SCS-C02 Practice Exam 65 — 20 Questions

Question 1

A company has an AWS account with multiple S3 buckets that contain sensitive data. The security team wants to ensure that no public access is granted to any bucket. The team has enabled AWS Config and set up a rule to detect public buckets. The rule reports that all buckets are compliant. However, during a security review, a team member finds that one bucket has a bucket policy that grants 's3:GetObject' to 'Principal': '*'. Why did the AWS Config rule not detect this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The AWS Config rule only checks ACLs, not bucket policies.. The AWS Config managed rule 's3-bucket-public-read-prohibited' only checks for public read access via ACLs, not bucket policies. Therefore, a bucket policy granting 's3:GetObject' to 'Principal': '*' would not be flagged as non-compliant by this rule. To detect public access via bucket policies, a custom AWS Config rule or other mechanisms like IAM Access Analyzer are needed. Option A is incorrect because CloudTrail logs API calls but does not evaluate compliance. Option C is incorrect because the bucket is in the same account as per the scenario. Option D is incorrect because IAM Access Analyzer can analyze policies but does not enforce compliance rules.

Answer

AWS CloudTrail must be enabled for Config to evaluate policies.

Answer

The bucket is in a different AWS account.

Answer

IAM Access Analyzer must be enabled first.

Question 2

A security engineer is configuring CloudTrail to log all management events across all regions. The engineer wants to ensure that log files are delivered to an S3 bucket owned by a separate AWS account for centralized auditing. Which additional configuration is required to allow the S3 bucket in the other account to receive these logs?

Accepted Answer

Add a bucket policy to the destination S3 bucket that allows CloudTrail to write objects.. CloudTrail delivers log files to an S3 bucket in a separate account by writing objects across accounts. The destination bucket must have a bucket policy that explicitly grants CloudTrail (the service principal `cloudtrail.amazonaws.com`) permission to write objects (e.g., `s3:PutObject`). Without this policy, CloudTrail cannot deliver logs to the cross-account bucket, even if the source account has proper CloudTrail configuration.

Answer

Create an S3 bucket policy on the source account's bucket to allow cross-account access.

Answer

Enable S3 server-side encryption with KMS on the destination bucket.

Answer

Create an IAM role in the source account and attach a trust policy for CloudTrail.

Question 3

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The security team receives an alert from Amazon GuardDuty that one of the EC2 instances is generating outbound traffic to a known command-and-control (C2) IP address. The instance is part of an Auto Scaling group (ASG) with a minimum of 2 and maximum of 10 instances. The security incident response playbook instructs the team to isolate the compromised instance without affecting the application's availability. The team needs to preserve the instance for forensic analysis. Which action should the team take first?

Accepted Answer

Remove the instance from the ALB target group and attach a security group that denies all traffic.. Removing the instance from the ALB target group immediately stops new traffic from reaching the application, while attaching a security group that denies all traffic (e.g., a custom security group with no inbound/outbound rules) effectively isolates the instance at the network layer. This preserves the instance for forensic analysis and does not affect application availability, as the ASG will not automatically terminate the instance (since it is still running and healthy from the ASG's perspective). The ALB will continue to route traffic to the remaining healthy instances in the target group, maintaining service continuity.

Answer

Terminate the compromised EC2 instance and allow the ASG to launch a replacement.

Answer

Detach the EBS root volume from the instance and attach it to a forensic instance.

Answer

Shut down the instance from within the OS using AWS Systems Manager Run Command.

Question 4

A company is required to retain CloudTrail logs for 7 years for compliance. Which solution meets this requirement with the LEAST operational overhead?

Accepted Answer

Configure an S3 Lifecycle policy to transition logs to S3 Glacier Deep Archive after 90 days and expire after 7 years.. It uses an S3 Lifecycle policy to automatically transition CloudTrail logs to S3 Glacier Deep Archive after 90 days (reducing storage costs) and then expire (delete) the objects after 7 years, meeting the retention requirement with zero ongoing operational effort. This is the least operational overhead solution as it is fully automated within S3, requiring no custom code, manual intervention, or additional services.

Answer

Store logs in CloudWatch Logs with a retention period of 7 years.

Answer

Configure CloudTrail to automatically delete logs older than 7 years.

Answer

Use an AWS Lambda function to delete logs older than 7 years.

Answer

Export logs to AWS Snowball for offline archival.

Question 5

A company uses AWS SSO to manage access to multiple accounts. An employee leaves the company. What is the most efficient way to revoke all AWS access for that employee?

