SCS-C02 Practice Exam 63 — 20 Questions

Question 1

A company needs to encrypt data in transit between an on-premises data center and Amazon S3. Which solution should they use?

Accepted Answer

Use HTTPS endpoints for S3 API calls.. HTTPS (HTTP over TLS) encrypts data in transit between the on-premises data center and Amazon S3 by using TLS 1.2/1.3 to secure the API calls. This ensures that all data transmitted over the network is encrypted end-to-end, protecting it from eavesdropping and man-in-the-middle attacks. AWS S3 enforces HTTPS for all API requests when using the default endpoint, and customers can also configure bucket policies to deny HTTP requests.

Answer

Use AWS KMS to encrypt the data before transmission.

Answer

Use an S3 VPC endpoint.

Answer

Use S3 Transfer Acceleration.

Question 2

A company uses AWS Organizations with multiple accounts. The security team wants to detect suspicious API activity across all accounts in real time. They have enabled AWS CloudTrail in all accounts and are sending logs to a centralized S3 bucket. However, they are receiving alerts only after a significant delay. What should the security team do to reduce the latency of threat detection?

Accepted Answer

Set up Amazon EventBridge rules in each account to send specific CloudTrail events to a centralized event bus for immediate processing.. Amazon EventBridge can be configured with rules in each account to forward specific CloudTrail events to a centralized event bus in near real time, bypassing the latency introduced by CloudTrail log delivery to S3 (which can be up to 15 minutes). This allows the security team to process and alert on suspicious API activity immediately as events occur, rather than waiting for log files to be delivered and processed.

Answer

Enable Amazon GuardDuty in each account and configure it to send findings to a centralized S3 bucket.

Answer

Configure CloudTrail to deliver logs to a single S3 bucket and use S3 Event Notifications to trigger a Lambda function.

Answer

Use Amazon CloudWatch Logs Insights to query CloudTrail logs across accounts in real time.

Question 3

A company stores sensitive customer data in Amazon S3. To comply with data protection regulations, they need to automatically prevent any new objects from being made publicly accessible. Which S3 feature should they configure?

Accepted Answer

Enable S3 Block Public Access at the account level.. S3 Block Public Access at the account level applies a blanket deny on any policy or ACL that would make an object or bucket public, and it overrides bucket policies and ACLs. Enabling it at the account level ensures all current and future buckets in the account are protected from accidental public exposure. This is the AWS-recommended preventive control for data protection compliance.

Answer

Configure a bucket policy that denies s3:PutObject with a condition for public access.

Answer

Use S3 default encryption with SSE-S3.

Answer

Enable S3 Object Lock in governance mode.

Question 4

Refer to the exhibit. A security engineer configures the above KMS key policy. The DataAccess role is used by an application that runs on EC2 instances in the us-east-1 region. The application needs to read encrypted objects from an S3 bucket in the same region. Which of the following is true about this configuration?

Accepted Answer

The role can decrypt objects in S3, but cannot use the key outside of S3.. The key policy includes a condition 'kms:ViaService' that restricts use of the key to requests that originate from S3 in us-east-1. The DataAccess role has permissions to call kms:Decrypt and kms:GenerateDataKey. With kms:Decrypt, the role can decrypt objects in S3 (e.g., via S3 GetObject with SSE-KMS). The role can also encrypt objects via S3 PutObject using kms:GenerateDataKey. However, the 'kms:ViaService' condition prevents the role from using the key for any operation outside of S3 (e.g., direct KMS API calls). Option A is incorrect because the condition restricts usage to S3 in us-east-1 only, not any region or any operation. Option B is incorrect because the condition 'kms:ViaService' is syntactically valid and functions as intended. Option C is incorrect because the role has kms:GenerateDataKey, which allows encryption via S3 PutObject, and kms:Decrypt for decryption, so it can both encrypt and decrypt.

Answer

The role can use the key for any S3 operation in any region.

Answer

The role cannot use the key for any operation because the condition is invalid.

Answer

The role can only encrypt data, not decrypt it.

Question 5

A company needs to centralize security logs from multiple AWS accounts and on-premises servers. The logs must be encrypted at rest and stored in a cost-effective manner. Which solution meets these requirements?

Accepted Answer

Use Amazon S3 with server-side encryption (SSE-S3). Amazon S3 with server-side encryption (SSE-S3) meets the requirements because it provides encryption at rest using AES-256, is cost-effective for log storage, and can centralize logs from multiple AWS accounts and on-premises servers via S3 Cross-Account Access and the S3 API. SSE-S3 is fully managed by AWS, requiring no additional key management overhead, and S3's lifecycle policies can transition older logs to lower-cost tiers like S3 Glacier for further cost savings.

