SCS-C02 Practice Exam 67 — 20 Questions

Question 1

A company needs to encrypt data at rest in Amazon EBS volumes. They want to use an AWS managed key that is automatically rotated. Which encryption option should they choose?

Accepted Answer

Enable EBS encryption by default using the AWS managed key for Amazon EBS.. Enabling EBS encryption by default using the AWS managed key for Amazon EBS (alias `aws/ebs`) ensures data at rest is encrypted with a key that is automatically rotated on an annual basis, as required. This key is managed by AWS and requires no manual intervention for rotation, meeting the company's need for a managed, automatically rotated key.

Answer

Use SSE-S3.

Answer

Use a customer-managed KMS key with automatic rotation enabled.

Answer

Use client-side encryption.

Question 2

Which TWO AWS services provide key management for encryption at rest? (Choose 2.)

Accepted Answer

AWS CloudHSM. AWS Key Management Service (KMS) is a managed service that makes it easy to create and control customer master keys (CMKs) used for encrypting data at rest across AWS services like S3, EBS, and RDS. AWS CloudHSM provides dedicated hardware security modules (HSMs) that allow you to manage your own encryption keys in a tamper-resistant hardware appliance, meeting FIPS 140-2 Level 3 compliance for key storage and cryptographic operations. Both services directly provide key management for encryption at rest, with KMS offering integrated key rotation and auditing via AWS CloudTrail, while CloudHSM gives you full control over the HSM appliance and keys.

Answer

AWS Systems Manager Parameter Store

Answer

AWS Certificate Manager (ACM)

Answer

AWS Secrets Manager

Question 3

A security engineer is investigating a potential security incident involving an Amazon RDS database. The engineer needs to identify which of the following actions should be taken during the forensic analysis phase? (Select TWO.)

Accepted Answer

Take a manual snapshot of the RDS instance.. Taking a manual snapshot preserves a point-in-time, immutable copy of the RDS instance for offline forensic analysis without altering the live database. This ensures that evidence is captured before any changes occur during the investigation, and the snapshot can be restored to a separate instance for safe examination.

Answer

Enable automatic backups if not already enabled.

Answer

Disable deletion protection to allow cleanup.

Answer

Modify the security group to restrict database access.

Question 4

Which TWO of the following are valid methods to protect sensitive data in transit between an on-premises data center and AWS? (Select TWO.)

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN (Option B) creates an encrypted tunnel between an on-premises VPN device and a Virtual Private Gateway in AWS, using IPSec to protect data in transit. This ensures confidentiality and integrity of data crossing the public internet, making it a valid method for securing sensitive data between an on-premises data center and AWS.

Answer

AWS Transit Gateway

Answer

Internet Gateway

Answer

VPC Peering

Question 5

A company uses IAM roles for cross-account access. Developers in Account A need to assume a role in Account B. What must be true for the AssumeRole call to succeed?

Accepted Answer

The role's trust policy must allow Account A and the user must have sts:AssumeRole permission. For a cross-account AssumeRole call to succeed, two conditions must be met: the role in Account B must have a trust policy that allows Account A (or specific principals in Account A) to assume it, and the IAM user or role in Account A must have an identity-based policy granting sts:AssumeRole on that role. Both are required; missing either results in Access Denied.

Answer

Account A must have an SCP that allows sts:AssumeRole

Answer

The user in Account A must have MFA enabled

Answer

The role in Account B must have a permissions boundary

Question 6

A security engineer is configuring Amazon GuardDuty for the first time. The engineer wants to receive alerts when GuardDuty generates a finding of severity HIGH or higher. What is the simplest way to achieve this?

Accepted Answer

Create an Amazon EventBridge rule that matches GuardDuty findings and triggers an SNS topic.. Amazon EventBridge can natively capture GuardDuty findings as events and route them to an SNS topic for alerting. This is the simplest approach because it requires no custom code, no log parsing, and no additional infrastructure—just a rule matching the `GuardDuty Finding` event type and a severity filter for HIGH or higher.

Answer

Configure CloudWatch Logs to monitor GuardDuty logs and create a metric filter for high-severity findings.

Answer

Set up an S3 event notification on the GuardDuty findings bucket.

Answer

Configure GuardDuty to send email notifications for all findings.

Question 7

A company has a security group rule that allows inbound traffic from 0.0.0.0/0 on port 22. The security engineer wants to restrict SSH access to only the company's public IP range (203.0.113.0/24). What is the correct way to update the security group rule?

Accepted Answer

Modify the existing inbound rule to change the source from 0.0.0.0/0 to 203.0.113.0/24.. Modifying the existing inbound rule to change the source from 0.0.0.0/0 to 203.0.113.0/24 directly restricts SSH access to the company's public IP range. Security groups are stateful and allow you to edit rules in place, so this is the simplest and most accurate method.