Accepted Answer

Deactivate the user in the connected identity provider (e.g., Active Directory).. The most efficient way to revoke all AWS access for a former employee is to deactivate the user in the connected identity provider (e.g., Active Directory). AWS SSO relies on the external IdP for authentication; once the user is deactivated there, they cannot authenticate to AWS SSO, and all active SSO sessions are invalidated. This single action immediately blocks access across all accounts and applications federated through AWS SSO, without needing to touch individual IAM roles or accounts.

Answer

Delete the corresponding IAM user in every AWS account.

Answer

Remove the user from all groups in AWS SSO.

Answer

Delete the IAM role that the user assumes in each account.

Question 6

Which TWO of the following are best practices for protecting data in transit? (Choose TWO.)

Accepted Answer

Enforce HTTPS for web traffic. Option C is correct because enforcing HTTPS for web traffic ensures that HTTP is wrapped in TLS, providing confidentiality and integrity for browser-to-server communications and preventing eavesdropping or man-in-the-middle tampering on the wire. Option D is correct because using SSL/TLS for all data transfers applies strong, standardized transport encryption (e.g., TLS 1.2/1.3) to any protocol carrying sensitive data, which is the core best practice for protecting data in transit. Option A is not the best answer because a VPN encrypts traffic over an untrusted network but does not by itself secure application-layer transfers end-to-end, and 'all traffic' is overly broad rather than a targeted transit-protection control. Option B is wrong because plain HTTP transmits data unencrypted and is unsuitable even for internal traffic. Option E is wrong because encryption at rest protects stored data, not data moving across a network.

Answer

Use a VPN for all traffic

Answer

Use HTTP for internal traffic

Answer

Use encryption at rest

Question 7

An IAM user reports that they are unable to launch an EC2 instance in a specific VPC. The user has an IAM policy that allows ec2:RunInstances but does not grant permission for the subnet resource. The VPC has a network ACL that allows all inbound and outbound traffic. What is the most likely cause of the failure?

Accepted Answer

The IAM policy does not grant permission to use the subnet.. ec2:RunInstances requires permissions on multiple resource types — the instance, the AMI, the subnet, the security group, the key pair, and the volume. If the IAM policy grants ec2:RunInstances on * for the instance resource but omits the subnet ARN (or uses a Resource that does not include the subnet), the request fails with an unauthorized error even though the VPC and NACL are permissive. The fix is to include the subnet ARN in the Resource element or use a wildcard that covers it.

Answer

The IAM policy does not grant permission to use the VPC.

Answer

The security group associated with the instance is blocking the launch.

Answer

The network ACL is blocking the launch request.

Question 8

A company is migrating sensitive customer data to Amazon RDS for MySQL. The security team requires that data be encrypted at rest and in transit. The database will be accessed by a web application running on Amazon EC2 instances in the same VPC. The RDS instance is launched with encryption enabled using an AWS managed KMS key. The security team also enables SSL/TLS for connections. Which additional step is necessary to ensure that the web application uses encrypted connections?

Accepted Answer

Configure the web application's database connection string to use SSL/TLS.. Enabling SSL/TLS on the RDS instance allows encrypted connections, but the web application must be configured to actually use SSL/TLS when connecting. This is done by modifying the database connection string to require SSL/TLS. Without this step, the application may connect without encryption.

Answer

Enable encryption at rest on the EC2 instance's EBS volumes.

Answer

Create an SCP to enforce SSL connections to RDS.

Answer

Grant the EC2 instance's IAM role permission to use the KMS key for decrypting RDS connections.

Question 9

A security engineer needs to ensure that all Amazon S3 buckets in an AWS account have server-side encryption (SSE) enabled. The engineer wants to automatically remediate any bucket that is created without SSE. Which solution should the engineer implement?

Accepted Answer

Use AWS Config with a managed rule (s3-bucket-server-side-encryption-enabled) and an automatic remediation action.. AWS Config's managed rule s3-bucket-server-side-encryption-enabled continuously evaluates every S3 bucket in the account and flags any that lack default encryption. Pairing it with an automatic remediation action (typically an SSM Automation document such as AWS-EnableS3BucketEncryption) means newly created non-compliant buckets are remediated without human intervention, satisfying the 'automatically remediate' requirement. This is the canonical AWS-native pattern for continuous compliance enforcement on S3.

Answer

Use S3 bucket policies to deny access to objects without encryption.

Answer

Apply an IAM policy that requires SSE for all S3 actions.

Answer

Create a service control policy (SCP) that denies creation of buckets without encryption.