Answer

Use Amazon S3 Glacier with Vault Lock

Answer

Use Amazon Kinesis Data Firehose to deliver logs to Amazon Redshift

Answer

Use Amazon CloudWatch Logs with KMS encryption

Question 6

A security engineer reviews the above IAM policy attached to an IAM user. The user reports that they cannot download objects from the S3 bucket 'example-bucket' when connected from the office network (IP range 10.0.0.0/16). What is the most likely cause?

Accepted Answer

The source IP condition does not match the user's actual IP address. The IAM policy includes a `Condition` block using `aws:SourceIp` that restricts allowed IP addresses to the range 10.0.0.0/16. If the user's actual office network IP address falls outside this range (e.g., due to NAT or a different subnet), the condition fails, and the `s3:GetObject` action is denied, even though the user has the necessary permissions in the `Action` field.

Answer

The bucket policy overrides the IAM policy

Answer

The policy does not allow the s3:GetObject action

Answer

The user is not assuming the correct IAM role

Question 7

A company needs to centrally manage access to AWS resources across multiple accounts. Which AWS service should be used to define and enforce a set of common permissions for all accounts in the organization?

Accepted Answer

AWS Organizations with SCPs. AWS Organizations with Service Control Policies (SCPs) allows you to centrally manage and enforce permissions across all accounts in an organization. SCPs define the maximum permissions for accounts and can be applied to the root, OUs, or individual accounts. Option A (AWS Directory Service) is for managed directory services, not for permissions management. Option B (IAM) is per-account and does not centrally manage multiple accounts. Option C (AWS SSO) is for federated access, not for enforcing permissions boundaries.

Answer

AWS Directory Service

Answer

AWS IAM

Answer

AWS Single Sign-On (SSO)

Question 8

A company uses AWS Organizations and wants to restrict the AWS Regions in which resources can be created across all member accounts. Which mechanism should be used?

Accepted Answer

Apply a service control policy (SCP) that denies operations in unauthorized regions.. A service control policy (SCP) in AWS Organizations can be used to restrict the AWS Regions in which resources can be created across all member accounts. SCPs define the maximum permissions for accounts and can deny actions in unauthorized regions.

Answer

Use VPC endpoints to restrict API calls to specific regions.

Answer

Configure AWS Config rules to detect and delete resources in unauthorized regions.

Answer

Attach an IAM policy to each user that denies operations in unauthorized regions.

Question 9

A company needs to encrypt data at rest in Amazon Redshift. They want to use an AWS KMS customer managed key. What is the correct procedure to enable encryption for an existing Redshift cluster?

Accepted Answer

Take a snapshot of the cluster, restore it to a new cluster with encryption enabled, and point applications to the new cluster.. Amazon Redshift does not support enabling encryption on an existing cluster directly. The only way to transition an unencrypted cluster to an encrypted one is to take a snapshot of the cluster, restore it to a new cluster with encryption enabled using a KMS customer managed key, and then redirect applications to the new cluster. This is because encryption settings are immutable after cluster creation.

Answer

Enable encryption using the Redshift console by selecting the KMS key.

Answer

Use the AWS CLI command 'aws redshift modify-cluster' with --encrypted flag.

Answer

Modify the cluster and enable encryption with the KMS key.

Question 10

A security engineer is investigating a potential compromise. An EC2 instance running Amazon Linux 2 is sending outbound traffic to a known malicious IP address. The engineer needs to capture the network traffic for analysis without alerting the attacker. Which solution meets these requirements?

Accepted Answer

Use VPC Traffic Mirroring to mirror the EC2 instance's ENI traffic to a monitoring appliance in a separate VPC.. VPC Traffic Mirroring captures all network traffic at the packet level from the EC2 instance's Elastic Network Interface (ENI) and forwards it to a monitoring appliance without any inline processing or modification of the traffic. This allows the security engineer to perform deep packet analysis while remaining completely transparent to the attacker, as the mirrored traffic is a copy and does not affect the original flow. Unlike other options, Traffic Mirroring provides full packet capture (including headers and payloads) for forensic analysis, which is essential for investigating a compromise.

Answer

Enable VPC Flow Logs on the ENI and stream to Amazon S3 for analysis.

Answer

Attach a security group to the instance that logs all traffic to CloudWatch Logs.

Answer

Enable AWS Network Firewall on the VPC and configure a rule to log all traffic to the malicious IP.

Question 11

A security engineer is auditing IAM policies. The engineer wants to identify if any policy grants 'Effect: Allow' with 'Action: *' and 'Resource: *'. Which TWO AWS services can be used to detect such overly permissive policies?

