SCS-C02 Practice Exam 60 — 20 Questions

Question 1

Drag and drop the steps to implement AWS KMS key rotation in the correct order.

Accepted Answer

Create a CMK, then enable automatic key rotation, then perform manual key rotation (if needed), then update applications to use the new key, then verify decryption.. Key rotation starts with creating a CMK, enabling auto-rotation, manual rotation if needed, updating apps, and verifying decryption.

Answer

Create a CMK, then perform manual key rotation, then enable automatic key rotation, then update applications to use the new key, then verify decryption.

Answer

Enable automatic key rotation, then create a CMK, then perform manual key rotation, then update applications, then verify decryption.

Answer

Create a CMK, then enable automatic key rotation, then update applications to use the new key, then perform manual key rotation, then verify decryption.

Question 2

A security engineer is configuring an automated incident response workflow. When a GuardDuty finding of type 'UnauthorizedAccess:EC2/SSHBruteForce' is generated, the workflow should isolate the EC2 instance and snapshot its EBS volume. Which AWS service can coordinate these actions?

Accepted Answer

AWS Step Functions. AWS Step Functions is the correct service because it is designed to orchestrate multi-step workflows by coordinating AWS services like Lambda, EC2, and EBS snapshots in a defined state machine. For the given GuardDuty finding, Step Functions can receive the event, invoke a Lambda function to isolate the EC2 instance (e.g., modify security groups or attach a deny-all NACL), and then trigger another Lambda or direct API call to snapshot the EBS volume, all with built-in error handling, retries, and sequencing.

Answer

AWS Lambda functions invoked sequentially

Answer

AWS CloudFormation

Answer

AWS Config rules with auto-remediation

Question 3

A company wants to enforce that all IAM users must use multi-factor authentication (MFA) to access the AWS Management Console. Which policy should be attached to the IAM users or group to enforce this requirement?

Accepted Answer

Deny access if MFA is not present. The correct policy is to explicitly deny access when MFA is not present. In IAM, an explicit Deny overrides any Allow, so attaching a policy with a Deny statement conditioned on 'aws:MultiFactorAuthPresent' being false ensures that users without MFA are blocked from accessing the console. This is the standard pattern to enforce MFA because it cannot be bypassed by other permissive policies.

Answer

Allow access if MFA is present

Answer

Deny access if MFA is present

Answer

Grant access with a condition requiring MFA

Question 4

A company has a requirement to audit all API calls made to AWS services in their account. Which AWS service should be used to meet this requirement?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records all API calls made to AWS services in an account, capturing the identity of the caller, the time, the source IP, the request parameters, and the response. It is the authoritative service for auditing API activity across the AWS account, and it can deliver logs to S3, CloudWatch Logs, or EventBridge for analysis and alerting. Enabling CloudTrail in all regions with log file validation is a standard compliance requirement.

Answer

AWS Config

Answer

Amazon Inspector

Answer

Amazon GuardDuty

Question 5

A company has an IAM policy that allows s3:GetObject on all buckets. However, a specific S3 bucket policy explicitly denies s3:GetObject to all principals. An IAM user with the IAM policy tries to read an object from that bucket. What is the result?

Accepted Answer

The request is denied because the explicit deny in the bucket policy overrides the allow in the IAM policy.. D is correct because AWS IAM policy evaluation logic follows an explicit deny override: any explicit deny in any applicable policy (resource-based or identity-based) overrides any allow. The S3 bucket policy explicitly denies s3:GetObject to all principals, so even though the IAM policy allows the action, the explicit deny takes precedence, resulting in a denied request.

Answer

The request is allowed because the IAM policy is more specific.

Answer

The request is allowed because the IAM policy allows the action.

Answer

The request is denied because the bucket policy applies only to IAM users.

Question 6

A security engineer notices that CloudTrail logs for a production account are not being delivered to the S3 bucket. The bucket policy allows CloudTrail to write objects. What is the MOST likely cause?

Accepted Answer

The bucket policy does not grant s3:GetBucketAcl to CloudTrail.. CloudTrail requires the `s3:GetBucketAcl` permission on the destination S3 bucket to verify that the bucket policy grants CloudTrail the necessary write access. Without this permission, CloudTrail cannot confirm its ability to deliver logs, even if the bucket policy explicitly allows `s3:PutObject`. This is a prerequisite check performed by CloudTrail before any log delivery occurs.

Answer

The S3 bucket does not have versioning enabled.

Answer

The S3 bucket uses SSE-KMS encryption.

Answer

The S3 bucket contains existing objects before CloudTrail delivery started.

Question 7

A company is deploying a web application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The instances are in a private subnet. How should the security group for the EC2 instances be configured?

Accepted Answer

Allow inbound HTTP/HTTPS from the security group of the ALB.. The EC2 instances are in a private subnet and should only accept traffic from the ALB, not directly from the internet. By referencing the ALB's security group as the source, you ensure that only traffic that has passed through the ALB can reach the instances, maintaining a secure architecture. This follows the principle of least privilege and prevents bypassing the load balancer.

