SCS-C02 Practice Exam 58 — 20 Questions

Question 1

A company uses AWS Organizations and wants to centralize security logs from all member accounts into a single S3 bucket in the management account. The bucket policy allows only the management account's root user to write objects. However, logs are not being delivered from member accounts. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The bucket policy denies write access to all principals except the management account's root user, preventing cross-account writes.. The bucket policy explicitly restricts write access to only the management account's root user. For cross-account log delivery from member accounts, the policy must grant write permissions to the logging service (e.g., AWS CloudTrail or AWS Config) in each member account. Without such permissions, the service cannot write objects to the bucket, causing log delivery to fail.

Answer

S3 Transfer Acceleration is not enabled.

Answer

VPC endpoints are not configured for the logging service.

Answer

The S3 bucket uses an AWS KMS key, and the key policy does not grant decrypt permissions to the logging service.

Question 2

A company needs to ensure that its S3 buckets are not publicly accessible. Which TWO AWS services can be used to detect and report on public S3 buckets? (Choose two.)

Accepted Answer

AWS Trusted Advisor. AWS Trusted Advisor (option B) checks S3 bucket permissions and reports any bucket that has open access policies, including public read or write access. AWS Config (option C) can evaluate S3 bucket policies against custom or managed rules (e.g., s3-bucket-public-read-prohibited, s3-bucket-public-write-prohibited) to detect noncompliant buckets and trigger remediation. Both services provide detection and reporting capabilities for public S3 buckets.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

Amazon Inspector

Question 3

Which TWO actions should a security engineer take to ensure that CloudTrail logs are protected from unauthorized deletion? (Choose two.)

Accepted Answer

Attach an S3 bucket policy that denies s3:DeleteObject to all principals except the CloudTrail service principal.. Attaching an S3 bucket policy that denies s3:DeleteObject to all principals except the CloudTrail service principal prevents any user or role (including root) from deleting log files, while still allowing CloudTrail to write logs. This ensures that even if an attacker gains administrative access, they cannot delete the logs, preserving their integrity for forensic analysis.

Answer

Enable S3 versioning on the log bucket.

Answer

Enable S3 default encryption with SSE-S3.

Answer

Configure CloudTrail to send logs to CloudWatch Logs.

Question 4

A company wants to block traffic from a specific IP address range from accessing an Application Load Balancer (ALB). Which AWS feature should be used?

Accepted Answer

AWS WAF. AWS WAF is the correct feature to block traffic from a specific IP address range from accessing an Application Load Balancer. WAF integrates directly with ALB and allows you to create rules based on IP addresses, which can be used to allow or block requests. Network ACLs and security groups operate at the network layer and are not specific to ALB traffic inspection.

Answer

Network ACL

Answer

Security Group for the ALB

Answer

Route53

Question 5

Refer to the exhibit. After invoking the Lambda function, why are there no log streams in the log group?

Accepted Answer

The Lambda function's execution role lacks permissions to write to CloudWatch Logs.. Lambda writes logs to CloudWatch Logs using the permissions granted to its execution role. If that role lacks the required actions (logs:CreateLogGroup, logs:CreateLogStream, logs:PutLogEvents), the function still executes but the log writes are silently denied, so no log streams appear in the log group. This is the classic cause of an empty log group after a successful invocation.

Answer

The CloudWatch Logs log group retention policy is set to 0 days.

Answer

The Lambda function is not configured with a CloudWatch Logs log group.

Answer

The Lambda function timed out before writing logs.

Question 6

Which TWO of the following are valid AWS IAM security best practices?

Accepted Answer

Implement a strong password policy for IAM users.. Option A is correct because implementing a strong IAM account password policy enforces complexity requirements such as minimum length, uppercase/lowercase, numbers, symbols, and rotation, which reduces the risk of brute-force and credential-guessing attacks against IAM user sign-ins. Option D is correct because enabling MFA for privileged users adds a second authentication factor, so a compromised password alone is insufficient to perform sensitive actions, which is a core AWS IAM best practice. Option B is not a best practice because IAM access keys are long-term credentials tied to a specific identity and must never be shared; sharing them breaks accountability and complicates rotation and revocation. Option C is not correct as stated because AWS recommends disabling (deactivating) credentials and removing permissions before deleting users, and deletion should be done only when the identity is truly no longer needed. Option E is not a best practice because the root user has unrestricted access and should be used only for the few tasks that require it, with MFA enabled and access keys removed.

