SCS-C02 Practice Exam 66 — 20 Questions

Question 1

A company has a multi-account AWS environment using AWS Organizations. The security team wants to centrally manage VPC security group rules across all accounts. Which AWS service should they use?

Accepted Answer

AWS Firewall Manager. AWS Firewall Manager is designed to centrally manage security policies across all accounts in an AWS Organization, including VPC security group rules. It allows you to define a security group policy that automatically applies to existing and new resources, ensuring consistent enforcement across the organization. This is the only service among the options that provides centralized, cross-account management of security groups.

Answer

AWS Network Firewall

Answer

AWS Config

Answer

Amazon Route 53 Resolver DNS Firewall

Question 2

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. Which AWS service should be used to allow this without assigning a public IP address to the instance?

Accepted Answer

NAT Gateway. A NAT Gateway is the correct service because it allows instances in a private subnet to initiate outbound connections to the internet (e.g., to download patches) while remaining unreachable from the internet and without needing a public IP. The NAT Gateway resides in a public subnet, has an Elastic IP, and performs source NAT (SNAT) on traffic from the private subnet, translating the private source IP to its own public IP. This satisfies the requirement of outbound-only internet access without exposing the instance.

Answer

Internet Gateway

Answer

VPC Endpoint

Answer

VPN Connection

Question 3

A company wants to restrict access to an S3 bucket so that only requests from a specific VPC Endpoint are allowed. Which policy element should be used in the bucket policy?

Accepted Answer

aws:SourceVpce. The aws:SourceVpce condition key is the correct choice because it specifically evaluates the VPC endpoint ID (e.g., vpce-12345678) that the request traversed to reach S3. When you attach a bucket policy that denies all traffic except requests originating from a particular VPC endpoint, you use a Condition block with StringEquals on aws:SourceVpce to match that endpoint ID. This is the only key that directly identifies the endpoint itself, making it the precise tool for restricting access to a specific VPC endpoint.

Answer

aws:SourceVpc

Answer

aws:VpcSourceIp

Answer

aws:SourceIp

Question 4

Refer to the exhibit. A security engineer reviews IAM permissions for the 'admin' user. The user is a member of the 'Administrators' group, which has the 'AdministratorAccess' managed policy attached. Additionally, the user has an inline policy named 'AllowSSH'. The engineer wants to ensure that the user can only start SSM sessions on instances with the tag 'SSH: enabled'. However, the user can still start sessions on any instance. What is the most likely reason?

Accepted Answer

The inline policy uses 'Allow' instead of 'Deny' for instances without the tag, so it does not restrict access.. In AWS IAM, an explicit Allow in any attached policy grants access — there is no 'most restrictive wins' rule for Allow statements. Because the user already has AdministratorAccess (which allows ssm:StartSession on *), the inline AllowSSH policy's Allow statement cannot restrict anything; it only adds permissions. To restrict the user to tagged instances, the inline policy must contain an explicit Deny for ssm:StartSession when the resource tag condition is not met (or the AdministratorAccess policy must be removed/scoped).

Answer

The inline policy does not include 'ec2:DescribeInstances' for the SSM session, so it cannot start sessions.

Answer

The condition 'aws:ResourceTag/SSH' should be 'aws:RequestTag/SSH' to check the request tag.

Answer

The inline policy 'AllowSSH' is not effective because it is overridden by the group policy 'AdministratorAccess'.

Question 5

A company wants to protect its Amazon EC2 instances from distributed denial-of-service (DDoS) attacks at the network layer. Which AWS service should be used?

Accepted Answer

AWS Shield Advanced. AWS Shield Advanced provides enhanced protections for Amazon EC2 instances against network-layer (Layer 3/4) DDoS attacks, such as SYN floods, UDP reflection attacks, and other volumetric attacks. It includes always-on traffic monitoring, automated mitigation, and access to the DDoS Response Team (DRT) for custom mitigations, making it the correct choice for network-layer DDoS protection.

