an IAM policy that allows ssm:StartSession and attach it to the instance role

Question 2

A company has multiple AWS accounts and wants to allow a user in the production account to assume a role in the development account. The role in the development account has a trust policy that allows the production account to assume it. What additional configuration is required?

Accepted Answer

Attach a policy to the user in the production account allowing sts:AssumeRole for the development role ARN.. The user in the production account must have an IAM policy that allows sts:AssumeRole targeting the development account role ARN. Option B is wrong because the trust policy is already set. Option C is wrong because the role must be created in the development account. Option D is wrong because the trust policy should reference the production account.

Answer

Modify the trust policy of the role in the development account to allow the user ARN instead of the account ARN.

Answer

Set up a VPC peering connection between the accounts.

Answer

Create a new IAM user in the development account with the same name.

Question 3

Which TWO AWS services can be used to enforce that specific resource types (e.g., EC2 instances) are tagged with a 'CostCenter' tag? (Choose two.)

Accepted Answer

AWS Organizations tag policies. AWS Config can evaluate resource tagging and AWS Organizations can use tag policies. IAM is for permissions, not enforcement; CloudFormation can be used but not for existing resources; Service Catalog is for provisioning, not enforcement.

Answer

AWS Service Catalog

Answer

AWS CloudFormation

Answer

AWS IAM

Question 4

A company is using AWS Organizations and wants to delegate the administration of certain accounts to different teams. For example, the finance team should be able to manage billing-related accounts, but not development accounts. Which AWS feature allows this type of delegation?

Accepted Answer

AWS Organizations delegated administrator. AWS Organizations delegated administrator allows a member account to be designated as the administrator for a specific AWS service (e.g., AWS Billing, AWS CloudFormation StackSets, AWS Config) across the organization. This enables the finance team's account to manage billing-related accounts without granting them full management over development accounts. It is the only feature that provides service-specific administrative delegation within Organizations.

Answer

AWS IAM Identity Center (AWS SSO)

Answer

Service control policies (SCPs)

Answer

IAM roles in each account

Question 5

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to download patches from the internet. Which combination of components provides a highly available, managed solution? (Select TWO.)

Accepted Answer

Add a route to the private subnet's route table pointing 0.0.0.0/0 to the NAT gateway.. A NAT gateway enables outbound internet access for instances in a private subnet while preventing inbound connections from the internet. It is a managed AWS service that automatically scales and is highly available within a single Availability Zone. By adding a route for 0.0.0.0/0 to the NAT gateway in the private subnet's route table, traffic destined for the internet is forwarded to the NAT gateway, which then uses an internet gateway to reach the internet.

Answer

Launch a NAT instance in a public subnet.

Answer

Create a VPC endpoint for Amazon S3.

Answer

Attach an internet gateway to the VPC.

Question 6

A company has an Amazon S3 bucket with versioning enabled. They want to ensure that all objects in the bucket are encrypted at rest using server-side encryption with AWS KMS (SSE-KMS). They also want to prevent any future uploads that are not encrypted with SSE-KMS. Which combination of actions should they take?

Accepted Answer

Add a bucket policy that denies s3:PutObject if s3:x-amz-server-side-encryption is not aws:kms. Use S3 Inventory to report encryption status of existing objects.. A bucket policy denying PutObject without SSE-KMS prevents non-compliant uploads, and S3 Inventory reports encryption status. Option B only checks compliance, does not enforce. Option C does not enforce encryption. Option D does not enforce.

Answer

Use AWS Config rule s3-bucket-server-side-encryption-enabled to check compliance.

Answer

Use S3 Object Lock with governance mode.

Answer

Enable default encryption with SSE-KMS on the bucket. Use S3 Inventory to report encryption status.

Question 7

A security engineer runs the command shown in the exhibit. What is the primary purpose of this command?

Accepted Answer

To encrypt the contents of secret.txt using a KMS key and store the result in encrypted_secret.txt.. The command shown in the exhibit is 'aws kms encrypt --key-id <key-id> --plaintext fileb://secret.txt --output text --query CiphertextBlob | base64 --decode > encrypted_secret.txt'. This command uses the AWS KMS Encrypt API to encrypt the contents of secret.txt with the specified KMS key, then decodes the base64-encoded ciphertext and writes it to encrypted_secret.txt. Therefore, the primary purpose is to encrypt the file contents using a KMS key and store the result in encrypted_secret.txt.

Answer

To generate a data key without plaintext.

Answer

To re-encrypt an existing encrypted file under a new key.

Answer

To decrypt the file secret.txt using a KMS key.

Question 8

A developer needs to access AWS resources from a mobile app. Which AWS service allows the app to obtain temporary credentials for authenticated users?