Accepted Answer

AWS Config. AWS Config [CORRECT] is right because it continuously evaluates IAM policies against managed or custom rules (e.g., iam-policy-no-statements-with-admin-access) and can flag policies containing Effect: Allow with Action: * and Resource: *, which is exactly the overly permissive pattern being audited. IAM Access Analyzer [CORRECT] is also correct because its policy validation and findings (including checks for overly permissive policies such as those granting full administrative access) can identify policies with Action: * and Resource: * on Allow statements. AWS CloudTrail is not correct because it records API activity and events, not policy permission analysis. AWS Trusted Advisor is not correct because its security checks focus on broad best-practice items like open ports or MFA, not parsing IAM policy statements for wildcard Action/Resource. Amazon GuardDuty is not correct because it detects suspicious activity and threats from logs, not static IAM policy permissiveness.

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Question 12

An IAM policy allows a user to pass a specific role and launch EC2 instances. The user tries to launch an EC2 instance with the role 'ec2-full-access' but receives an error: 'You are not authorized to perform iam:PassRole'. What is the MOST likely cause?

Accepted Answer

The user is attempting to pass a role with an ARN that does not exactly match the one in the policy. The error 'You are not authorized to perform iam:PassRole' indicates that the iam:PassRole permission is being denied. In IAM policies, the Resource element for iam:PassRole must specify the exact ARN of the role that can be passed. If the user attempts to pass a role whose ARN does not exactly match the ARN in the policy (e.g., due to a different path, account ID, or role name), the PassRole action is not allowed, resulting in this error. Therefore, the most likely cause is that the role ARN being passed does not match the ARN specified in the policy.

Answer

The role 'ec2-full-access' does not exist in the account

Answer

The policy is missing a condition key such as ec2:InstanceProfile

Answer

The user does not have permission to call ec2:RunInstances

Question 13

A company needs to monitor its AWS environment for compliance with the CIS AWS Foundations Benchmark. The security team wants to automatically check for non-compliant resources and receive reports. Which THREE services should be used together to meet these requirements? (Choose THREE.)

Accepted Answer

AWS Security Hub. AWS Security Hub (B) is correct because it natively supports the CIS AWS Foundations Benchmark as a security standard, aggregates findings from integrated services, and generates compliance scores and reports against that benchmark. AWS Config (C) is correct because it provides configuration recording and managed/custom rules that evaluate resource compliance, and Security Hub's CIS standard relies on AWS Config rules to assess many controls. Amazon GuardDuty (D) is not required for CIS AWS Foundations Benchmark compliance checking or reporting; it is a threat-detection service whose findings can be viewed in Security Hub but does not evaluate CIS controls. Amazon Detective (A) is used for investigating and visualizing security findings after they occur, and Amazon Macie (E) discovers and classifies sensitive data in S3; neither is part of the CIS compliance-checking and reporting workflow.

Answer

Amazon Detective

Answer

Amazon GuardDuty

Answer

Amazon Macie

Question 14

A company needs to enforce that all Amazon S3 buckets are encrypted at rest. Which TWO actions should be taken? (Choose two.)

Accepted Answer

Use bucket policies to deny write operations without encryption.. Option B is correct because a bucket policy with a Deny effect on s3:PutObject when the request lacks the s3:x-amz-server-side-encryption header (or uses an unapproved algorithm) actively blocks unencrypted uploads, enforcing encryption at rest at the object level. Option C is correct because enabling default encryption (SSE-S3 or SSE-KMS) on each bucket ensures any object PUT without explicit encryption headers is automatically encrypted at rest. Option A is incorrect because CloudTrail only records API activity for auditing; it does not enforce encryption. Option D is incorrect because creating a KMS key alone does not apply it to buckets or enforce encryption; the key must be referenced in bucket policies or default encryption settings. Option E is incorrect because denying s3:PutBucketPublicAccessBlock addresses public access blocking, not encryption at rest.

Answer

Enable AWS CloudTrail to log S3 API calls.

Answer

Create a KMS key and apply it to all buckets.

Answer

Use a service control policy (SCP) to deny the s3:PutBucketPublicAccessBlock action.

Question 15

A security engineer is investigating a potential breach. The engineer notices that an EC2 instance's security group allows inbound SSH (port 22) from 0.0.0.0/0. The instance is in a public subnet and has a public IP address. However, the engineer finds that SSH access is only possible from a specific IP address. What is the most likely explanation?

Accepted Answer

The network ACL denies inbound SSH from all IPs except the specific IP. Security groups in AWS are stateful and allow-only — they cannot deny traffic. If a security group permits SSH from 0.0.0.0/0 but access is restricted to one IP, the restriction must come from a stateless network ACL, which supports both allow and deny rules and is evaluated before the security group. A network ACL that denies SSH from all sources except the specific IP would produce exactly this observed behavior. This is the only option that explains a restriction despite a permissive security group.

