SCS-C02 Practice Exam 62 — 20 Questions

Question 1

During a security incident, a security engineer needs to collect EBS snapshots of multiple EC2 instances across different accounts in AWS Organizations. The snapshots must be copied to a central forensics account. Which combination of steps is MOST efficient?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS Backup to create backup plans in each account and enable cross-account backup copy to the forensics account.. AWS Backup is the most efficient solution because it natively supports cross-account backup copy, allowing you to create backup plans in each account and automatically copy EBS snapshots to a central forensics account without custom scripting or manual intervention. This integrates directly with AWS Organizations, enabling centralized management of backup policies across multiple accounts, which is ideal for incident response scenarios requiring rapid, consistent snapshot collection.

Answer

Use Amazon Data Lifecycle Manager (DLM) to create snapshots and copy them to the forensics account using S3 cross-region replication.

Answer

Use AWS CloudFormation StackSets to deploy a stack that creates snapshots and copies them manually.

Answer

Use AWS Systems Manager Automation to run scripts in each account that create snapshots and copy them to the forensics account via Lambda.

Question 2

Refer to the exhibit. The bucket policy allows access from a specific IP range and denies access over HTTP. A user from IP 198.51.100.5 makes a GET request over HTTPS. What will happen?

Accepted Answer

Denied because no explicit allow matches the request.. In AWS S3 bucket policies, an explicit Deny always overrides any Allow, but the request must first match a Deny condition. Here, the Deny condition applies to HTTP requests, but the request is HTTPS, so the Deny does not apply. However, the bucket policy only allows access from a specific IP range, and the user's IP (198.51.100.5) is not within that allowed range. Since no explicit Allow matches the request, the default implicit Deny applies, resulting in access being denied.

Answer

Denied because of the explicit Deny statement.

Answer

Allowed because the request is over HTTPS.

Answer

Allowed because the Deny condition is not satisfied.

Question 3

A company runs a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB) in a VPC. The security team uses Amazon GuardDuty and has enabled Amazon Detective. Recently, GuardDuty raised a 'Recon:EC2/PortProbeUnprotectedPort' finding for one of the instances. The security engineer verified that the ALB security group only allows inbound HTTP/HTTPS from the internet. However, the finding indicates that the instance is receiving probes on port 22 (SSH). Further investigation with Detective shows that the probes originate from multiple IP addresses and are reaching the instance's private IP address. The engineer suspects that the SSH port is exposed despite the security group configuration. What is the MOST likely cause of this exposure?

Accepted Answer

The EC2 instance's security group allows inbound SSH from 0.0.0.0/0.. The GuardDuty finding 'Recon:EC2/PortProbeUnprotectedPort' indicates that an EC2 instance is receiving unsolicited probes on a port that should not be publicly accessible. Since the ALB security group only allows HTTP/HTTPS from the internet, but the probes are reaching the instance's private IP on port 22 (SSH), the most likely cause is that the instance's own security group has an inbound rule allowing SSH from 0.0.0.0/0. This bypasses the ALB's security group because the instance's security group is evaluated independently for direct traffic to the instance's private IP, and if it permits SSH from anywhere, the probes will reach the instance.

Answer

VPC Flow Logs are misconfigured and are inadvertently forwarding traffic to the instance.

Answer

AWS Shield Advanced is causing false positives by marking legitimate traffic as probes.

Answer

The ALB security group has an inbound rule that allows SSH from the internet.

Question 4

A company is implementing a data loss prevention (DLP) solution for data stored in Amazon S3. The data includes personally identifiable information (PII). The company wants to automatically identify and classify PII objects, then apply encryption using AWS KMS with a customer-managed key. Which AWS service should be used to identify PII?