Answer

Share IAM user access keys among team members for convenience.

Answer

Delete IAM users instead of disabling them when not needed.

Answer

Use the AWS account root user for everyday administrative tasks.

Question 7

A company uses AWS Systems Manager Patch Manager to apply patches to EC2 instances. The security team wants to ensure that instances are patched within 7 days of a patch release. Which service should be used to monitor and report compliance?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides continuous monitoring and evaluation of your AWS resource configurations, including patch compliance status via Systems Manager Patch Manager. You can create an AWS Config rule (e.g., 'ec2-managedinstance-patch-compliance-status') that checks whether instances have the required patches installed within a specified time frame (e.g., 7 days). AWS Config then reports noncompliant resources, enabling the security team to track and remediate patching gaps.

Answer

AWS Security Hub

Answer

Amazon Inspector

Answer

AWS Trusted Advisor

Question 8

A company needs to enforce encryption in transit for all traffic between an Amazon EC2 instance and an Amazon RDS database. Which TWO steps should be taken?

Accepted Answer

Enable TLS on the RDS database and configure the database to require encrypted connections.. Option A is correct because enforcing encryption in transit for RDS requires enabling TLS on the DB instance and setting the parameter group so the database requires SSL/TLS connections (for example, MySQL's require_secure_transport or PostgreSQL's rds.force_ssl), which rejects unencrypted client sessions. Option E is correct because the client side must actually negotiate TLS: the application on the EC2 instance has to connect using SSL/TLS, typically by supplying the RDS CA certificate (rds-ca-rsa2048-g1 or similar) and using the appropriate driver parameters such as sslmode=require for PostgreSQL or ssl-mode=REQUIRED for MySQL. Option B is not correct because security groups only control network reachability on ports 3306/5432 and do not provide or enforce encryption. Option C is not correct because a VPN encrypts traffic at the network layer between networks but is not the mechanism used to enforce TLS between an EC2 instance and an RDS endpoint, and RDS TLS is the supported approach. Option D is not correct because encryption at rest protects stored data via KMS and does not address data in transit between the EC2 instance and the database.

Answer

Configure security groups to allow traffic only on port 3306 (MySQL) or 5432 (PostgreSQL).

Answer

Set up a VPN connection between the EC2 instance and the RDS database.

Answer

Enable encryption at rest on the RDS instance.

Question 9

A security engineer needs to ensure that all objects uploaded to an S3 bucket are automatically scanned for malware before being made accessible to users. Which solution is MOST appropriate?

Accepted Answer

Use S3 event notifications to invoke an AWS Lambda function that runs a malware scanning solution.. S3 event notifications can be configured to trigger an AWS Lambda function upon object creation, allowing the Lambda function to run a malware scanning solution (e.g., using ClamAV or an AWS Marketplace partner) before the object is made accessible. This serverless approach ensures automated, near-real-time scanning without manual intervention, and the Lambda function can quarantine or delete malicious objects by adjusting S3 bucket policies or object ACLs.

Answer

Enable VPC Flow Logs to capture all access to the bucket.

Answer

Enable S3 Object Lock on the bucket.

Answer

Configure Amazon CloudWatch Logs to monitor S3 access logs.

Question 10

A company wants to ensure that data at rest in Amazon EBS volumes is encrypted. What is the simplest way to achieve this?

Accepted Answer

Enable EBS encryption by default in the AWS account.. The simplest way to ensure that data at rest in Amazon EBS volumes is encrypted is to enable EBS encryption by default in the AWS account. This setting automatically encrypts all new EBS volumes created in the account, using the default KMS key for EBS encryption. It eliminates the need to manually encrypt each volume or attach custom KMS keys. Other methods are more manual and do not provide the same level of automation.

Answer

Use AWS KMS to create a custom key and attach it to each volume.

Answer

Encrypt each volume manually using the AWS Management Console.

Answer

Use an operating system-level encryption tool like LUKS.

