SCS-C02 Practice Exam 59 — 20 Questions

Question 1

A company is designing a VPC with public and private subnets. The application servers in the private subnets need to download patches from the internet. Which architecture provides the highest security while allowing internet access?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Place a NAT Gateway in the public subnet and configure the private subnet route table to send 0.0.0.0/0 traffic to the NAT Gateway. A NAT Gateway in a public subnet allows instances in private subnets to initiate outbound traffic to the internet (e.g., for patch downloads) while preventing any unsolicited inbound traffic from the internet. The private subnet route table sends 0.0.0.0/0 traffic to the NAT Gateway, which then forwards it through the Internet Gateway (IGW) attached to the VPC. This provides the highest security because the private instances remain unreachable from the internet, unlike using an IGW directly or a bastion host for routing.

Answer

Create a VPC endpoint for Amazon S3 and route traffic through it

Answer

Attach an internet gateway to the private subnet and configure the route table to send 0.0.0.0/0 traffic to the internet gateway

Answer

Place a bastion host in the public subnet and configure the private instances to route internet traffic through it

Question 2

A company wants to encrypt data in transit between an Application Load Balancer (ALB) and its targets. Which configuration should be used?

Accepted Answer

Configure the ALB with an HTTPS listener and use HTTPS as the protocol for the target group.. To encrypt data in transit between an ALB and its targets, you must configure the ALB listener to use HTTPS and set the target group protocol to HTTPS. This ensures that traffic from the ALB to the targets is encrypted using TLS. The ALB terminates the client-side TLS and establishes a new TLS connection to the targets.

Answer

Configure the ALB with a TCP listener and use Network Load Balancer.

Answer

Configure the ALB security group to allow only encrypted traffic.

Answer

Configure the ALB with an HTTP listener and use a security group to enforce encryption.

Question 3

A company wants to protect data in transit between an on-premises data center and Amazon S3. Which AWS service should be used to establish a dedicated, encrypted connection?

Accepted Answer

AWS Direct Connect with an IPsec VPN. AWS Direct Connect alone provides a dedicated private network path but does not encrypt traffic in transit. To achieve both a dedicated connection and encryption, you must pair Direct Connect with an IPsec VPN running over the dedicated link. This combination gives the private, consistent bandwidth of Direct Connect plus the encryption guarantees of IPsec, satisfying the requirement for encrypted data in transit.

Answer

AWS Direct Connect without VPN

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN over the internet

Question 4

A company wants to monitor for unauthorized changes to its Amazon S3 bucket policies. Which AWS service should be used to detect such changes?

Accepted Answer

AWS Config. AWS Config continuously records resource configurations and evaluates them against rules, so it can detect and alert on changes to S3 bucket policies via the s3-bucket-policy-not-more-permissive or custom Config rules. It provides a configuration timeline and compliance state, which is exactly what's needed to detect unauthorized policy modifications.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

Amazon CloudWatch Logs Insights

Question 5

An IAM user reports that they are unable to launch an EC2 instance in us-east-1. The IAM policy attached to the user allows ec2:RunInstances but with a condition that the instance type must be t2.micro. What could be the reason for the failure?

Accepted Answer

The user is trying to launch an instance type other than t2.micro.. The IAM policy condition restricts ec2:RunInstances to t2.micro instances only. If the user attempts to launch any other instance type, the condition evaluates to false and the request is denied. The most likely reason for the failure is that the user is requesting a non-t2.micro instance type, which violates the policy condition.

Answer

The user has not attached a security group to the instance.

Answer

The IAM policy does not include ec2:RunInstances for us-east-1.

Answer

The user's account has reached the EC2 instance limit.

Question 6

A security engineer needs to grant an IAM user in Account A (111111111111) access to an S3 bucket in Account B (222222222222). The bucket policy in Account B allows cross-account access from Account A. Which additional step is required?

Accepted Answer

Attach an IAM policy to the IAM user in Account A granting s3:GetObject on the bucket.. For cross-account access to an S3 bucket, both the bucket policy in Account B and an IAM policy in Account A are required. The bucket policy grants access to the Account A user, but the user also needs an IAM policy in their own account allowing the s3:GetObject action on that bucket. This is because IAM policies in the user's account must permit the action, and the bucket policy must also allow it.

Answer

Create a cross-account role in Account B and have the user assume it.

Answer

Attach the bucket policy to the IAM user in Account A.

Answer

Create an S3 access point in Account B and grant the IAM user access.

Question 7

A company uses an AWS Transit Gateway to connect multiple VPCs and on-premises networks. A security engineer needs to ensure that traffic between VPCs is inspected by a third-party firewall appliance. Which architecture should be used?

Accepted Answer

Attach the firewall appliance to a dedicated inspection VPC and route traffic from other VPCs through the inspection VPC using transit gateway route tables.. It uses a dedicated inspection VPC as a central point for traffic inspection. By attaching the third-party firewall appliance to this inspection VPC and manipulating transit gateway route tables, you can force all inter-VPC traffic to be routed through the firewall for inspection. This architecture leverages the transit gateway's ability to route traffic between attachments based on route table entries, enabling centralized security enforcement without modifying individual VPC routing.

