SCS-C02 Practice Exam 64 — 20 Questions

Question 1

A company runs a web application on Amazon EC2 instances that processes credit card data. The application must store the data in an encrypted format. The security team wants to minimize the performance impact of encryption and offload the encryption operations to a dedicated hardware security module (HSM). Which solution should the architect choose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS CloudHSM to perform encryption operations from the application.. AWS CloudHSM provides dedicated hardware security modules that can perform cryptographic operations, including encryption, offloading the work from the application's CPU. It is designed for applications that require dedicated HSM hardware for compliance or performance reasons. Using CloudHSM allows the application to call the HSM for encryption, minimizing performance impact on the EC2 instance.

Answer

Use Amazon EBS encryption on the EC2 instance's root volume.

Answer

Use the Linux dm-crypt utility to encrypt the data at the application level.

Answer

Use AWS KMS with a customer-managed key to encrypt the data in the application.

Question 2

During a security incident, a security engineer needs to capture network traffic from an EC2 instance for forensic analysis. The instance is part of an Auto Scaling group and may be terminated. What is the MOST efficient way to capture the traffic without affecting the instance's performance?

Accepted Answer

Use VPC Traffic Mirroring to mirror the instance's network traffic.. VPC Traffic Mirroring captures all network traffic at the hypervisor level without installing agents or consuming instance CPU/memory, making it ideal for forensic analysis of an EC2 instance that may be terminated. It works by copying packets from the source ENI to a target (e.g., a Network Load Balancer or another ENI) for inspection, ensuring zero performance impact on the production instance. This approach preserves traffic even if the instance is later terminated, as the mirror session is tied to the ENI, not the instance lifecycle.

Answer

Enable VPC Flow Logs for the subnet.

Answer

SSH into the instance and run tcpdump to capture packets.

Answer

Attach a Network Load Balancer in front of the instance.

Question 3

An organization wants to enforce multi-factor authentication (MFA) for all IAM users who perform sensitive actions. Which condition key should be used in an IAM policy to require MFA?

Accepted Answer

aws:MultiFactorAuthPresent. The condition key 'aws:MultiFactorAuthPresent' is used in IAM policies to check whether the principal authenticated with MFA. When set to 'true' in a policy condition, it requires that the user has presented a valid MFA token for the request to be allowed, making it the correct choice for enforcing MFA on sensitive actions.

Answer

aws:SourceIp

Answer

aws:UserAgent

Answer

aws:CurrentTime

Question 4

A company wants to audit all changes to security group rules in their AWS account. Which AWS service should be used to record these changes?

Accepted Answer

AWS CloudTrail.. AWS CloudTrail is the correct service because it records API calls made to the AWS environment, including changes to security group rules via the EC2 AuthorizeSecurityGroupIngress, RevokeSecurityGroupIngress, AuthorizeSecurityGroupEgress, and RevokeSecurityGroupEgress API actions. These events are captured as management events in CloudTrail, providing a complete audit trail of who made the change, when, from which IP address, and the exact parameters of the rule modification.

Answer

Amazon CloudWatch Logs.

Answer

VPC Flow Logs.

Answer

AWS Config.

Question 5

A security engineer is auditing an S3 bucket policy that allows cross-account access. The engineer wants to ensure that only encrypted connections are permitted. Which condition should be added to the policy?

Accepted Answer

aws:SecureTransport. The aws:SecureTransport condition key evaluates to true when the request is made over HTTPS/TLS and false over HTTP. Adding a Deny statement with 'aws:SecureTransport: false' ensures that any non-TLS request to the bucket is rejected, enforcing encrypted connections.

Answer

aws:SourceIp

Answer

aws:Referer

Answer

s3:x-amz-server-side-encryption

Question 6

A company wants to automate the enforcement of security best practices across all AWS accounts in an organization. The solution should automatically remediate noncompliant resources. Which AWS service should be used to achieve this?

Accepted Answer

AWS Config rules with auto-remediation. AWS Config rules evaluate resource configurations against desired states and can trigger automatic remediation via SSM Automation documents when a resource is noncompliant. With AWS Organizations integration, Config can aggregate compliance across all accounts and apply remediation centrally, making it the correct choice for automated enforcement with remediation.