Question 10

An application running on an EC2 instance needs to access an S3 bucket. What is the most secure way to grant the EC2 instance the necessary permissions?

Accepted Answer

Create an IAM role with the necessary S3 permissions and attach it to the EC2 instance as an instance profile.. Attaching an IAM role to an EC2 instance via an instance profile delivers temporary, automatically rotated credentials through the Instance Metadata Service (IMDS), so no long-lived secrets exist on disk or in code. This is the AWS best practice for granting AWS service permissions to EC2 workloads and eliminates the risk of credential leakage.

Answer

Store the credentials in an encrypted file on the EC2 instance and decrypt them at runtime.

Answer

Store the AWS access key and secret key in the application code.

Answer

Use an S3 bucket policy that allows access from the EC2 instance's public IP address.

Question 11

A security engineer needs to centralize logs from multiple AWS accounts into a single S3 bucket. Which solution is most secure?

Accepted Answer

Configure each account's CloudTrail to deliver to a centralized S3 bucket in a logging account, with a bucket policy allowing CloudTrail from source accounts.. It uses a centralized S3 bucket in a dedicated logging account with a bucket policy that explicitly grants CloudTrail from source accounts the s3:PutObject permission. This ensures logs are written directly to a single location without intermediate replication or cross-account delivery that could introduce latency or complexity. The bucket policy can restrict access to only CloudTrail service principals and specific source account ARNs, maintaining a secure, auditable log trail.

Answer

Deliver logs to separate buckets per account and use S3 replication to copy them to a central bucket.

Answer

Use a single S3 bucket in the management account and have each account write logs directly without additional permissions.

Answer

Stream logs to Amazon Kinesis Data Firehose in each account and consolidate into a single S3 bucket via cross-account delivery.

Question 12

An administrator needs to allow a Lambda function to write logs to CloudWatch Logs. What is the BEST way to grant these permissions?

Accepted Answer

Create an IAM role with the necessary CloudWatch Logs permissions and assign it as the Lambda function's execution role.. Lambda functions assume an IAM execution role at runtime, and all AWS API calls the function makes (including CloudWatch Logs PutLogEvents) are authorized against that role's identity-based policies. Creating a role with only the required CloudWatch Logs permissions and assigning it as the execution role follows least privilege and is the standard, supported mechanism. This avoids embedding long-lived credentials and grants exactly the access needed.

Answer

Store AWS credentials in the Lambda function code.

Answer

Attach a resource-based policy to the Lambda function.

Answer

Attach the AdministratorAccess managed policy to the Lambda function's execution role.

Question 13

A security engineer needs to be alerted when an IAM user attempts to modify an S3 bucket policy. Which method is the MOST efficient?

Accepted Answer

Create an Amazon CloudWatch Events rule that matches the PutBucketPolicy API call and triggers an SNS notification. Amazon CloudWatch Events (now Amazon EventBridge) can directly capture the PutBucketPolicy API call as a real-time event and trigger an SNS notification without any additional compute or polling. This is the most efficient method as it requires no log parsing, no custom code, and no additional infrastructure, providing immediate alerting with minimal overhead.

Answer

Enable VPC Flow Logs and analyze for S3 API traffic

Answer

Configure an AWS Config rule to detect changes and invoke a Lambda function

Answer

Enable S3 server access logs and parse them for PutBucketPolicy entries

Question 14

Which TWO methods can be used to encrypt data at rest in Amazon S3? (Choose 2.)

Accepted Answer

Use SSE-S3 to have Amazon S3 manage the encryption keys.. Option B is correct because SSE-S3 (server-side encryption with Amazon S3-managed keys, AES-256) encrypts objects at rest, with AWS fully managing the key material and rotation. Option E is correct because client-side encryption means data is encrypted before it leaves the client and is stored in S3 already encrypted, so the objects are protected at rest. Option A is not a valid answer because a bucket policy denying unencrypted uploads only enforces that encryption is used; it does not itself encrypt data. Option C is incorrect because HTTPS/TLS provides encryption in transit, not at rest. Option D is incorrect because MFA Delete only adds an authentication requirement for deleting objects or changing versioning state; it does not encrypt data.

Answer

Set a bucket policy that denies uploads without encryption.

Answer

Enable encryption in transit using HTTPS.

Answer

Enable MFA Delete on the S3 bucket.

Question 15

A company has an AWS account with a single VPC and multiple subnets. The security team wants to ensure that no network ACL (NACL) allows inbound SSH (port 22) from 0.0.0.0/0. Which AWS service can be used to detect and alert on such non-compliant NACLs?