Answer

Amazon CloudFront

Answer

Amazon GuardDuty

Answer

AWS WAF

Question 6

A company uses AWS Organizations with multiple accounts. The security team needs to ensure that no account can disable a specific security service, such as AWS Config, across all accounts. Which approach should be used?

Accepted Answer

Attach a service control policy (SCP) that denies the action at the root organization level. A service control policy (SCP) in AWS Organizations can be attached to the root, OU, or account level to set permission guardrails. An SCP that denies the action (e.g., config:StopConfigurationRecorder or config:DeleteConfigurationRecorder) at the root organization level applies to all accounts and cannot be overridden by account administrators, ensuring the security service cannot be disabled.

Answer

Create an IAM role with a deny policy for the action and attach it to all users

Answer

Create an AWS Config rule to check for the action and automatically remediate

Answer

Enable AWS CloudTrail and create a metric filter to alert on the action

Question 7

A security engineer is investigating a GuardDuty finding of type 'Backdoor:EC2/C&CActivity.B!DNS'. Which TWO actions should the engineer take as part of the initial response? (Choose two.)

Accepted Answer

Isolate the EC2 instance by modifying its security group to deny all traffic.. Isolating the EC2 instance by modifying its security group to deny all traffic is a critical containment step in incident response. This immediately stops the C2 (command and control) communication detected by GuardDuty's 'Backdoor:EC2/C&CActivity.B!DNS' finding, preventing further data exfiltration or lateral movement while preserving the instance for forensic analysis.

Answer

Enable Amazon GuardDuty in the account if not already enabled.

Answer

Immediately terminate the EC2 instance to stop the activity.

Answer

Disable termination protection on the instance to allow future termination.

Question 8

Refer to the exhibit. An EC2 instance with an IAM role attached attempts to access an S3 bucket, but receives an 'AccessDenied' error. The role has an attached policy allowing s3:GetObject on the bucket. What is the most likely cause?

Accepted Answer

The S3 bucket policy denies access to the role.. When an IAM role has an identity-based policy allowing s3:GetObject but access is still denied, the most likely cause is an explicit Deny in the S3 bucket policy, because in AWS an explicit Deny anywhere in the evaluation chain overrides any Allow. The bucket policy is a resource-based policy evaluated alongside the identity-based policy, and a Deny there will block the role even though the IAM policy grants permission.

Answer

The IAM policy is not attached to the role.

Answer

The trust policy does not allow the EC2 service to assume the role.

Answer

The EC2 instance does not have an instance profile associated with the role.

Question 9

A company wants to enforce that all S3 buckets are encrypted with SSE-KMS. Which AWS service can be used to automatically remediate non-compliant buckets?

Accepted Answer

AWS Config with auto-remediation. AWS Config with auto-remediation can enforce that all S3 buckets are encrypted with SSE-KMS. You create an AWS Config rule (e.g., s3-bucket-server-side-encryption-enabled) that evaluates bucket encryption settings, and attach an AWS Systems Manager Automation document (e.g., AWS-EnableS3BucketEncryption) as a remediation action. When a non-compliant bucket is detected, AWS Config automatically triggers the remediation action to enable SSE-KMS encryption on that bucket.

Answer

AWS CloudTrail with CloudWatch Events

Answer

AWS Service Catalog

Answer

AWS Organizations

Question 10

A security engineer is configuring automated incident response for an Amazon EC2 instance that has been compromised. The engineer needs to isolate the instance while preserving forensic data. Which solution meets these requirements?

Accepted Answer

Create an AMI of the instance, then remove the instance from the security group to isolate it.. Creating an AMI preserves the EBS volumes and their forensic data, while removing the instance from the security group effectively isolates it by denying all network traffic. This approach allows the engineer to later launch a forensic instance from the AMI in a controlled environment for analysis, without losing the compromised instance's state.

Answer

Detach the EBS volumes and attach them to a new instance in a different VPC.

Answer

Terminate the instance immediately to prevent further damage.

Answer

Stop the instance and change the security group to deny all traffic.