Answer

Configure security groups on the transit gateway to inspect traffic.

Answer

Create VPC endpoints for each VPC to route traffic through the firewall.

Answer

Use network ACLs on the transit gateway to filter traffic.

Question 8

A developer is trying to use the AWS CLI to list objects in an S3 bucket but receives an AccessDenied error. The developer has an IAM user with a policy that allows s3:ListBucket on the bucket. What could be causing the error?

Accepted Answer

The S3 bucket has a bucket policy that denies access to the developer's IAM user.. S3 access decisions are evaluated by combining IAM identity-based policies with bucket policies, and an explicit Deny in either location always wins. Even though the developer's IAM policy grants s3:ListBucket, a bucket policy that explicitly denies the user's principal overrides that Allow. This is the classic 'explicit deny beats allow' rule in AWS's policy evaluation logic.

Answer

The developer has not enabled MFA on their IAM user.

Answer

The S3 bucket does not exist in the same AWS region as the CLI is configured.

Answer

The IAM policy is attached to a group, not directly to the user.

Question 9

Which IAM feature allows you to grant temporary, limited-privilege credentials for a specific role?

Accepted Answer

AWS STS. AWS STS (Security Token Service) is the service that provides temporary, limited-privilege credentials for IAM roles or federated users. When you assume a role, STS issues temporary security credentials that can be used to access AWS resources. This is the core mechanism for granting temporary access.

Answer

Resource-based policies

Answer

IAM roles

Answer

Service control policies

Question 10

A security engineer needs to ensure that data at rest in an Amazon RDS for PostgreSQL DB instance is encrypted. Which action should the engineer take?

Accepted Answer

Create a new DB instance with encryption enabled using the AWS CLI or Console.. Amazon RDS does not support enabling encryption on an existing unencrypted DB instance; encryption must be specified at creation time. To encrypt data at rest, the engineer must create a new DB instance with encryption enabled (via Console, CLI, or API), then migrate data from the old instance. This is the only supported path for RDS encryption at rest.

Answer

Grant the rds:ModifyDBInstance permission to allow encryption toggling.

Answer

Modify the existing unencrypted DB instance to enable encryption.

Answer

Enable encryption automatically by enabling automated backups.

Question 11

A company uses Amazon S3 to store sensitive data. The security team wants to ensure that all objects are encrypted at rest. Which feature should they enable on the S3 bucket?

Accepted Answer

Default encryption. S3 Default Encryption (now called Default Bucket Encryption) automatically encrypts every object uploaded to the bucket using either SSE-S3 or SSE-KMS, without requiring the uploader to specify encryption headers. Enabling it on the bucket ensures all objects are encrypted at rest by default, satisfying the security team's requirement. It is the only option that directly enforces encryption at rest for all objects.

Answer

Versioning

Answer

Server access logging

Answer

Cross-Region Replication

Question 12

An IAM policy has the following statement: {"Effect":"Allow","Action":"s3:*","Resource":"arn:aws:s3:::my-bucket/*"}. A user with this policy tries to perform s3:ListBucket on 'my-bucket'. Will the request succeed?

Accepted Answer

No, because the resource ARN does not include the bucket itself.. The statement grants s3:* on arn:aws:s3:::my-bucket/*, which matches only objects inside the bucket, not the bucket itself. s3:ListBucket is a bucket-level operation that requires the resource arn:aws:s3:::my-bucket (without the /*). Since the policy does not grant access to that resource, the request is denied by default. This is a classic IAM resource-ARN mismatch.

Answer

No, because there is an explicit deny elsewhere.

Answer

Yes, because s3:* allows all actions.

Answer

Yes, because the user has permission to access objects.

Question 13

An organization wants to enforce that all IAM users must use MFA to access the AWS API. Which TWO steps should be taken?

Accepted Answer

Attach the policy to all IAM users or to a group that all users belong to.. Option B is correct because an IAM policy that enforces MFA must actually be attached to the principals it should affect — either directly to each IAM user or, more manageably, to a group that all users belong to, so the deny-unless-MFA condition is evaluated for their API calls. Option C is correct because the standard way to enforce MFA on API access is an IAM policy with a Deny effect on all actions ("*") guarded by a condition such as "aws:MultiFactorAuthPresent": "true" (typically combined with a BoolIfExists or Null check to handle cases where the key is absent), which blocks any request not made with MFA-authenticated credentials. Option A is not required: rotating access keys improves key hygiene but does not enforce MFA on API calls. Option D is wrong because the account password policy controls password complexity, length, and rotation for console sign-in, not MFA requirements for API access. Option E is wrong because SCPs only apply to accounts within AWS Organizations and cannot require MFA for individual IAM users' API calls; MFA enforcement for users is done with IAM policies.

Answer

Rotate all IAM user access keys.

Answer

Configure the account password policy to require MFA.

Answer

Create a service control policy (SCP) that requires MFA for all API calls.

Question 14

A security engineer notices that an IAM user has permissions to create new IAM users and attach policies. What is the most effective way to detect if this user created a backdoor user?

