SCS-C02 Practice Exam 68 — 20 Questions

Question 1

A company wants to allow its development team to have full access to Amazon S3 buckets that are tagged with 'Environment: Dev'. Which IAM policy element should be used to restrict access based on tags?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use 'aws:ResourceTag' in the Condition element. To restrict access based on tags attached to the S3 bucket (the resource), the IAM policy must use the aws:ResourceTag condition key. This key evaluates the tags on the target resource, allowing or denying actions only when the resource carries the specified tag, such as Environment: Dev.

Answer

Use 'aws:PrincipalTag' in the Condition element

Answer

Use 'aws:SourceTag' in the Condition element

Answer

Use 'aws:RequestTag' in the Condition element

Question 2

A company has a serverless application using AWS Lambda, API Gateway, and DynamoDB. The security team wants to detect and respond to potential SQL injection attempts in API requests. They have enabled AWS WAF on the API Gateway and created a rule to block SQL injection. However, they also want to capture the blocked requests for analysis and store them in an S3 bucket. The team has configured WAF to send logs to Amazon Kinesis Data Firehose, which delivers to an S3 bucket. After testing, the team notices that the logs are not being delivered. The Firehose delivery stream is in the same AWS account, and the S3 bucket policy allows the Firehose service to write. What is the most likely cause?

Accepted Answer

The Kinesis Data Firehose delivery stream does not have an IAM role with permissions to write to the S3 bucket.. The most likely cause is that the Kinesis Data Firehose delivery stream lacks an IAM role with permissions to write to the S3 bucket. Even if the S3 bucket policy allows the Firehose service to write, Firehose assumes an IAM role to access the bucket. If that role does not have the necessary permissions (e.g., s3:PutObject), delivery fails. The other options are less likely because WAF logging is configured (since logs are attempted), the S3 bucket policy is stated to allow write, and Firehose buffering is normal.

Answer

The WAF web ACL is not configured to log blocked requests.

Answer

The S3 bucket policy does not grant write permissions to the Firehose delivery stream's IAM role.

Answer

Kinesis Data Firehose delivers logs in batches every 5 minutes, so the team should wait longer.

Question 3

A company has an AWS Lambda function that needs to access an Amazon RDS database. The database is in a private subnet. Which configuration will allow the Lambda function to securely access the database without traversing the internet?

Accepted Answer

Configure the Lambda function to run in the same VPC as the RDS database, in the same private subnet.. Placing the Lambda function in the same VPC and the same private subnet as the RDS database allows the Lambda function to communicate with the database directly over the AWS network using private IP addresses. This configuration ensures traffic does not traverse the internet, and it leverages VPC routing and security groups for access control. Lambda functions must be configured with VPC settings to access resources in private subnets, and when both are in the same subnet, no additional gateways or peering are required.

Answer

Create a VPC peering connection between the Lambda VPC and the RDS VPC.

Answer

Place the Lambda function in a public subnet and use a NAT gateway to access the RDS database.

Answer

Use a VPC endpoint for Lambda to connect to the RDS database.

Question 4

Which THREE of the following are required to use client-side encryption with Amazon S3 using AWS KMS? (Choose three.)

Accepted Answer

The encrypted data key is stored as metadata with the S3 object.. Option B is correct because with client-side encryption using the AWS SDK Encryption Client, the SDK generates a data key, encrypts the object locally, and stores the encrypted (wrapped) data key as metadata alongside the S3 object so it can be retrieved and unwrapped later. Option D is correct because the caller must have IAM permissions to invoke kms:GenerateDataKey (and typically kms:Decrypt) so the SDK can obtain a plaintext data key and a wrapped copy from AWS KMS. Option E is correct because client-side encryption is performed by the AWS SDK Encryption Client library (e.g., AmazonS3EncryptionClient), which handles key generation, local encryption, and metadata storage; S3 itself never sees plaintext. Option A is not required because a bucket policy forcing encryption governs server-side encryption at the S3 service level and is irrelevant to client-side encryption, which happens before data reaches S3. Option C is not required because the KMS key policy must grant the calling IAM principal (user or role) access to the key, not the S3 service, since S3 is not involved in the KMS operations for client-side encryption.