Question 11

A security engineer is investigating a potential compromise of an EC2 instance. The engineer wants to capture memory and disk forensics without shutting down the instance. Which service should the engineer use?

Accepted Answer

AWS Systems Manager. AWS Systems Manager (SSM) is the correct service because it provides the capability to perform forensic data collection on a running EC2 instance without shutting it down. Specifically, SSM Automation documents like AWS-RunShellScript or AWS-GatherEC2InstanceInfo can execute commands to capture memory (e.g., using LiME or fmem) and disk forensics (e.g., dd or volume snapshots) via the SSM Agent, which runs as a system service and does not require instance termination.

Answer

AWS Config

Answer

EC2 Instance Connect

Answer

Amazon CloudWatch Logs

Question 12

A financial services company must ensure that all data at rest in Amazon RDS for PostgreSQL is encrypted. The current database is unencrypted. What is the MOST operationally efficient way to enable encryption?

Accepted Answer

Take a snapshot of the database, copy the snapshot with encryption enabled, and restore the encrypted snapshot to a new DB instance.. The most operationally efficient way to enable encryption on an existing unencrypted RDS for PostgreSQL database is to take a snapshot, copy the snapshot with encryption enabled, and restore it to a new encrypted DB instance. This method leverages RDS's native snapshot and restore capabilities, minimizing manual intervention and downtime. Other methods like exporting and importing data are more complex and time-consuming, and encryption cannot be enabled directly on an existing instance.

Answer

Export the database to S3 using pg_dump, then import into a new encrypted RDS instance.

Answer

Create a read replica with encryption enabled and promote it to primary.

Answer

Enable encryption directly on the existing RDS instance by modifying the DB instance settings.

Question 13

An organization wants to detect and alert on the use of root user credentials in their AWS accounts. They have multiple accounts managed via AWS Organizations. What is the most efficient way to centralize this monitoring?

Accepted Answer

Enable Amazon GuardDuty in the management account and use the delegated administrator feature.. Amazon GuardDuty, when enabled in the management account with a delegated administrator, can centrally monitor and detect suspicious activity—including root user credential usage—across all member accounts in AWS Organizations. This approach eliminates the need to configure per-account monitoring and provides a single pane of glass for security alerts, making it the most efficient centralized solution.

Answer

Create an AWS CloudTrail trail in each account and aggregate logs to a central S3 bucket.

Answer

Use IAM Access Analyzer to find resources shared with external entities.

Answer

Use AWS Config rules to detect root user usage in each account.

Question 14

A company is designing a VPC for a three-tier web application that must be accessible from the internet only via HTTPS. The web servers must be able to initiate outbound connections to the internet for software updates, but the database servers must have no direct internet access. Which architecture meets these requirements?

Accepted Answer

Web servers in private subnets with a route to a NAT Gateway, database servers in private subnets with no route to the NAT Gateway, both behind an Application Load Balancer in public subnets. Web servers in private subnets behind an Application Load Balancer (ALB) in public subnets can receive internet traffic via the ALB, and they can initiate outbound internet connections via a NAT Gateway. Database servers in private subnets with no route to the NAT Gateway have no internet access, meeting the requirement. This architecture isolates the database tier while allowing web tier outbound updates.

Answer

Web servers in private subnets, database servers in public subnets, both behind an Application Load Balancer

Answer

Web servers in public subnets, database servers in private subnets with a route to a NAT Gateway in a public subnet

Answer

Web servers in public subnets with Elastic IPs, database servers in private subnets with a route to an internet gateway

Question 15

An administrator needs to grant an IAM user the ability to change their own password without allowing them to change other users' passwords. Which IAM action should be included in the policy?

Accepted Answer

iam:ChangePassword. The IAM action iam:ChangePassword allows a user to change their own password, but only if the policy is attached to that user and the request is for their own password. It does not grant permission to change other users' passwords. This is the correct action for self-service password change.

Answer

iam:CreateLoginProfile

Answer

iam:UpdateAccountPasswordPolicy

Answer

iam:UpdateServiceSpecificCredential

Question 16

A company uses AWS Secrets Manager to store database credentials. The security team needs to ensure that secrets are automatically rotated every 30 days. The rotation function must be implemented with minimal operational overhead. Which approach should be used?