Answer

AWS Organizations service control policies (SCPs)

Answer

AWS IAM Access Analyzer

Answer

Amazon GuardDuty

Question 7

A company wants to enforce that all IAM users in an AWS account must have multi-factor authentication (MFA) enabled. Which AWS service can be used to automatically detect and remediate non-compliant users?

Accepted Answer

AWS Config. AWS Config continuously records resource configurations and evaluates them against rules. A managed rule such as 'iam-user-mfa-enabled' detects IAM users without MFA, and Config remediation actions (via SSM Automation documents) can automatically enforce MFA or disable non-compliant users. This gives both detection and automated remediation in a single service, matching the requirement.

Answer

AWS Trusted Advisor

Answer

AWS IAM Access Analyzer

Answer

AWS CloudTrail

Question 8

A company uses Amazon S3 to store sensitive documents. The security policy requires that all objects be encrypted using server-side encryption with customer-provided keys (SSE-C). An application fails when trying to read an object with the error 'The request includes an invalid header.' What is the MOST likely cause?

Accepted Answer

The application did not include the x-amz-server-side-encryption-customer-key header in the GET request.. With SSE-C, the customer provides the encryption key on every request, and S3 does not store it. For a GET request, the client must include the same key headers used during PUT: x-amz-server-side-encryption-customer-algorithm, x-amz-server-side-encryption-customer-key, and x-amz-server-side-encryption-customer-key-MD5. If the key header is missing, S3 returns an 'invalid header' error because it cannot decrypt the object.

Answer

The application did not specify an encryption context in the request.

Answer

The KMS key used for encryption has been disabled.

Answer

The S3 bucket does not have versioning enabled.

Question 9

A company has a multi-account AWS Organization with hundreds of accounts. The security team wants to prevent any IAM user from creating access keys in any account. What is the most scalable and secure approach?

Accepted Answer

Apply an SCP that denies the IAM:CreateAccessKey action to all accounts in the organization.. Service Control Policies (SCPs) applied at the organization or OU level deny the IAM:CreateAccessKey action across every account in one place, which is the most scalable and preventive control. Because SCPs are inherited, a single policy blocks access key creation in all current and future accounts without per-account configuration.

Answer

Use IAM Access Analyzer to generate findings when access keys are created.

Answer

Configure IAM password policies in each account to disallow access keys.

Answer

Create an AWS Config rule in each account to automatically delete access keys.

Question 10

Which THREE are best practices for managing security in a multi-account AWS environment? (Choose three.)

Accepted Answer

Use SCPs to restrict permissions across accounts.. Option A is correct because AWS Organizations Service Control Policies (SCPs) are applied at the OU or account level and set the maximum available permissions for all IAM principals in member accounts, providing a centralized guardrail to restrict permissions across accounts. Option C is correct because a dedicated security account isolates security tooling (such as GuardDuty, Security Hub, and IAM Access Analyzer) and audit activities from production workloads, following AWS's recommended multi-account security structure. Option D is correct because centralizing logs in a dedicated security account (often via AWS Organizations CloudTrail organization trails and cross-account log destinations) protects audit data from tampering by account owners and enables unified monitoring and retention. Option B is incorrect because disabling CloudTrail removes the audit trail needed for incident response, compliance, and forensics; CloudTrail is a foundational detective control, not an optional cost to cut. Option E is incorrect because the root user has unrestricted access that cannot be limited by SCPs or IAM policies, so it should be locked away with MFA and never used for routine administrative tasks; least-privilege IAM roles or federated identities should be used instead.

Answer

Disable AWS CloudTrail in production accounts to reduce costs.

Answer

Use the root user of each account for administrative tasks.

Question 11

A security engineer needs to grant an EC2 instance access to an S3 bucket without storing long-term credentials on the instance. Which approach should the engineer use?

Accepted Answer

Create an IAM role with the required permissions and attach it to the EC2 instance as an instance profile.. An IAM role attached to an EC2 instance via an instance profile allows the instance to obtain temporary, automatically rotated credentials from the EC2 Instance Metadata Service (IMDS) at 169.254.169.254. This eliminates the need to embed long-term access keys anywhere on the instance or in the AMI. The instance assumes the role and receives short-lived STS credentials scoped to the role's permissions.

