SCS-C02 Practice Exam 61 — 20 Questions

Question 1

A company needs to share an encrypted Amazon S3 object with another AWS account. The object is encrypted with an AWS KMS customer managed key. Which steps are required?

Accepted Answer

Update both the bucket policy and the KMS key policy to grant cross-account access.. Cross-account access to a KMS-encrypted S3 object requires permissions on both sides: the S3 bucket policy must grant the external account s3:GetObject, and the KMS key policy must grant that account kms:Decrypt. Without the KMS key policy update, the external account's request fails with AccessDenied even if the bucket policy allows it, because S3 delegates decryption authorization to KMS.

Answer

Use an object ACL to grant the other account read access.

Answer

Update the bucket policy to allow the other account to access the object.

Answer

Update the KMS key policy to allow the other account to decrypt.

Question 2

A company wants to implement a least-privilege access model for their AWS resources. Which TWO of the following are best practices for achieving this?

Accepted Answer

Grant permissions only for the specific actions required.. Granting only the necessary permissions is the core of least-privilege. Option D is correct because using conditions to restrict access based on attributes like source IP or time further enforces least-privilege. Option A is wrong because using a single IAM role for all users violates the least-privilege principle by granting excessive permissions. Option C is wrong because attaching policies to groups is a best practice for manageability, but it does not directly address least-privilege. Option E is wrong because using only AWS managed policies may grant more permissions than needed; customer managed policies can be tailored to specific requirements.

Answer

Use a single IAM role for all users in the account.

Answer

Attach IAM policies to groups rather than individual users.

Answer

Always use AWS managed policies instead of customer managed policies.

Question 3

The above condition is added to an S3 bucket policy to restrict access to a specific VPC endpoint. An EC2 instance in the same VPC is unable to access the bucket. What is the most likely reason?

Accepted Answer

The resource ARN in the policy is for EC2, not for S3. The resource ARN in the policy must reference the S3 bucket (e.g., arn:aws:s3:::bucket-name/*), not an EC2 resource. If the ARN is for EC2, the policy will not apply to S3 operations, causing the EC2 instance to be denied access regardless of the VPC endpoint condition. S3 bucket policies only take effect when the Resource element specifies the S3 bucket ARN.

Answer

The condition should use aws:SourceVpc instead of aws:SourceVpce

Answer

The EC2 instance does not have a public IP address

Answer

The VPC endpoint policy does not allow the s3:GetObject action

Question 4

A company has an incident response (IR) process that includes isolating compromised EC2 instances. During a security incident, the IR team needs to block all traffic to and from a compromised instance while preserving the instance for forensic analysis. Which approach should the team take?

Accepted Answer

Modify the security group associated with the instance to remove all inbound and outbound rules.. Modifying the security group to remove all inbound and outbound rules effectively blocks all traffic to and from the EC2 instance because security groups act as a stateful virtual firewall at the instance level. This approach preserves the instance in its current running state, allowing the IR team to perform forensic analysis without the risk of the instance being tampered with or communicating with external systems.

Answer

Detach the instance from the Auto Scaling group and stop it.

Answer

Update the network ACL for the subnet to deny all traffic.

Answer

Terminate the instance immediately.

Question 5

Refer to the exhibit. A role has two policies attached. The custom policy includes an Allow for s3:PutObject. An IAM user assumes this role and tries to upload a file to S3. What happens?

Accepted Answer

The upload succeeds because the custom policy allows s3:PutObject. The upload succeeds because IAM evaluates policies in a default-deny environment, and the custom policy attached to the role explicitly allows s3:PutObject. When a user assumes the role, the effective permissions are the union of all attached policies; the managed policy's read-only restriction does not block the explicit allow for s3:PutObject. Since there is no explicit deny for s3:PutObject, the allow from the custom policy grants the action.

Answer

The upload fails because the managed policy only allows read

Answer

The upload is denied by default because no explicit allow

Answer

The upload fails because the managed policy overrides the custom policy

Question 6

A company is using AWS DMS to migrate data from an on-premises Oracle database to Amazon RDS for PostgreSQL. The data must be encrypted in transit. What should the company do?