Accepted Answer

Enable automatic rotation in Secrets Manager and configure the rotation interval to 30 days. AWS Secrets Manager has native, built-in rotation support that requires only enabling rotation and specifying a rotation interval and a Lambda rotation function (AWS provides templates for RDS, Redshift, DocumentDB, etc.). Setting the interval to 30 days satisfies the requirement with the least operational overhead because Secrets Manager manages the schedule, invokes the Lambda, and updates the secret version automatically.

Answer

Create an Amazon EventBridge rule that triggers a Lambda function to rotate the secret

Answer

Use AWS CLI to schedule a cron job that runs every 30 days and rotates the secret

Answer

Use Amazon CloudWatch Events to invoke an AWS Lambda function that updates the secret

Question 17

A company has a requirement to grant cross-account access to an S3 bucket named 'shared-data' in Account A (111111111111) to users in Account B (222222222222). The security team has set up a bucket policy in Account A that grants read-only access to the IAM role 'DataReader' in Account B. The bucket policy is as follows: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::222222222222:role/DataReader"},"Action":["s3:GetObject"],"Resource":"arn:aws:s3:::shared-data/*"}]}. A user in Account B assumes the 'DataReader' role, but when trying to read an object from the bucket, they receive an 'Access Denied' error. What is the MOST likely reason for this error?

Accepted Answer

The IAM role 'DataReader' does not have an IAM policy that allows s3:GetObject on the bucket.. The most likely reason for the Access Denied error is that the IAM role 'DataReader' in Account B does not have an IAM policy that allows s3:GetObject on the bucket. For cross-account access, both the bucket policy in Account A and the IAM policy in Account B must grant the necessary permissions. The bucket policy alone is not sufficient; the role must also have an identity-based policy allowing the action.

Answer

The bucket policy principal must be the IAM user ARN, not the role ARN.

Answer

The bucket policy is missing the 's3:ListBucket' action, which is required to read objects.

Answer

The bucket objects are encrypted with a KMS key, and the role does not have permission to decrypt.

Question 18

A company uses AWS CloudHSM to generate and store encryption keys for a custom application. The security team needs to ensure high availability and durability of the keys. Which architecture should be recommended?

Accepted Answer

Deploy a CloudHSM cluster with at least two HSMs in different Availability Zones. Deploying a CloudHSM cluster with at least two HSMs in different Availability Zones provides high availability and durability. CloudHSM automatically synchronizes keys across HSMs in the cluster, so if one HSM fails, the others continue to provide access to the keys.

Answer

Use AWS KMS instead of CloudHSM for better durability

Answer

Deploy a single CloudHSM instance in one Availability Zone

Answer

Deploy CloudHSM in two AWS Regions with automatic replication

Question 19

A security engineer is configuring a VPC with public and private subnets. The engineer needs to allow instances in the private subnet to download software updates from the internet. Which component should be added to the VPC?

Accepted Answer

NAT gateway in a public subnet.. A NAT gateway placed in a public subnet allows instances in a private subnet to initiate outbound connections to the internet (e.g., to download software updates) while remaining unreachable from the internet. The NAT gateway performs source NAT, translating the private IPs to its own Elastic IP, and returns responses to the originating instances. This is the standard AWS pattern for giving private subnets outbound-only internet access.

Answer

VPN connection to on-premises.

Answer

VPC endpoint for Amazon S3.

Answer

Bastion host in a public subnet.

Question 20

A security engineer notices that an IAM role has a trust policy allowing any AWS account to assume it. Which attack is this misconfiguration most likely to enable?

Accepted Answer

Unauthorized access by an external attacker. An IAM role trust policy that allows any AWS account (i.e., `"Principal": {"AWS": "*"}`) to assume the role means that any user or service in any AWS account can call the STS `AssumeRole` API to obtain temporary credentials for the role. This directly enables unauthorized access by an external attacker who can discover the role ARN and assume it, gaining all permissions attached to the role.

Answer

Logging bypass via CloudTrail

Answer

Cross-service confused deputy attack

Answer

Privilege escalation by attaching additional policies