Accepted Answer

Amazon Macie. Amazon Macie is the correct service because it uses machine learning and pattern matching to automatically discover, classify, and protect sensitive data such as PII in Amazon S3. AWS CloudTrail (Option A) logs API calls and does not inspect data content. Amazon GuardDuty (Option C) detects threats and unauthorized behavior, not data classification. AWS Config (Option D) evaluates resource configurations and compliance, not data content. Therefore, Option B is correct.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS Config

Question 5

A security engineer is designing a VPC with a public subnet and a private subnet. The private subnet will host a database instance that should only be accessible from the application instances in the public subnet. The application instances use an Auto Scaling group. Which configuration ensures that only the application instances can access the database?

Accepted Answer

Allow inbound database port from the security group attached to the application instances in the public subnet.. Referencing the application instances' security group as the source in the database security group's inbound rule allows only instances that carry that security group to connect. Because the Auto Scaling group applies the same security group to all instances, this dynamically permits all current and future application instances without hardcoding CIDRs. This is the only option that restricts access to the application instances specifically.

Answer

Allow inbound database port from 0.0.0.0/0 in the database security group.

Answer

Configure a network ACL on the private subnet to allow the database port from the public subnet CIDR.

Answer

Allow inbound database port from the public subnet CIDR block in the database security group.

Question 6

A company uses AWS Organizations to manage multiple accounts. The security team wants to centralize threat detection across all accounts. They enable Amazon GuardDuty in the management account and intend to use delegated administrator functionality. However, they find that GuardDuty is not detecting threats in member accounts. What is the most likely cause?

Accepted Answer

GuardDuty is not enabled in the member accounts. The security team must invite member accounts or use the delegated administrator to enable GuardDuty in all accounts.. Amazon GuardDuty must be enabled in each member account to detect threats in those accounts. When using the delegated administrator model, the security team can enable GuardDuty across all accounts programmatically via the delegated administrator API, but they must explicitly perform this action. Simply enabling GuardDuty in the management account does not automatically activate it in member accounts, which is why no threats are detected in those accounts.

Answer

GuardDuty requires an S3 bucket in each account to store findings.

Answer

GuardDuty only monitors the management account's resources, not member accounts.

Answer

GuardDuty does not support delegated administrator for AWS Organizations.

Question 7

Drag and drop the steps to respond to a suspected AWS IAM credential compromise in the correct order.

Accepted Answer

Rotate IAM user access keys, then review CloudTrail logs, then disable the IAM user, then revoke temporary credentials, then notify stakeholders.. Credential compromise response starts with rotation, log review, disabling user, revoking temp creds, and notification.

Answer

Review CloudTrail logs, then rotate IAM user access keys, then disable the IAM user, then revoke temporary credentials, then notify stakeholders.

Answer

Disable the IAM user, then rotate IAM user access keys, then review CloudTrail logs, then revoke temporary credentials, then notify stakeholders.

Answer

Notify stakeholders, then rotate IAM user access keys, then review CloudTrail logs, then disable the IAM user, then revoke temporary credentials.

Question 8

A company is using AWS WAF to protect its Application Load Balancer (ALB). The security team wants to block requests that do not contain a valid API key in the HTTP header 'X-API-Key'. Which WAF rule type should be used?

Accepted Answer

Regex pattern set. A regex pattern set rule is the correct choice because it allows you to define a regular expression pattern that matches the expected format of valid API keys in the 'X-API-Key' header. AWS WAF regex pattern sets can be used in a rule to inspect the header value and block requests that do not match the pattern, providing flexible and precise validation beyond simple string matching.

Answer

String match condition

Answer

Rate-based rule

Answer

IP set

Question 9

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. Which component should be added to the VPC to enable this?

Accepted Answer

NAT gateway. A NAT gateway allows instances in private subnets to initiate outbound internet traffic while preventing inbound traffic from the internet. It is placed in a public subnet and uses an Elastic IP, and private subnet route tables point to it for 0.0.0.0/0.