Accepted Answer

Enable SSL on the source and target endpoints in the DMS task.. AWS DMS supports SSL/TLS to encrypt data in transit between source and target endpoints. Enabling SSL on both endpoints ensures that the data migration is encrypted over the network. Option A is incorrect because AWS Direct Connect provides a private network connection but does not automatically encrypt traffic; additional encryption like SSL is still required for data in transit. Option C is incorrect because AWS KMS is used for encryption at rest, not for encrypting data in transit. Option D is incorrect because a VPN connection provides a secure tunnel but is not necessary; DMS can use SSL directly on the endpoints, which is a simpler solution.

Answer

Use AWS Direct Connect to establish a private connection.

Answer

Use AWS KMS to encrypt the data before sending.

Answer

Set up a VPN connection between the on-premises network and AWS VPC.

Question 7

A security engineer is designing a system to detect and respond to IAM policy changes that could grant excessive permissions. The solution must alert within minutes of the change and automatically revert the change if it violates a predefined baseline. Which combination of services should the engineer use?

Accepted Answer

AWS CloudTrail, Amazon CloudWatch Events, and AWS Lambda. AWS CloudTrail logs IAM policy changes. Amazon CloudWatch Events (now EventBridge) can match specific API calls (e.g., PutRolePolicy) and trigger an AWS Lambda function within minutes. The Lambda function can evaluate the change against a baseline and automatically revert it if it violates the policy, providing both detection and remediation.

Answer

AWS CloudTrail and Amazon S3

Answer

AWS Config and AWS Systems Manager

Answer

IAM Access Analyzer and AWS Lambda

Question 8

A security engineer needs to audit all IAM role creations across an AWS account. Which AWS service should be used to log these API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records all API calls made in an AWS account, including IAM role creation events (CreateRole). CloudTrail captures the identity of the caller, the time, source IP, and request parameters, making it the authoritative audit log for API activity. GuardDuty, Config, and CloudWatch Logs do not provide a complete API call history for IAM actions.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 9

A security engineer is auditing the AWS Organizations structure. The engineer notices that the 'Management' account (111111111111) has a status of 'ACTIVE' and joined method 'CREATED'. The engineer is concerned about potential security risks. Which action should the engineer take to improve security?

Accepted Answer

Enable multi-factor authentication (MFA) for the root user of the management account.. The management account in AWS Organizations is the account that created the organization and has full administrative access. It is critical to secure this account, and enabling multi-factor authentication (MFA) for the root user is a fundamental security best practice. Option A is incorrect because you cannot remove the management account from the organization; it is the foundational account. Option B is incorrect because you cannot delete the management account; you would need to delete the entire organization. Option C is incorrect because you cannot delete the root user; it is a built-in user that cannot be removed. Therefore, enabling MFA on the root user of the management account is the appropriate action to improve security.

Answer

Remove the management account from the organization.

Answer

Delete the management account and create a new one.

Answer

Create a new root user for the management account and delete the old one.

Question 10

A security engineer is designing a solution to monitor and remediate non-compliant resources across multiple AWS accounts. The company uses AWS Organizations and wants to enforce that any S3 bucket with public read access is automatically remediated. The solution must be centralized and scalable. Which approach should the engineer take?

Accepted Answer

Deploy an AWS Config conformance pack with a rule and an auto-remediation action using AWS Systems Manager Automation.. AWS Config conformance packs allow you to deploy a collection of AWS Config rules and remediation actions across multiple accounts and Regions in AWS Organizations. By including an auto-remediation action using AWS Systems Manager Automation, the solution can automatically remediate S3 buckets with public read access in a centralized and scalable manner, without manual intervention or per-account configuration.

Answer

Create an AWS Config rule in each account and configure an Amazon CloudWatch Events rule to trigger an AWS Lambda function for remediation.

Answer

Use AWS Trusted Advisor to identify public buckets and manually remediate them.

Answer

Deploy an AWS Config conformance pack with a rule that checks for public buckets and reports non-compliance.

Question 11

A company has an S3 bucket that stores sensitive data. The bucket policy allows access only from a specific VPC endpoint. The security team notices that an object was accessed from an IP address outside the allowed VPC. CloudTrail logs show that the access was made using temporary credentials from an assumed role. The role was assumed by an EC2 instance in the allowed VPC. What is the MOST likely reason the access was allowed despite the bucket policy restriction?