Accepted Answer

Amazon Cognito identity pools (federated identities). Amazon Cognito identity pools (federated identities) are specifically designed to provide temporary, scoped AWS credentials to authenticated and unauthenticated users. The identity pool exchanges a token from an identity provider (such as a Cognito user pool, social provider, or SAML) for temporary AWS credentials via AWS Security Token Service (STS). This allows mobile apps to directly access AWS services like S3 or DynamoDB without embedding long-term credentials.

Answer

Amazon Cognito user pools

Answer

AWS IAM Identity Center (AWS SSO)

Answer

AWS Key Management Service (AWS KMS)

Question 9

A company runs a multi-tier web application on AWS. The application consists of an Application Load Balancer (ALB), a fleet of EC2 instances in an Auto Scaling group, and an RDS MySQL database. The security team wants to monitor for SQL injection attempts. They have enabled AWS WAF on the ALB and are logging all requests. The security engineer needs to analyze the WAF logs to identify if any SQL injection attacks have been attempted. The logs are stored in an S3 bucket. The engineer needs to query the logs for patterns like 'SELECT * FROM' or 'DROP TABLE' in the URI. Which service should the engineer use to perform this analysis?

Accepted Answer

Amazon Athena. Amazon Athena is a serverless interactive query service that can query data directly from S3 using standard SQL, making it ideal for analyzing WAF logs stored in S3. The engineer can run SQL queries with LIKE clauses to search for patterns like 'SELECT * FROM' or 'DROP TABLE' in the URI field. Athena integrates natively with S3 and requires no infrastructure management.

Answer

Amazon Kinesis Data Analytics

Answer

Amazon QuickSight

Answer

CloudWatch Logs Insights

Question 10

A security engineer notices that an IAM role in the production account is being assumed by a user from another AWS account, which violates the principle of least privilege. The role's trust policy allows the root user of the external account. What is the MOST secure way to restrict access to only a specific user in the external account?

Accepted Answer

Modify the trust policy to specify the exact user ARN instead of the root ARN.. Modifying the trust policy to include the specific user ARN is the most direct and secure approach. Option A is incorrect because SCPs do not affect cross-account access. Option B is incorrect because IAM policies on the role do not restrict who can assume it. Option D is incorrect because the external account's IAM policies do not control trust.

Answer

Apply an SCP to the external account to deny the sts:AssumeRole action.

Answer

Create an IAM policy in the external account that denies sts:AssumeRole for the role.

Answer

Add a condition to the role's permissions policy requiring a specific source IP.

Question 11

A company stores sensitive data in Amazon S3 and requires that objects are automatically encrypted using server-side encryption with AWS KMS. The bucket policy must deny any PUT request that does not include the x-amz-server-side-encryption header with value aws:kms. Which bucket policy condition key should be used?

Accepted Answer

s3:x-amz-server-side-encryption. The condition key s3:x-amz-server-side-encryption can be used to check the header value. Condition key aws:SourceIp is for source IP; aws:RequestedRegion is for region; kms:EncryptionContext is for KMS encryption context. Option A is correct.

Answer

aws:SourceIp

Answer

aws:RequestedRegion

Answer

kms:EncryptionContext

Question 12

A company uses AWS KMS to encrypt data in Amazon S3. They need to audit all KMS key usage for an S3 bucket. Which AWS service should be used to capture KMS Decrypt API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail captures API calls to AWS services, including KMS Decrypt. CloudTrail logs can be delivered to S3 for analysis. Option C is correct. CloudWatch Logs can receive logs but does not directly capture KMS API calls; S3 server access logs do not include KMS decryption events; VPC Flow Logs capture network traffic, not API calls.

Answer

Amazon S3 server access logs

Answer

Amazon VPC Flow Logs

Answer

AWS CloudWatch Logs

Question 13

A company uses AWS IAM Identity Center (SSO) for managing access to multiple AWS accounts. A user reports that they can log in to the SSO portal but cannot see any AWS accounts in their dashboard. What is the most likely cause?

Accepted Answer

The user has not been assigned to any AWS accounts in IAM Identity Center.. In IAM Identity Center, users see AWS accounts in their portal only if they have been assigned to those accounts via account assignments (which link a user/group, a permission set, and an AWS account). If no account assignments exist, the user can authenticate successfully but will see an empty dashboard. This is the most common cause of the reported symptom.

Answer

The user's identity source (e.g., Active Directory) is not synchronized correctly.

Answer

The user's session token has expired.

Answer

The permission set assigned to the user does not grant any permissions.