Answer

Allow inbound HTTP/HTTPS from the internet gateway.

Answer

Allow inbound HTTP/HTTPS from 0.0.0.0/0.

Answer

Allow inbound HTTP/HTTPS from the VPC CIDR.

Question 8

A company wants to ensure that all API calls in their AWS account are logged and immutable. Which TWO actions should be taken? (Choose TWO.)

Accepted Answer

Enable S3 Object Lock on the CloudTrail S3 bucket. Enabling S3 Object Lock on the CloudTrail S3 bucket ensures that log files are immutable and cannot be overwritten or deleted by any user, including root. This is achieved through a write-once-read-many (WORM) model, which is essential for maintaining a tamper-proof audit trail of all API calls.

Answer

Enable MFA delete on the S3 bucket

Answer

Use AWS Config rules to monitor CloudTrail configuration

Answer

Encrypt the S3 bucket with AWS KMS

Question 9

A company uses AWS Organizations and wants to restrict the use of specific AWS services in member accounts. For example, they want to block the use of Amazon Redshift. Which policy type should be used?

Accepted Answer

Service control policies (SCPs). Service control policies (SCPs) are used in AWS Organizations to centrally manage permissions across multiple accounts. They can restrict which AWS services and actions are available to member accounts. To block the use of Amazon Redshift in member accounts, an SCP can be applied to the organizational units or accounts that denies the redshift:* actions.

Answer

IAM permissions boundaries

Answer

IAM identity-based policies

Answer

S3 bucket policies

Question 10

Refer to the exhibit. An IAM policy is attached to a user. The user attempts to upload an object to my-bucket using server-side encryption with AWS KMS (SSE-KMS). What is the outcome?

Accepted Answer

The upload fails because the Deny statement denies any PutObject that does not use AES256 encryption.. The policy contains an explicit Deny for s3:PutObject when the request does not use AES256 server-side encryption. In IAM, an explicit Deny always overrides any Allow, so a PutObject using SSE-KMS (aws:kms) fails even though the Allow statement matches the action and resource. The Deny condition effectively whitelists only AES256, making any other encryption mode—including SSE-KMS—blocked.

Answer

The upload fails because the Allow statement requires AES256 encryption.

Answer

The upload succeeds because the policy does not explicitly deny SSE-KMS.

Answer

The upload succeeds because the Allow statement matches the s3:PutObject action.

Question 11

Which THREE AWS services can be used to centrally manage security across multiple accounts? (Select THREE.)

Accepted Answer

AWS Config. AWS Config is correct because it provides a centralized view of resource configurations and compliance across multiple accounts when integrated with AWS Organizations. By enabling Config in the management account and using aggregation authorizations, you can aggregate configuration and compliance data from all member accounts into a single administrator account, enabling centralized security governance.

Answer

AWS Shield

Answer

Amazon GuardDuty

Question 12

A company wants to automatically detect and remediate S3 buckets that are publicly accessible. Which AWS service can be used to evaluate bucket policies against a defined rule and trigger an automated response?

Accepted Answer

AWS Config. AWS Config evaluates resource configurations against rules and can trigger automatic remediation via SSM Automation documents. For S3 public access, the managed rule s3-bucket-public-read-prohibited or s3-bucket-public-write-prohibited can detect noncompliant buckets and invoke a remediation action to block public access.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

Amazon Inspector

Question 13

A company needs to securely store database credentials that are used by an application running on Amazon EC2. The credentials must be automatically rotated every 90 days. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is purpose-built for storing, retrieving, and automatically rotating database credentials. It natively supports rotation for Amazon RDS, Aurora, and other databases via Lambda rotation functions, and can rotate credentials every 90 days as required. This directly meets the requirement for secure storage and automatic rotation.

Answer

AWS KMS

Answer

AWS IAM roles for EC2

Answer

AWS Systems Manager Parameter Store

Question 14

A company wants to centralize the management of IAM users and groups for multiple AWS accounts. Which AWS service should be used to allow users to access multiple accounts with a single set of credentials?

Accepted Answer

AWS IAM Identity Center (AWS SSO). AWS IAM Identity Center (successor to AWS SSO) is purpose-built to centralize workforce access across multiple AWS accounts using a single set of credentials. It integrates with AWS Organizations to enumerate accounts and permission sets, and can federate with an external IdP (e.g., Okta, Microsoft Entra ID) or use its own identity store. Users sign in once and pick from assigned accounts/roles, eliminating per-account IAM users.

Answer

AWS Organizations

Answer

IAM users and groups in each account

Answer

Amazon Cognito

Question 15

A security engineer needs to analyze VPC Flow Logs to identify traffic to a known malicious IP address. The logs are stored in Amazon S3. Which approach is the most cost-effective for querying the logs?