Accepted Answer

The bucket policy allows access from the VPC endpoint, and the request was made through that endpoint.. The bucket policy uses the aws:SourceVpce condition to restrict access to a specific VPC endpoint. When the EC2 instance in the allowed VPC makes a request, it goes through the VPC endpoint, satisfying the condition. Even though the source IP address appears to be outside the VPC (the VPC endpoint's public IP), the policy evaluates based on the VPC endpoint, not the source IP. Therefore, the request was allowed. Option A is incorrect because encryption in transit is not related to the access restriction. Option C is incorrect because there is no evidence of a syntax error. Option D is incorrect because IAM permissions cannot override a bucket policy that explicitly denies access; the bucket policy allowed the access because the condition was met.

Answer

The bucket policy does not require encryption in transit.

Answer

The bucket policy has a syntax error that makes it ineffective.

Answer

The IAM role used by the EC2 instance has permissions that override the bucket policy.

Question 12

A developer needs to allow an EC2 instance to read from a DynamoDB table named 'Orders' in the same account. The security team requires that the permissions be granted using an instance profile. Which steps should be taken?

Accepted Answer

Create an IAM role with a policy that allows dynamodb:GetItem on the 'Orders' table, create an instance profile, add the role to the profile, and launch the EC2 instance with the instance profile. The correct steps are to create an IAM role with the necessary policy, create an instance profile, add the role to the instance profile, and then launch the EC2 instance with that instance profile. This grants the EC2 instance temporary credentials to access DynamoDB. The instance profile is the container for the role and is required for EC2 to assume the role.

Answer

Create an instance profile and attach a policy to it, then launch the EC2 instance with the instance profile

Answer

Create an IAM role with the required policy, then attach the role directly to the EC2 instance during launch

Answer

Create an IAM user with programmatic access, store the access key in a secure S3 bucket, and have the EC2 instance retrieve the credentials at startup

Question 13

A company is designing a data protection strategy for an Amazon RDS for MySQL database. The database is 2 TB in size and stores financial data. The compliance team requires that database snapshots be encrypted at rest and that encryption keys be rotated every year. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Enable automatic key rotation in AWS KMS for the KMS key used for RDS encryption. Enabling automatic key rotation in AWS KMS for the KMS key used for RDS encryption meets the compliance requirement of yearly key rotation without any manual effort. RDS automatically uses the rotated key for new snapshots, and existing snapshots remain encrypted with the original key but can be decrypted with the new key as KMS maintains the key hierarchy. Option A is wrong because copying snapshots to re-encrypt with a new KMS key requires manual scripting and adds operational overhead. Option B is wrong because exporting snapshots to S3 and using S3 Batch Operations is complex and unnecessary. Option C is wrong because using a different KMS key for each snapshot and manually rotating adds significant operational overhead and does not leverage the automatic rotation capability of KMS.

Answer

Copy each snapshot to a new snapshot encrypted with a new KMS key

Answer

Export snapshots to S3 and use S3 Batch Operations to re-encrypt them

Answer

Use a different KMS key for each snapshot and rotate the key manually

Question 14

A security engineer needs to ensure that all changes to IAM policies in an AWS account are logged and that the logs are immutable and cannot be deleted by any user, including the root user. Which actions should the engineer take? (Choose two.)

Accepted Answer

Enable AWS CloudTrail to log IAM events.. AWS CloudTrail is the service specifically designed to log all API activity, including IAM policy changes. By enabling CloudTrail with management event logging, all IAM CreatePolicy, PutPolicy, DeletePolicy, and similar actions are recorded in a log file delivered to an S3 bucket. This provides an authoritative audit trail of who made the change, when, and from which source IP. Option E is correct because S3 Object Lock in compliance mode prevents any user, including the root user, from overwriting or deleting objects for the specified retention period. This ensures the log files are immutable and cannot be tampered with or deleted, fulfilling the requirement that logs cannot be deleted by any user.

Answer

Enable default encryption with AWS KMS on the bucket.

Answer

Enable S3 Versioning on the bucket.

Answer

Enable multi-factor authentication (MFA) delete on the S3 bucket.

Question 15

Which AWS service can be used to detect and alert on suspicious network traffic patterns within a VPC, such as port scanning or unusual outbound traffic?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors VPC Flow Logs, DNS logs, and CloudTrail events to identify suspicious network traffic patterns such as port scanning, unusual outbound traffic, and other malicious activities. It uses machine learning, anomaly detection, and integrated threat intelligence to generate security alerts without requiring manual rules or signatures.