Accepted Answer

AWS Config. AWS Config continuously records resource configurations and evaluates them against rules, making it the correct service to detect non-compliant NACLs. You can use the managed rule 'nacl-no-unrestricted-ssh-rdp' (or a custom rule) to flag any NACL that allows inbound SSH from 0.0.0.0/0 and trigger alerts via Amazon EventBridge or SNS. This directly addresses the requirement to detect and alert on non-compliant NACLs.

Answer

Amazon Inspector

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Question 16

A company wants to securely store secrets used by an application running on EC2 instances. The secrets include database credentials and API keys. What is the MOST secure and manageable approach?

Accepted Answer

Use AWS Secrets Manager and attach an IAM role to the EC2 instance with permission to access the secrets.. AWS Secrets Manager is purpose-built for storing, rotating, and retrieving secrets such as database credentials and API keys. Attaching an IAM role to the EC2 instance allows the application to retrieve secrets securely without hardcoding credentials, and Secrets Manager supports automatic rotation, auditing via CloudTrail, and fine-grained access control. This is the most secure and manageable approach.

Answer

Store the secrets in the EC2 instance user data and retrieve them from the metadata service.

Answer

Embed the secrets in the application code and encrypt the code with a KMS key.

Answer

Use AWS Systems Manager Parameter Store with a SecureString parameter and reference it in the application code.

Question 17

An IAM user has the policy shown in the exhibit. The user tries to launch an m5.large instance in us-east-1, but gets an 'AccessDenied' error. Why does this happen?

Accepted Answer

The policy restricts RunInstances to instance type t2.micro, but the user requested m5.large.. The IAM policy's RunInstances statement includes a condition that restricts the allowed instance type (likely ec2:InstanceType StringEquals t2.micro). Because the user requested m5.large, the condition evaluates false and the Allow does not apply, resulting in an implicit deny and AccessDenied.

Answer

The condition uses StringEquals, which is case-sensitive and the instance type is in the wrong case.

Answer

The policy does not allow the RunInstances action at all.

Answer

The resource ARN in the policy is incorrect for launching instances.

Question 18

A company uses Amazon SQS to decouple its microservices. The messages contain personally identifiable information (PII). The security team requires that all messages be encrypted at rest. Currently, SQS is configured with SSE enabled using a customer managed KMS key. However, the team discovers that some messages are still being stored in plaintext in the dead-letter queue (DLQ) after the maximum receives are exceeded. The DLQ is also an SQS queue. What is the MOST likely reason?

Accepted Answer

The DLQ does not have SSE enabled, so messages are stored in plaintext.. SSE is configured per queue, not inherited. Enabling SSE with a customer-managed KMS key on the source queue does not automatically encrypt the DLQ; if the DLQ was created without SSE, messages moved there are stored using SQS's default (no encryption at rest) behavior, exposing the PII in plaintext. Each SQS queue, including a DLQ, must have its own encryption configuration.

Answer

The source queue's SSE is configured with AWS managed KMS key, which does not support cross-account DLQ.

Answer

The source queue's SSE configuration uses a different KMS key than the DLQ, causing decryption failure.

Answer

The KMS key policy does not allow the SQS service to decrypt the messages before moving them to the DLQ.

Question 19

A company wants to restrict access to an S3 bucket so that only requests from a specific VPC endpoint are allowed. Which policy element should be used in the S3 bucket policy?

Accepted Answer

aws:SourceVpce. To restrict access to an S3 bucket so that only requests originating from a specific VPC endpoint are allowed, the `aws:SourceVpce` condition key must be used in the S3 bucket policy. This key checks the VPC endpoint ID (e.g., `vpce-1a2b3c4d`) from which the request originated, ensuring that only traffic through that specific endpoint is permitted. Using `aws:SourceVpc` would allow any endpoint within the VPC, not a specific one, and `aws:SourceIp` or `aws:Referer` are irrelevant for VPC endpoint-based access control.

Answer

aws:Referer

Answer

aws:SourceVpc

Answer

aws:SourceIp

Question 20

A company uses S3 to store sensitive customer data. Which AWS service can automatically discover and classify this data to help meet compliance requirements?

Accepted Answer

Amazon Macie. Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to automatically discover, classify, and protect sensitive data stored in Amazon S3. It specifically identifies PII, PHI, credentials, and other sensitive content, generating findings that support compliance requirements such as GDPR, HIPAA, and PCI-DSS. This is the exact purpose for which Macie was designed.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

Amazon CloudWatch