Question 11

Which THREE services can be used to detect and alert on suspicious API activity across an AWS organization? (Choose three.)

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious or unauthorized behavior, including suspicious API activity. It uses machine learning, anomaly detection, and integrated threat intelligence to analyze AWS CloudTrail management events, VPC Flow Logs, and DNS logs across an AWS organization, and can trigger alerts via Amazon EventBridge or Security Hub.

Answer

Amazon Inspector

Answer

AWS Config

Question 12

A company uses AWS CloudTrail to log API activity. The security team wants to ensure that log files are encrypted at rest and that any tampering with logs is detectable. Which combination of services should be used?

Accepted Answer

Enable CloudTrail log file SSE-KMS encryption and enable CloudTrail log file integrity validation.. CloudTrail log file integrity validation produces digest files signed with SHA-256 and RSA that let you prove logs were not altered or deleted after delivery, while SSE-KMS encryption protects the log objects at rest with a customer-managed or AWS-managed KMS key. Together they satisfy both the confidentiality and tamper-detection requirements. This is the AWS-documented combination for secure, verifiable CloudTrail log storage.

Answer

Enable CloudTrail and configure S3 bucket to use default encryption and enable S3 server access logs.

Answer

Use AWS CloudHSM to generate keys and encrypt CloudTrail logs at the application layer.

Answer

Enable CloudTrail log file encryption using SSE-S3 and store logs in CloudWatch Logs.

Question 13

A company wants to allow users to assume a role in another AWS account to access a specific S3 bucket. What must be configured?

Accepted Answer

An IAM role with a trust policy allowing the user's account and a bucket policy granting the role access to the bucket.. Cross-account role assumption requires two coordinated policies: a trust policy on the IAM role in the target account that names the user's account (or principal) as a trusted entity, and a resource-based policy (bucket policy) in the target account granting the role access to the S3 bucket. Both are necessary because the trust policy authorizes the AssumeRole call, while the bucket policy authorizes the S3 actions once the role is assumed.

Answer

A trust policy on the IAM role that allows the user's account to assume the role.

Answer

An S3 bucket policy that allows the user to access the bucket.

Answer

A resource-based policy on the S3 bucket that allows the user's account.

Question 14

A company wants to protect data at rest for an Amazon RDS for PostgreSQL database. Which AWS service should be used to manage the encryption keys?

Accepted Answer

AWS Key Management Service (KMS). Amazon RDS for PostgreSQL integrates with AWS Key Management Service (KMS) to enable encryption at rest. When you enable encryption for an RDS DB instance, KMS manages the customer master keys (CMKs) that encrypt the data keys used by the storage layer. This is the standard, fully managed key management service for RDS encryption, supporting automatic key rotation and fine-grained access control.

Answer

AWS CloudHSM

Answer

AWS Certificate Manager (ACM)

Answer

AWS Secrets Manager

Question 15

A security engineer is reviewing AWS CloudTrail and notices `AssumeRole` API calls to a role that should not be assumed by the source identity. What is the FIRST step in the incident response process?

Accepted Answer

Investigate the source IP address and user agent of the `AssumeRole` calls.. The first step in any incident response process is to investigate and gather evidence to understand the scope and impact of the potential security event. Option C is correct because analyzing the source IP address and user agent of the `AssumeRole` API calls provides critical forensic data to determine if the activity is malicious or a false positive, without disrupting operations or destroying evidence. AWS CloudTrail logs these details, enabling the security engineer to trace the origin of the unauthorized assumption before taking any containment or remediation actions.

Answer

Enable AWS GuardDuty to detect future anomalies.

Answer

Delete the IAM role immediately.

Answer

Disable the AWS account and contact support.

Question 16

A company is using Amazon GuardDuty to detect threats in its AWS environment. The security team notices that GuardDuty is generating a high number of 'UnauthorizedAccess:IAMUser/MaliciousIPCaller' findings for an IAM user that is used by a legacy application. The security team has verified that the IP addresses flagged are not malicious but are legitimate IPs used by the application's third-party service. The company wants to suppress these findings without disabling GuardDuty entirely. Which solution is the MOST effective and secure?