Answer

Remove the existing inbound rule and do not add any new rule; SSH access will be denied by default.

Answer

Add a new inbound rule with source 203.0.113.0/24 and the security group will automatically deny all other traffic.

Answer

Change the outbound rules to restrict traffic.

Question 8

A company is using AWS KMS to encrypt data in Amazon Redshift. They need to rotate the KMS key annually. Which approach meets the requirement with minimal operational impact?

Accepted Answer

Enable automatic key rotation on the KMS key. AWS KMS supports automatic annual key rotation for customer-managed KMS keys. Enabling this feature automatically rotates the key material once per year with no manual intervention, minimal operational overhead, and no impact on the Redshift cluster, which continues to use the same key ID.

Answer

Create a new KMS key each year and update the Redshift cluster to use the new key

Answer

Use an AWS Lambda function to rotate the key every year

Answer

Rotate the key by re-importing key material into an existing KMS key

Question 9

A security engineer is setting up monitoring for AWS API calls. Which TWO AWS services can be used to capture and analyze API activity?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs can capture and analyze API activity by ingesting log data from various AWS services, including AWS CloudTrail. You can configure CloudWatch Logs to monitor API calls in real time, set up metric filters to detect specific patterns, and trigger alarms based on API activity. This makes it a valid service for capturing and analyzing API calls, especially when combined with CloudTrail for detailed event records.

Answer

AWS Config

Answer

Amazon Inspector

Answer

Amazon GuardDuty

Question 10

A company wants to restrict access to an S3 bucket so that only requests from a specific VPC endpoint are allowed. Which S3 bucket policy condition key should be used?

Accepted Answer

aws:SourceVpce. To restrict access to an S3 bucket so that only requests originating from a specific VPC endpoint are allowed, you must use the `aws:SourceVpce` condition key in the S3 bucket policy. This key evaluates the VPC endpoint ID (e.g., `vpce-1a2b3c4d`) of the request, ensuring that only traffic routed through that specific endpoint is granted access. The `aws:SourceVpc` key is used to restrict access based on the VPC ID, not the endpoint ID, and `aws:SourceIp` and `aws:VpcSourceIp` are not valid condition keys for VPC endpoint-based restrictions.

Answer

aws:VpcSourceIp

Answer

aws:SourceVpc

Answer

aws:SourceIp

Question 11

A security engineer is troubleshooting an issue where an Amazon RDS for MySQL DB instance is not encrypting data at rest. The DB instance was created without encryption. The engineer needs to enable encryption without significant downtime. What is the MOST effective approach?

Accepted Answer

Take a snapshot, copy it with encryption enabled, and restore a new DB instance from the encrypted snapshot. To enable encryption on an unencrypted RDS DB instance with minimal downtime, you must take a snapshot, copy it with encryption enabled, and then restore a new DB instance from the encrypted snapshot. This creates a new encrypted instance, and you can then switch applications to it. The process requires some downtime during the switch, but it's the most effective method because RDS does not support enabling encryption in-place on an existing unencrypted instance.

Answer

Take a snapshot of the DB instance and enable encryption on the snapshot

Answer

Modify the DB instance and enable encryption in the console

Answer

Create a read replica with encryption and promote it

Question 12

A company wants to automatically trigger a Lambda function when a new security finding is generated in AWS Security Hub. Which service should be used to invoke the Lambda function?

Accepted Answer

Amazon EventBridge. Amazon EventBridge is the correct service because AWS Security Hub automatically sends all findings to the default EventBridge bus as events. You can create an EventBridge rule that matches the 'Security Hub Findings - Imported' event pattern and targets a Lambda function for invocation. This is the native, recommended integration for event-driven responses to Security Hub findings.

Answer

Amazon Simple Notification Service (SNS)

Answer

AWS Security Hub itself

Answer

AWS CloudTrail

Question 13

A company has a serverless application using AWS Lambda functions that process sensitive data. The security team wants to detect potential data exfiltration via DNS queries from the Lambda functions. Which service should be enabled to monitor DNS requests?

Accepted Answer

Amazon Route 53 Resolver DNS Firewall. Amazon Route 53 Resolver DNS Firewall is the correct choice because it provides DNS-layer filtering for outbound DNS queries from VPCs, including those made by Lambda functions. It can log and block DNS requests to known malicious domains, enabling detection of data exfiltration attempts that use DNS tunneling or command-and-control (C2) communication. This service integrates with VPC flow logs and CloudWatch to monitor DNS query patterns specifically.