Answer

Internet gateway

Answer

VPN connection

Answer

VPC peering connection

Question 10

A company uses AWS KMS to encrypt secrets stored in AWS Secrets Manager. The security team wants to audit all KMS key usage, including attempts to use the key without proper authorization. Which AWS service should the team use to meet this requirement?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records every API call made to KMS, including successful and failed attempts to use, encrypt, decrypt, or manage keys. Failed attempts due to insufficient permissions are logged as AccessDenied errors, giving the security team the audit trail they need. CloudTrail is the authoritative service for API-level auditing across AWS.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 11

A company wants to allow users from an external AWS account to assume an IAM role in its account. What must be configured in both accounts?

Accepted Answer

Both the trusting account's role trust policy and the external account's IAM policy to allow sts:AssumeRole.. Cross-account role assumption requires a two-sided trust relationship. The trusting account (where the role lives) must have a trust policy that names the external account as a Principal and allows sts:AssumeRole. The external account must also grant its users or roles an IAM policy permitting sts:AssumeRole on the role ARN, otherwise the request is denied even if the trust policy allows it.

Answer

An IAM password policy in both accounts.

Answer

Only the trusting account's role trust policy.

Answer

Only the external account's IAM policy to allow sts:AssumeRole.

Question 12

A company is implementing a multi-account strategy using AWS Organizations. The security team wants to enforce that all newly created member accounts automatically have an IAM role that allows read-only access to the management account. Which configuration should be used?

Accepted Answer

Use AWS CloudFormation StackSets to deploy the role to all existing and future accounts.. AWS CloudFormation StackSets is the correct service for deploying a common IAM role across multiple accounts, including automatically to new accounts as they are added to the organization. When you create a StackSet with service-managed permissions, you can enable automatic deployments so that the stack instance is created in every new account that joins the target organizational unit (OU). This directly satisfies the requirement to enforce the role's presence in all newly created member accounts without custom automation.

Answer

Create an AWS Lambda function that listens for AWS CloudTrail CreateAccount events and creates the role in the new account.

Answer

Use an AWS Config managed rule to evaluate new accounts and trigger a remediation action to create the role.

Answer

Configure an SCP with the 'iam_role' setting to specify a role name and path to be automatically created in new accounts.

Question 13

A company is designing a multi-tier web application. The web servers must be accessible from the internet, but the application servers must only be accessible from the web servers. Which AWS feature should be used to meet these requirements?

Accepted Answer

Use security groups with rules that allow inbound traffic to the web servers from the internet, and allow inbound traffic to the application servers only from the web server security group.. Security groups are stateful, instance-level virtual firewalls in AWS. By allowing inbound internet traffic to the web server security group and then allowing inbound traffic to the application server security group only from the web server security group (referencing the SG as the source), you enforce that only web servers can reach application servers. This is the standard AWS pattern for tiered isolation.

Answer

Use a VPC peering connection between the web tier and application tier subnets.

Answer

Use network ACLs to allow inbound traffic to the web tier from the internet and to the application tier only from the web tier.

Answer

Use a VPN connection to isolate the application tier from the web tier.

Question 14

A security engineer is configuring an automated response to a GuardDuty finding that indicates a compromised EC2 instance. The engineer wants to isolate the instance by changing its security group to a 'quarantine' group. Which AWS service is BEST suited to automate this response?

Accepted Answer

Amazon EventBridge. Amazon EventBridge is the best choice because it can directly receive GuardDuty findings as events and trigger an automated response, such as invoking a Lambda function or Systems Manager Automation runbook to change the EC2 instance's security group to a quarantine group. EventBridge provides native integration with GuardDuty via its default event bus, enabling real-time, event-driven automation without additional orchestration overhead.

Answer

AWS Step Functions

Answer

AWS Config

Answer

AWS Systems Manager Automation

Question 15

An IAM policy includes the following statement: 'Effect': 'Deny', 'Action': 's3:*', 'Resource': '*', 'Condition': {'Bool': {'aws:SecureTransport': 'false'}}. What does this policy do?

Accepted Answer

Denies all S3 actions when the request is not using HTTPS.. The policy statement has an explicit Deny effect for all S3 actions on all resources, with a condition that the request must have aws:SecureTransport set to false. aws:SecureTransport is a global condition key that evaluates to true if the request uses SSL/TLS, and false otherwise. Therefore, the policy denies all S3 actions when the request is not using HTTPS (i.e., when SecureTransport is false).