Accepted Answer

Create a GuardDuty suppression rule that automatically archives findings for that IAM user.. GuardDuty suppression rules allow you to automatically archive findings that match specific criteria (such as a particular finding type and IAM user) without disabling the detector or the finding type entirely. This is the most effective and secure way to reduce noise from known-legitimate activity while preserving GuardDuty's ability to detect other threats.

Answer

Disable the specific finding type in GuardDuty settings.

Answer

Create a VPC flow log filter to exclude traffic from those IP addresses.

Answer

Modify the IAM user's permissions to restrict the IP addresses it can use.

Question 17

A security engineer is reviewing AWS CloudTrail logs and notices repeated `CreateTrail` API calls from an IAM user that is not authorized to create trails. What is the MOST likely cause of these log entries?

Accepted Answer

The IAM user attempted to create a trail but was denied due to lack of permissions.. The repeated `CreateTrail` API calls in CloudTrail logs indicate that an IAM user is attempting to create a trail. Since the user lacks the required `cloudtrail:CreateTrail` permission, the API call is recorded as an attempted action that was denied by AWS Identity and Access Management (IAM) policy evaluation. CloudTrail logs all API calls, including those that fail due to insufficient permissions, which is why these entries appear in the logs.

Answer

AWS GuardDuty is generating simulated events.

Answer

S3 server access logs are enabled for the trail's S3 bucket.

Answer

CloudTrail is configured to log only data events.

Question 18

A security engineer needs to restrict access to an S3 bucket so that only requests from a specific VPC endpoint are allowed. Which condition must be configured?

Accepted Answer

aws:SourceVpce. To restrict S3 bucket access to a specific VPC endpoint, the bucket policy must include a condition that checks the VPC endpoint ID. The condition key `aws:SourceVpce` evaluates the endpoint ID of the VPC endpoint through which the request arrives. This ensures that only requests originating from that specific endpoint are allowed, effectively blocking access from the public internet or other endpoints.

Answer

aws:SourceIp

Answer

aws:UserAgent

Answer

aws:SourceVpc

Answer

aws:Referer

Question 19

A security engineer notices that an IAM role allows 'iam:PassRole' to an EC2 instance. What security risk does this present?

Accepted Answer

The instance can launch new resources with a more privileged role.. The 'iam:PassRole' permission allows an entity to pass an IAM role to an AWS service, such as EC2. If an EC2 instance has this permission, it can launch new resources (like another EC2 instance or a Lambda function) and associate a more privileged role with that resource. This is a privilege escalation risk because the instance could effectively gain the permissions of the passed role.

Answer

The instance can modify IAM policies.

Answer

The instance can stop CloudTrail logging.

Answer

The instance can decrypt data encrypted with KMS keys.

Question 20

Which TWO statements are true about IAM roles? (Choose two.)

Accepted Answer

IAM roles can be used by federated users.. Option A is correct because IAM roles support identity federation: users authenticated by an external identity provider (via SAML 2.0 or OIDC, or via AWS STS AssumeRoleWithSAML/AssumeRoleWithWebIdentity) receive temporary credentials scoped to the role's permissions rather than needing IAM user accounts. Option E is correct because AWS services can assume roles through a trust policy that names the service principal (for example, ec2.amazonaws.com), which is exactly how an instance profile lets EC2 instances obtain temporary credentials from the instance metadata service. Option B is wrong because IAM roles, like IAM users and policies, are global resources not tied to a specific AWS region. Option C is wrong because roles are in fact attached to EC2 instances via instance profiles. Option D is wrong because roles never issue permanent access keys; they provide temporary credentials through AWS STS with automatic rotation and expiration.

Answer

IAM roles are specific to an AWS region.

Answer

IAM roles cannot be attached to an EC2 instance.

Answer

IAM roles have permanent access keys.