Answer

The network ACL allows inbound SSH from 0.0.0.0/0

Answer

The security group rule is being overridden by a more restrictive security group attached to the same instance

Answer

The security group rule is being evaluated but the instance's operating system firewall is blocking SSH

Question 16

A company is using AWS CloudTrail to log API calls. The security team wants to ensure that the logs are protected from unauthorized access and deletion. Which TWO actions should be taken?

Accepted Answer

Enable server-side encryption using AWS KMS (SSE-KMS) on the S3 bucket.. Enabling server-side encryption using AWS KMS (SSE-KMS) on the S3 bucket that stores CloudTrail logs ensures that the log files are encrypted at rest, protecting them from unauthorized access. This encryption uses envelope encryption with a customer-managed or AWS-managed KMS key, providing an additional layer of access control via KMS key policies and IAM policies. Option C is correct because CloudTrail log file validation creates a signed digest file for each log file, allowing you to verify that the logs have not been tampered with, deleted, or modified after delivery. This uses SHA-256 hashing and digital signing with the private key of AWS, ensuring integrity and authenticity of the log files.

Answer

Use S3 bucket ACLs to restrict access.

Answer

Enable S3 Versioning on the bucket.

Answer

Enable multi-factor authentication (MFA) for CloudTrail.

Question 17

A company has a security group that allows inbound SSH from 0.0.0.0/0. The security team wants to restrict access to only the company's public IP range 203.0.113.0/24. What change should be made?

Accepted Answer

Modify the inbound SSH rule in the security group to source 203.0.113.0/24.. Security groups are stateful and act as a virtual firewall for instances. To restrict inbound SSH access from 0.0.0.0/0 to only the company's public IP range, you must modify the existing inbound rule's source CIDR from 0.0.0.0/0 to 203.0.113.0/24. This change directly updates the allowed source IP range, and since security groups evaluate all rules before making a decision, the more specific allowed range will take effect without needing additional rules.

Answer

Add a network ACL rule to deny SSH from 0.0.0.0/0.

Answer

Add a network ACL rule to allow SSH from 203.0.113.0/24.

Answer

Remove the inbound SSH rule from the security group.

Question 18

A security engineer needs to ensure that an Amazon RDS for MySQL database is encrypted at rest. Which action should be taken?

Accepted Answer

Create a new DB instance with encryption enabled.. Amazon RDS does not support enabling encryption on an existing unencrypted DB instance. Encryption at rest must be configured at instance creation time by selecting the KMS key. Therefore, the only valid path is to create a new DB instance with encryption enabled and migrate data to it.

Answer

Use a client-side encryption tool to encrypt data before writing to the database.

Answer

Use AWS KMS to encrypt individual databases within the instance.

Answer

Enable encryption on an existing unencrypted DB instance.

Question 19

A company is using AWS KMS to encrypt data at rest in Amazon S3. The security team requires that all encryption keys be automatically rotated every year. However, the current KMS key policy does not allow rotation. Which action should the security team take to meet the requirement?

Accepted Answer

Use an AWS managed key instead of a customer managed key.. AWS managed keys are automatically rotated annually by AWS. This meets the requirement without needing to modify the existing key policy. Option A is wrong because manually rotating the key by creating a new key and updating the S3 bucket policy does not provide automatic rotation and is not the simplest solution. Option C is wrong because customer managed keys with imported key material do not support automatic rotation. Option D is wrong because the existing key policy does not allow rotation, so enabling automatic rotation on that key would fail; the correct approach is to use an AWS managed key.

Answer

Manually rotate the key by creating a new key and updating the S3 bucket policy.

Answer

Create a new customer managed key with imported key material and enable automatic rotation.

Answer

Enable automatic rotation on the existing customer managed key.

Question 20

A company's Security team is using AWS Organizations with a consolidated billing account. The security team wants to ensure that all member accounts have AWS CloudTrail enabled and that logs are delivered to a central S3 bucket in the management account. Which combination of actions should the security team take? (Choose the best answer.)

Accepted Answer

Use an SCP to deny disabling CloudTrail and use CloudFormation StackSets to deploy CloudTrail in all accounts.. Using an SCP to deny disabling CloudTrail and a CloudFormation StackSet to deploy CloudTrail in each account ensures enforcement and deployment across all member accounts. Option A is wrong because AWS Config rules can detect but not prevent disabling of CloudTrail. Option B is wrong because an IAM policy requiring account owners to enable CloudTrail is not enforceable and relies on individual action. Option C is wrong because enabling CloudTrail only in the management account does not enable it in member accounts; cross-account logging requires member accounts to have CloudTrail configured.

Answer

Use AWS Config rules to detect when CloudTrail is disabled.

Answer

Create a new IAM policy that requires each account owner to enable CloudTrail.

Answer

Enable CloudTrail in the management account only and use cross-account logging.