Answer

AWS WAF

Answer

AWS Network Firewall

Answer

VPC Flow Logs

Question 16

An IAM policy includes: { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/MyRole" }. What does this allow?

Accepted Answer

Allows the user to pass the role MyRole to an AWS service like Lambda.. Iam:PassRole allows a user to pass a role to an AWS service such as Lambda, enabling the service to assume that role. Option A is incorrect because creating a role requires the iam:CreateRole action, not iam:PassRole. Option C is incorrect because assuming a role requires the sts:AssumeRole action. Option D is incorrect because attaching a role to an IAM user is not a valid operation; roles are attached to services, not users.

Answer

Allows the user to create the role MyRole.

Answer

Allows the user to assume the role MyRole.

Answer

Allows the user to attach the role to an IAM user.

Question 17

A security team is designing a logging solution for a multi-account AWS environment using AWS Organizations. They need to collect CloudTrail logs, VPC Flow Logs, and DNS logs from all accounts. Which TWO services can be used to centralize this logging?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs (A) is correct because it can serve as a centralized log repository where log groups from multiple accounts stream CloudTrail, VPC Flow Logs, and Route 53 DNS query logs via subscription filters and cross-account log sharing, enabling a single security account to aggregate and query all log data. Amazon S3 (E) is correct because it is the standard centralized destination for CloudTrail log file delivery (including organization trails), VPC Flow Logs (delivered to S3 buckets), and Route 53 DNS query logs, with cross-account bucket policies and AWS Organizations allowing all member accounts to write into a central logging bucket. AWS CloudTrail (Organization Trail) (B) is not correct here because it only captures CloudTrail API activity across accounts, not VPC Flow Logs or DNS logs, so it cannot centralize all three log types. AWS Config (C) is not correct because it records resource configuration changes and compliance state, not CloudTrail, VPC Flow Log, or DNS log data. Amazon GuardDuty (D) is not correct because it is a threat-detection service that consumes logs to generate findings, not a service for centralizing and storing the raw logs themselves.

Answer

AWS CloudTrail (Organization Trail)

Answer

AWS Config

Answer

Amazon GuardDuty

Question 18

A company wants to allow an IAM user to list objects in an S3 bucket named 'my-bucket'. Which IAM policy statement grants the minimum required permissions?

Accepted Answer

{"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::my-bucket"}. The s3:ListBucket action is the specific permission required to list objects in an S3 bucket, and the resource ARN must be the bucket itself (arn:aws:s3:::my-bucket) without a trailing /*. This grants the minimum necessary permission to perform the ListObjects (or ListObjectsV2) API call, which returns the object keys in the bucket.

Answer

{"Effect":"Allow","Action":"s3:PutObject","Resource":"arn:aws:s3:::my-bucket/*"}

Answer

{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::my-bucket/*"}

Answer

{"Effect":"Allow","Action":"s3:*","Resource":"arn:aws:s3:::my-bucket"}

Question 19

A security engineer is reviewing the security of an Amazon EKS cluster. The cluster is used to run containerized applications. Which three actions should the engineer take to improve the security of the cluster?

Accepted Answer

Restrict access to the cluster using AWS IAM authentication for kubectl.. Restricting access to the cluster using AWS IAM authentication for kubectl is correct because it integrates with AWS IAM to manage user and role permissions, ensuring that only authorized principals can interact with the EKS cluster. This replaces the default, less secure static token or certificate-based authentication with a robust, auditable identity federation. By mapping IAM roles to Kubernetes RBAC, you enforce least-privilege access and prevent unauthorized API calls.

Answer

Use the default VPC for the cluster.

Answer

Grant the cluster-admin role to all developers.

Question 20

A company wants to allow an IAM user to list only the objects in a specific S3 bucket named 'my-bucket'. Which IAM policy statement should be used?

Accepted Answer

{"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::my-bucket"}. The s3:ListBucket action operates on the bucket itself, so the Resource must be the bucket ARN without the /* wildcard: arn:aws:s3:::my-bucket. This grants permission to list objects in that specific bucket only. The /* suffix is used for object-level actions like s3:GetObject, not for ListBucket.

Answer

{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::my-bucket/*"}

Answer

{"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::my-bucket/*","Condition":{"StringEquals":{"s3:prefix":""}}}

Answer

{"Effect":"Allow","Action":"s3:*","Resource":"arn:aws:s3:::my-bucket/*"}