Answer

Generate an access key and secret key for an IAM user and store them in the EC2 instance.

Answer

Use an SCP to allow the EC2 instance to access the S3 bucket.

Answer

Store the credentials in the AMI used to launch the instance.

Question 12

An IAM policy allows the iam:PassRole action for a specific role only when the role is passed to EC2. A developer tries to launch an EC2 instance with this role, but fails. What is the most likely missing permission?

Accepted Answer

The developer does not have ec2:RunInstances permission.. iam:PassRole only authorizes the principal to hand a role to a service; it does not authorize the service action itself. To launch an EC2 instance, the developer must also have ec2:RunInstances in their identity-based policy. The scenario states the PassRole condition is correctly scoped to EC2, so the failure is most likely the absence of the EC2 launch permission. Without ec2:RunInstances, the API call is denied before PassRole is even evaluated.

Answer

The developer needs to create the role first.

Answer

The developer does not have iam:PassRole permission for the role.

Answer

The condition in the policy is incorrect; it should use 'ec2.amazonaws.com' as the service.

Question 13

A company uses AWS KMS to encrypt data in S3 buckets. The security team needs to ensure that KMS keys can only be used by specific IAM roles within the same account. Which key policy should be applied?

Accepted Answer

"Principal": {"AWS": "arn:aws:iam::123456789012:role/AllowedRole"}. A KMS key policy that names a specific IAM role ARN as the principal grants key usage only to that role, which directly satisfies the requirement to restrict key usage to specific IAM roles within the account. The key policy is the primary access control for a KMS key, and explicit role ARNs enforce least privilege at the key level.

Answer

"Principal": {"AWS": "arn:aws:iam::123456789012:*"}

Answer

"Principal": {"AWS": "*"}

Answer

"Principal": {"AWS": "arn:aws:iam::123456789012:root"}

Question 14

A security engineer is troubleshooting an issue where an IAM policy allows access to S3 but the user is denied access to a specific bucket. The policy has the following statement:

{
  "Effect": "Allow",
  "Action": "s3:*",
  "Resource": "*"
}

What is the most likely cause of the denial?

Accepted Answer

An explicit deny statement in a different policy (e.g., SCP, permissions boundary) is overriding the allow.. AWS evaluates all applicable policies using a union-of-allows model, but any explicit Deny anywhere in the evaluation chain (identity policy, resource policy, SCP, permissions boundary, session policy) wins over every Allow. A broad Allow like s3:* on * does not get 'narrowed' by AWS — it is simply overridden when an explicit Deny matches the same action/resource. The most likely cause is therefore an explicit Deny in an SCP, permissions boundary, or similar policy that targets the specific bucket.

Answer

The policy statement is too broad and AWS automatically denies access to specific buckets.

Answer

The S3 bucket has a bucket policy that denies access to the user.

Answer

The policy is attached to the user but the user is assuming a role that does not have S3 permissions.

Question 15

A company has an Amazon RDS for MySQL database in a private subnet. The security team wants to ensure that only an application server in the same VPC can connect to the database. Which security group configuration should be used?

Accepted Answer

Inbound rule on the RDS security group: allow MySQL on port 3306 from the security group ID of the application server.. Referencing the application server's security group ID as the source in the inbound rule for MySQL (port 3306) on the RDS security group allows traffic only from instances that are members of that security group, regardless of their IP addresses. This is the most secure and precise method, as it automatically adapts to changes in the application server's IP (e.g., after scaling or replacement) and avoids opening the database to the entire subnet or VPC CIDR.

Answer

Inbound rule on the RDS security group: allow MySQL on port 3306 from the VPC's CIDR.

Answer

Inbound rule on the RDS security group: allow MySQL on port 3306 from the subnet CIDR of the application server.

Answer

Inbound rule on the application server's security group: allow outbound MySQL to the RDS security group.

Question 16

An application running on an EC2 instance needs to read from an S3 bucket. What is the BEST practice for granting permissions to the EC2 instance?