Accepted Answer

Use Amazon Athena to query the logs in S3. Amazon Athena is the most cost-effective option because it is a serverless query service that allows you to run SQL queries directly on data stored in S3, including VPC Flow Logs, without needing to load or transform the data. You pay only for the data scanned per query, and with partitioning (e.g., by date or region), you can minimize costs by scanning only relevant log files. This avoids the overhead of provisioning clusters or managing infrastructure, making it ideal for ad-hoc analysis of malicious IP traffic.

Answer

Load the logs into an Amazon Redshift cluster

Answer

Use Amazon EMR to run Spark jobs

Answer

Use Amazon QuickSight to connect to S3

Question 16

A startup uses a single AWS account for development. The security engineer wants to detect if any EC2 instances have been compromised and are performing reconnaissance by probing open ports on other internal instances. The engineer has enabled VPC Flow Logs for all subnets. What is the most cost-effective way to detect this behavior?

Accepted Answer

Enable Amazon GuardDuty and review the findings.. Amazon GuardDuty is a managed threat detection service that uses machine learning and integrated threat intelligence to analyze VPC Flow Logs, DNS logs, and other data sources. It can automatically detect reconnaissance behavior such as port probing or port scanning from compromised EC2 instances without requiring any additional infrastructure or manual query setup. This makes it the most cost-effective solution because it operates on a pay-per-volume basis and eliminates the need for custom log analysis or per-instance agents.

Answer

Install a third-party intrusion detection system on each EC2 instance.

Answer

Use Amazon CloudWatch Logs Insights to query VPC Flow Logs for rejected traffic patterns.

Answer

Use AWS Config rules to check for security group changes.

Question 17

A company wants to store audit logs for a minimum of 7 years to meet compliance requirements. The logs are stored in Amazon S3. Which action should be taken to ensure logs are not deleted before 7 years?

Accepted Answer

Enable S3 Object Lock in Compliance mode with a 7-year retention period on the bucket.. S3 Object Lock in Compliance mode prevents any user, including the root account, from deleting or overwriting an object version until the retention period expires. Setting a 7-year retention period on the bucket enforces the compliance requirement at the object level and cannot be bypassed, which is exactly what is needed to guarantee logs are not deleted before 7 years.

Answer

Enable MFA Delete on the bucket.

Answer

Configure an S3 Lifecycle policy to transition objects to Glacier after 7 years.

Answer

Enable S3 Versioning to preserve all versions of objects.

Question 18

An administrator wants to audit all IAM actions in the account. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity, including all IAM actions. AWS Config tracks resource configuration changes, not API actions. Amazon GuardDuty is a threat detection service. Amazon CloudWatch monitors metrics and logs, but does not record API calls.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

Amazon CloudWatch

Question 19

A security engineer is designing a centralized logging solution for a multi-account AWS environment using AWS Organizations. The solution must ensure that all CloudTrail logs from all accounts are delivered to a single S3 bucket in the security account. Additionally, the logs must be encrypted with a KMS key that is managed by the security account. Which combination of steps is required?

Accepted Answer

Create a trail in each account, each delivering to the same S3 bucket. Use a bucket policy to allow cross-account writes. Use a single KMS key with appropriate key policy.. It uses individual trails in each account, all configured to deliver to the same centralized S3 bucket in the security account. A bucket policy can grant CloudTrail write permissions from all accounts, and a single KMS key (managed by the security account) with appropriate key policy ensures encryption. This approach meets the centralized logging and encryption requirements without violating organization trail constraints. Option B is incorrect because AWS Config does not deliver CloudTrail logs, and CloudWatch Logs streaming is not the required solution. Option C is incorrect because the trail is created in the management account but delivers to a bucket in the management account, not the security account, and it uses default encryption instead of a customer-managed KMS key from the security account. Option D is incorrect because organization trails can only be created in the management account; creating one in the security account is not allowed.

Answer

Use AWS Config to deliver logs to a central bucket. Enable CloudWatch Logs in each account and stream to the security account.

Answer

Create a trail in the management account with organization trail enabled, delivering to a bucket in the management account. Use KMS default encryption.

Answer

Create a trail in the security account with organization trail enabled, delivering to a bucket in the security account. Configure bucket policy and KMS key policy to allow CloudTrail and S3 from all accounts.

Question 20

A security analyst wants to monitor unsuccessful login attempts to the AWS Management Console. Which AWS service and log combination should be used?

Accepted Answer

AWS CloudTrail.. AWS CloudTrail is the correct service because it records all API calls made to the AWS Management Console, including failed login attempts (ConsoleLogin events with an 'errorMessage' field). CloudTrail logs these events as management events, which can be delivered to Amazon CloudWatch Logs or an S3 bucket for monitoring and alerting. This makes it the only option that captures authentication failures at the console level.

Answer

Amazon S3 server access logs.

Answer

VPC Flow Logs.

Answer

Amazon CloudWatch Logs.