Accepted Answer

Enable AWS CloudTrail and monitor IAM events using Amazon CloudWatch Logs and create a metric filter for CreateUser and AttachUserPolicy events.. The most effective way to detect if a user created a backdoor IAM user is to enable AWS CloudTrail and monitor IAM events such as CreateUser and AttachUserPolicy using CloudWatch Logs metric filters and alarms. CloudTrail records all API activity, including IAM changes, and CloudWatch can alert on specific event names in near real-time. This provides direct detection of the exact actions that would indicate backdoor user creation.

Answer

Review S3 access logs for any PutObject calls from the IAM user.

Answer

Use IAM Access Analyzer to review all IAM policies for potential backdoor access.

Answer

Configure an AWS Config rule to check for IAM users with administrative policies.

Question 15

A company stores sensitive documents in an S3 bucket. The security team wants to ensure that any object uploaded to the bucket is automatically encrypted using server-side encryption with AWS KMS. Which S3 bucket feature should be configured?

Accepted Answer

Default encryption. S3 default encryption (now called default encryption with SSE-KMS or SSE-S3) automatically encrypts every object at rest when it is uploaded, without requiring the uploader to specify encryption headers. Configuring default encryption with SSE-KMS using a customer-managed KMS key satisfies the requirement for automatic server-side encryption with AWS KMS. This is a bucket-level setting applied at PUT time.

Answer

Versioning

Answer

Bucket policy

Answer

Lifecycle policy

Question 16

A company needs to ensure that data in transit between an on-premises data center and Amazon S3 is encrypted. The data will be transferred using HTTPS. What additional step should be taken to ensure the encryption is enforced?

Accepted Answer

Add a bucket policy that denies requests where aws:SecureTransport is false. S3 bucket policies can enforce encryption in transit by denying any request where the aws:SecureTransport condition key is false. This ensures that only HTTPS (TLS) requests are allowed, effectively blocking HTTP access. Since the data is already being transferred over HTTPS, adding this policy guarantees that encryption in transit is enforced and cannot be bypassed.

Answer

Use AWS KMS to require encryption in transit

Answer

Enable S3 Transfer Acceleration

Answer

Use Amazon CloudFront with HTTPS only

Question 17

A developer is creating an AWS Lambda function that needs to read items from a DynamoDB table. The function is deployed in a VPC with no internet access. What is the MOST secure way to grant the Lambda function access to DynamoDB?

Accepted Answer

Create a VPC endpoint for DynamoDB and attach an IAM execution role to the Lambda function with the necessary permissions.. A VPC endpoint for DynamoDB allows private connectivity from within a VPC to DynamoDB without requiring an internet gateway, NAT device, or VPN. Attaching an IAM execution role to the Lambda function with the necessary DynamoDB permissions grants the function the required access. This combination is the most secure because it keeps traffic within the AWS network and uses least privilege.

Answer

Attach a public IP to the Lambda function and use an IAM role with DynamoDB permissions.

Answer

Create an API Gateway REST API with a VPC link and DynamoDB integration.

Answer

Use a resource-based policy on the DynamoDB table allowing access from the Lambda function's ARN.

Question 18

A company wants to protect data in transit between an EC2 instance and an S3 bucket. Which method should be used?

Accepted Answer

Use HTTPS endpoints for S3 API calls. To protect data in transit between an EC2 instance and an S3 bucket, you must use HTTPS endpoints for S3 API calls, which encrypts traffic using TLS. S3 supports HTTPS natively via its REST API endpoints, and this is the standard method to ensure encryption in transit for S3 access from EC2.

Answer

Use a VPN connection with IPsec

Answer

Install an SSL certificate on the EC2 instance

Answer

Use SSH to transfer files

Question 19

A security engineer needs to ensure that all new IAM users are created with a strong password policy enforced. Which action should be taken?

Accepted Answer

Set a custom IAM password policy in the account. AWS IAM account password policies are configured at the account level and apply to all IAM users created in that account. Setting a custom password policy enforces minimum length, complexity, reuse prevention, and rotation requirements automatically for every new and existing user. This is the native, supported mechanism for enforcing strong passwords across an AWS account.

Answer

Use AWS Config to automatically delete users with weak passwords

Answer

Create a Lambda function that checks password strength on user creation

Answer

Use AWS Secrets Manager to generate passwords

Question 20

A company wants to encrypt data at rest in Amazon S3 using server-side encryption with Amazon S3-managed keys (SSE-S3). What is the minimum permission required for an IAM user to upload an object that will be encrypted with SSE-S3?

Accepted Answer

s3:PutObject. For SSE-S3, Amazon S3 manages the encryption keys entirely, so the IAM user does not need any AWS KMS permissions. The only permission required to upload an object with SSE-S3 is s3:PutObject, which allows the upload operation. S3 automatically encrypts the object with an S3-managed key when the request specifies SSE-S3 or when default encryption is enabled.

Answer

s3:PutObjectAcl

Answer

kms:Decrypt

Answer

kms:GenerateDataKey