Accepted Answer

Use an IAM role and attach it to the EC2 instance profile.. The best practice is to use an IAM role attached to the EC2 instance via an instance profile. This provides temporary, automatically rotated credentials to the instance, eliminating the need to hardcode or distribute long-term access keys. The instance profile allows the EC2 instance to assume the role and obtain credentials from the Instance Metadata Service (IMDS), which the AWS SDK and CLI use automatically. This approach follows the principle of least privilege and is the most secure and manageable method for granting AWS permissions to EC2 instances.

Answer

Store AWS access keys in the application code.

Answer

Create an IAM user and give access keys to the developer.

Answer

Use the root account credentials.

Question 17

A security engineer is reviewing the following IAM policy attached to an S3 bucket: 
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "10.0.0.0/8"
        }
      }
    }
  ]
}
The bucket contains sensitive data and should only be accessible from the corporate network (CIDR 10.0.0.0/8). However, the engineer is concerned that this policy might not be effective. What is the primary security concern with this policy?

Accepted Answer

The policy grants public access to the bucket because the Principal is "*", allowing anyone from the specified IP range to access objects.. The bucket policy uses `"Principal": "*"` combined with `"Effect": "Allow"`, which explicitly grants public access to anyone who meets the condition. While the condition restricts access to the `10.0.0.0/8` IP range, the policy itself is still a public bucket policy — it allows any authenticated or unauthenticated user from that IP range to read objects. This violates the principle of least privilege and exposes sensitive data to any user on the corporate network, not just authorized IAM roles or users.

Answer

The bucket policy does not include a Deny statement for requests outside the IP range, so the default allow might still permit access from other IPs.

Answer

The condition key aws:SourceIp only evaluates the IP address of the client, but if the request comes through a proxy, the IP might not match.

Answer

The policy uses s3:GetObject but does not include s3:ListBucket, so users cannot see the object list, but they can guess object keys.

Question 18

A company is using AWS KMS to encrypt data in Amazon S3. The security team wants to ensure that only a specific IAM role can decrypt the data. What is the MOST secure way to enforce this?

Accepted Answer

Configure the KMS key policy with a condition that allows only the role to decrypt. AWS KMS key policies are the primary resource-based access control for a KMS key. To ensure only a specific IAM role can decrypt, the key policy must explicitly allow that role (and no other principals) for kms:Decrypt, optionally with conditions. IAM policies alone cannot grant access to a KMS key unless the key policy also permits it, making the key policy the authoritative enforcement point.

Answer

Attach an IAM policy to the role granting kms:Decrypt

Answer

Disable the KMS key and re-enable it only when the role needs to decrypt

Answer

Configure an S3 bucket policy that denies all principals except the role

Question 19

An organization wants to use AWS Organizations to centrally manage permissions for multiple accounts. Which IAM feature is used to grant cross-account access within the organization?

Accepted Answer

IAM roles. IAM roles are the standard mechanism for granting cross-account access within AWS Organizations. A role in the target (trusting) account defines a trust policy that names principals in other accounts as trusted entities, and those principals call sts:AssumeRole to obtain temporary credentials scoped to the role's permissions policy. This avoids creating duplicate IAM users in every account and is the recommended pattern for centralized, auditable cross-account access.

Answer

Service control policies (SCPs)

Answer

Resource-based policies

Answer

IAM groups

Question 20

A company wants to ensure that all data in transit between its EC2 instances and an RDS database is encrypted. The instances and the database are in the same VPC. Which configuration step is necessary to achieve this?

Accepted Answer

Enable SSL/TLS on the RDS instance and configure the EC2 instances to connect using SSL.. To encrypt data in transit between EC2 instances and an RDS database within the same VPC, you must enable SSL/TLS on the RDS instance and configure the EC2 instances to connect using SSL. This ensures that the network traffic is encrypted at the transport layer, protecting against eavesdropping or man-in-the-middle attacks. AWS RDS supports SSL/TLS for most database engines, and the client must explicitly request an encrypted connection.

Answer

Enable encryption at rest for the RDS instance using AWS KMS.

Answer

Set up a VPN connection between the EC2 instances and the RDS database.

Answer

Configure the security group for the RDS instance to enforce encryption.