Answer

Denies all S3 actions to a specific bucket.

Answer

Denies all S3 actions for all users.

Answer

Allows all S3 actions only when using HTTPS.

Question 16

A developer needs to grant an IAM user read-only access to an S3 bucket containing sensitive data. The bucket is encrypted with an AWS KMS customer managed key. Which set of permissions must be included in the IAM policy?

Accepted Answer

s3:GetObject, kms:Decrypt. To read objects from an encrypted S3 bucket, the user needs both s3:GetObject to retrieve the object and kms:Decrypt to decrypt the object using the KMS key. Option A is wrong because it includes kms:Encrypt instead of kms:Decrypt; decryption is required, not encryption. Option C is wrong because it lacks s3:GetObject permission, which is necessary to retrieve the object. Option D is wrong because it includes s3:ListBucket, which is not required for reading a specific object, and it lacks s3:GetObject.

Answer

s3:GetObject, kms:Encrypt

Answer

kms:Decrypt

Answer

s3:ListBucket, kms:Decrypt

Question 17

A company wants to receive real-time notifications when an IAM user in their AWS account performs a console login. Which AWS service should be used to monitor and alert on this activity?

Accepted Answer

AWS CloudTrail and Amazon EventBridge. AWS CloudTrail logs console login events, and Amazon EventBridge can be used to create rules that trigger notifications (e.g., via SNS) in real-time when such events occur. Option A is incorrect because IAM does not provide monitoring capabilities. Option B is incorrect because AWS Config is designed for tracking resource configuration changes, not API call activity. Option C is incorrect because Trusted Advisor offers best-practice recommendations and does not provide real-time monitoring of login events.

Answer

AWS IAM

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 18

A company uses AWS Key Management Service (KMS) to encrypt sensitive data in Amazon S3. The security team needs to ensure that the KMS key can only be used from within the company's VPC and not from the public internet. How can this be achieved?

Accepted Answer

Create a VPC endpoint for KMS and modify the KMS key policy to allow usage only from the specified VPC endpoint.. To restrict KMS key usage to a VPC, you create a VPC endpoint for KMS (an interface endpoint powered by AWS PrivateLink) and then modify the KMS key policy to allow usage only from that VPC endpoint. This ensures that requests to KMS must come through the VPC endpoint, not the public internet.

Answer

Use an SCP to deny kms:Encrypt unless the request comes from the VPC.

Answer

Use AWS CloudTrail to monitor KMS calls and alert if they come from outside the VPC.

Answer

Create a VPC endpoint for KMS and attach a bucket policy that requires the endpoint.

Question 19

A company uses Amazon GuardDuty to monitor for malicious activity in their AWS account. The security team receives a GuardDuty finding that indicates an EC2 instance is communicating with a known cryptocurrency mining pool. The team needs to investigate the finding and determine which security group rules allowed the outbound traffic. The EC2 instance is in a VPC with a single security group attached. Which AWS service should the security team use to review the outbound traffic details?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic metadata — including source/destination IP, ports, protocol, and ACCEPT/REJECT action — for network interfaces in a VPC. Reviewing flow logs for the EC2 instance's ENI reveals which outbound traffic was allowed and, combined with the security group rules, identifies the rule that permitted the connection to the mining pool.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon GuardDuty

Question 20

A security team wants to detect and alert on API calls that create or modify IAM roles in their AWS account. Which AWS service can be used to create a metric filter and alarm for these specific CloudTrail events?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs can create metric filters on CloudTrail log data to detect specific API calls, such as CreateRole or UpdateAssumeRolePolicy. These metric filters can then trigger CloudWatch alarms for real-time notification. CloudTrail delivers logs to CloudWatch Logs, but the metric filter and alarm capabilities reside in CloudWatch Logs, not in CloudTrail itself.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

AWS Config