Question 14

Which TWO actions should a security engineer take to ensure that an S3 bucket is not publicly accessible? (Choose two.)

Accepted Answer

Enable S3 Block Public Access at the account level. Block Public Access settings at bucket and account level prevent all public access. The other options are not correct because: ACLs can allow public access; CloudTrail does not block; Bucket policies are overridden by Block Public Access.

Answer

Enable AWS CloudTrail for the bucket

Answer

Remove all bucket ACLs

Answer

Set a bucket policy that denies all public access

Question 15

A company wants to run a security assessment that checks for vulnerabilities in an EC2 instance. Which AWS service should be used?

Accepted Answer

Amazon Inspector. Amazon Inspector automatically assesses EC2 instances for vulnerabilities and network exposure.

Answer

AWS WAF

Answer

Amazon GuardDuty

Answer

AWS Shield Advanced

Question 16

A company uses AWS CloudTrail and wants to ensure that all log files are encrypted at rest using a customer-managed AWS KMS key. The CloudTrail trail is configured to use a KMS key, but some log files appear to be encrypted with the default Amazon S3 managed key (SSE-S3). What is the most likely cause?

Accepted Answer

The KMS key policy does not grant CloudTrail permission to use the key.. The most likely cause is that the KMS key policy does not grant CloudTrail the necessary permissions to use the key for encryption. When a CloudTrail trail is configured with a customer-managed KMS key, the key policy must include a statement that allows the CloudTrail service principal (cloudtrail.amazonaws.com) to perform the kms:GenerateDataKey and kms:Decrypt actions. Without these permissions, CloudTrail falls back to encrypting log files with the default Amazon S3 managed key (SSE-S3), resulting in some logs appearing encrypted with SSE-S3 instead of SSE-KMS.

Answer

The CloudTrail trail is configured to use SSE-S3 instead of SSE-KMS.

Answer

The KMS key is in a different AWS region than the S3 bucket.

Answer

The S3 bucket has default encryption set to SSE-S3.

Question 17

A company uses AWS Organizations with multiple accounts. The security team wants to automatically receive alerts when an IAM user attempts to access resources they do not have permissions for, across all accounts. Which combination of services should be used?

Accepted Answer

Amazon GuardDuty and AWS Security Hub. Amazon GuardDuty continuously monitors for suspicious activity, including unauthorized API calls or failed access attempts, across all accounts in an AWS Organization. Security Hub aggregates these findings from GuardDuty and other services, enabling automated alerts via integrations like Amazon SNS or AWS Chatbot. Together, they provide a centralized, cross-account threat detection and alerting solution that meets the requirement of notifying the security team when IAM users attempt unauthorized resource access.

Answer

Amazon Inspector and AWS Lambda

Answer

AWS Config and Amazon SNS

Answer

AWS CloudTrail and Amazon CloudWatch Logs

Question 18

A security engineer is designing a secure VPC architecture. Which THREE components should be used to implement defense in depth? (Choose three.)

Accepted Answer

Security groups. Security groups (C) are stateful virtual firewalls that control inbound and outbound traffic at the instance level. They operate at the network interface (ENI) level, allowing only explicitly permitted traffic and automatically allowing return traffic for permitted sessions. This provides a critical layer of host-level defense within the VPC.

Answer

VPN connection

Answer

Internet gateway

Question 19

A company's security policy requires that all S3 buckets be encrypted at rest. An security engineer needs to detect any S3 bucket that does not have default encryption enabled. Which AWS service should the engineer use to continuously monitor and alert on non-compliant buckets?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides continuous monitoring and evaluation of your AWS resource configurations against desired policies. You can create an AWS Config rule, such as the managed rule 's3-bucket-default-encryption-enabled', which automatically checks each S3 bucket for the presence of default encryption (SSE-S3 or SSE-KMS) and triggers an alert or remediation action for any non-compliant bucket. This aligns directly with the requirement to detect and alert on buckets lacking encryption at rest.

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Question 20

A company is using AWS CloudFormation to deploy infrastructure. Which method ensures that sensitive data, such as database passwords, is not exposed in the template or outputs?

Accepted Answer

Use a dynamic reference to a Systems Manager Parameter Store parameter.. Using a dynamic reference to an AWS Systems Manager Parameter Store parameter allows CloudFormation to retrieve the password at stack creation time without embedding it in the template or exposing it in outputs. The password is stored securely in Parameter Store, and CloudFormation resolves the reference dynamically, ensuring the sensitive value never appears in plaintext in the template, stack events, or outputs.

Answer

Use the 'NoEcho' property on the password parameter.

Answer

Store the password in the template outputs.

Answer

Hardcode the password in the template and use the 'NoEcho' property.