Answer

AWS WAF

Answer

Amazon CloudWatch Logs

Answer

AWS GuardDuty

Question 14

A security engineer is investigating a potential data exfiltration from an S3 bucket. The engineer needs to identify which IAM role or user accessed the bucket and from which IP address. Which AWS service should the engineer use to obtain this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to S3, including the IAM role or user identity (via the `userIdentity` field) and the source IP address (via the `sourceIPAddress` field). For data exfiltration investigation, you need these specific details from management events or data events (e.g., `GetObject`, `PutObject`), which CloudTrail captures. Other services either lack identity-level detail or focus on network-level traffic without user attribution.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

Amazon GuardDuty

Question 15

A company is using Amazon S3 to store sensitive data. They want to ensure that all objects uploaded to a specific bucket are encrypted using server-side encryption with AWS KMS. Which bucket policy condition should be used to enforce this?

Accepted Answer

Condition: 's3:x-amz-server-side-encryption': 'aws:kms'. The bucket policy condition `s3:x-amz-server-side-encryption` with value `aws:kms` enforces that any PutObject request must include the `x-amz-server-side-encryption` header set to `aws:kms`. This ensures that objects are encrypted using SSE-KMS. The condition key is specific to the encryption algorithm, not the KMS key ID.

Answer

Condition: 's3:x-amz-server-side-encryption-customer-algorithm': 'AES256'

Answer

Condition: 's3:x-amz-server-side-encryption-aws-kms-key-id': 'arn:aws:kms:...'

Answer

Condition: 's3:x-amz-server-side-encryption': 'AES256'

Question 16

A company uses AWS Organizations with SCPs. The SCP for the production OU denies all actions on DynamoDB. An IAM policy attached to a user in that OU allows dynamodb:PutItem. What is the effective access?

Accepted Answer

The user cannot perform PutItem because the SCP denies all DynamoDB actions and IAM allows are overridden.. In AWS Organizations, Service Control Policies (SCPs) define the maximum permissions for accounts in an OU. An explicit Deny in an SCP overrides any Allow in IAM policies. Since the SCP denies all DynamoDB actions, the user cannot perform PutItem regardless of the IAM policy allowing it.

Answer

The user can perform PutItem because the IAM policy allows it.

Answer

The user cannot perform PutItem because the SCP applies only to the root account.

Answer

The user can perform PutItem only if the SCP has an explicit allow.

Question 17

A security engineer needs to detect and respond to potential credential theft where an IAM user's access key is being used from an unusual geographic location. Which AWS service should be used to generate alerts based on this anomaly?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is the correct choice because it is a threat detection service that uses machine learning and integrated threat intelligence to identify anomalous behavior, such as an IAM access key being used from an unusual geographic location. It specifically analyzes CloudTrail management and data events, VPC flow logs, and DNS logs to detect credential theft patterns like a new geolocation or an impossible travel scenario, and can trigger alerts via Amazon EventBridge or SNS for automated response.

Answer

AWS IAM Access Analyzer

Answer

AWS CloudTrail

Answer

AWS Config

Question 18

A company stores sensitive data in Amazon S3 and wants to detect and alert on any public read access to objects. Which combination of services provides the most comprehensive solution?

Accepted Answer

Enable S3 server access logging and use Amazon Athena to query logs, with CloudWatch Events to alert on specific patterns. S3 server access logs capture detailed records of all requests made to a bucket, including the requester, bucket name, request time, action, and response status. By using Amazon Athena to query these logs and CloudWatch Events to trigger alerts on patterns indicating public read access (e.g., a specific HTTP method like GET from an anonymous principal), you can detect and alert on unauthorized public reads comprehensively. This combination provides granular, queryable logging with event-driven alerting, covering both current and historical access patterns.

Answer

Enable VPC Flow Logs and analyze for S3 traffic

Answer

Use AWS Config rules to check for public bucket policies and alert via SNS

Answer

Enable S3 event notifications for all object-level events and send to Amazon SNS

Question 19

A company needs to audit all changes to IAM policies in their AWS account for compliance. Which AWS service should be enabled to record the API calls that modify IAM policies?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity in an AWS account, including all calls that modify IAM policies such as CreatePolicy, PutRolePolicy, AttachRolePolicy, and DeletePolicy. Enabling CloudTrail (which is on by default for management events) provides the audit trail of who made the change, when, and from where. This is the correct service for auditing IAM policy modifications.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

VPC Flow Logs

Question 20

A company is using Amazon S3 to store backup files that must be retained for 7 years. The files are accessed infrequently but must be available within minutes when needed. The company wants to minimize storage costs while ensuring data is encrypted at rest. Which storage class and encryption combination is most cost-effective?

Accepted Answer

S3 Glacier Instant Retrieval with SSE-S3. S3 Glacier Instant Retrieval provides millisecond retrieval (meeting the 'within minutes' requirement) at lower cost than S3 Standard-IA, and SSE-S3 provides encryption at rest at no additional cost. This combination minimizes storage costs while meeting access and encryption requirements.

Answer

S3 Glacier Deep Archive with SSE-S3

Answer

S3 Glacier Flexible Retrieval with SSE-KMS

Answer

S3 Standard-IA with SSE-KMS