Answer

An S3 bucket policy that forces encryption.

Answer

A KMS key policy that allows the S3 service to decrypt.

Question 5

A company wants to protect sensitive data stored in Amazon S3. Which TWO actions should the company take to meet this goal? (Choose TWO.)

Accepted Answer

Enable S3 Block Public Access.. Option C (Enable S3 Block Public Access) is correct because it applies account- and bucket-level settings that reject any ACL or bucket policy granting public access, preventing accidental exposure of sensitive objects to the internet. Option E (Enable default encryption on the bucket) is correct because it ensures every object is encrypted at rest with SSE-S3 or SSE-KMS automatically, protecting data confidentiality even if storage media is compromised. Option A (S3 Transfer Acceleration) only speeds up uploads/downloads via edge locations and does not protect data. Option B (S3 event notifications to Amazon SNS) merely reports object events and provides no security control. Option D (S3 Object Lock) enforces WORM retention to prevent deletion or modification, which addresses integrity/retention rather than protecting sensitive data from unauthorized access or disclosure.

Answer

Enable S3 Transfer Acceleration.

Answer

Configure S3 event notifications to send events to Amazon SNS.

Answer

Enable S3 Object Lock.

Question 6

A company uses AWS Systems Manager Session Manager to manage EC2 instances without opening inbound ports. Which IAM policy is required for an EC2 instance to allow Session Manager to connect?

Accepted Answer

AmazonSSMManagedInstanceCore. The AmazonSSMManagedInstanceCore policy grants the minimum permissions required for an EC2 instance to communicate with the Systems Manager service via the SSM Agent, including sending heartbeats, receiving commands, and establishing Session Manager connections. Session Manager does not require inbound ports; it relies on the instance initiating outbound HTTPS connections (port 443) to the SSM endpoints, so the instance needs only the permissions in this managed policy to function as a managed node.

Answer

AmazonSSMFullAccess

Answer

AmazonEC2FullAccess

Answer

AdministratorAccess

Question 7

A company is using AWS Lambda functions to process sensitive data. The security team wants to detect when a Lambda function is invoked with an unexpected payload that may indicate an injection attack. Which AWS service should the team use to inspect the function's input for malicious patterns?

Accepted Answer

None of the above; the team should implement custom validation within the Lambda function.. AWS Lambda functions process event payloads directly within the function code, and no AWS managed service can inspect the actual input data passed to a Lambda function at invocation time. AWS WAF operates at the HTTP/HTTPS layer for API Gateway or CloudFront, not for Lambda function payloads. Amazon Inspector scans for software vulnerabilities in EC2 instances and container images, not runtime payloads. AWS Shield provides DDoS protection at the network and transport layers. Amazon GuardDuty analyzes VPC flow logs, DNS logs, and CloudTrail events for threats, but it does not inspect Lambda function invocation payloads. Therefore, the only way to detect malicious patterns in the function's input is to implement custom validation logic within the Lambda function code itself.

Answer

AWS WAF

Answer

Amazon Inspector

Answer

AWS Shield

Answer

Amazon GuardDuty

Question 8

A company needs to audit all changes to IAM policies in its AWS account. Which AWS service should be used to record the change history of IAM policies?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the service that records API activity in an AWS account, including all changes to IAM policies. When an IAM policy is created, modified, or deleted, CloudTrail logs the event with details such as the identity of the caller, the time of the API call, the source IP address, and the request parameters. This makes CloudTrail the authoritative source for auditing IAM policy changes.

Answer

Amazon CloudWatch Logs

Answer

Amazon GuardDuty

Answer

AWS Config

Question 9

Refer to the exhibit. An IAM policy attached to a user allows s3:GetObject only from a specific IP range and denies all S3 actions if not using HTTPS. What happens when the user makes a GET request from IP 10.0.0.5 using HTTP?

Accepted Answer

Denied because the Deny statement matches. IAM policies evaluate all matching statements, and an explicit Deny always wins over any Allow. The policy denies all S3 actions when the request is not using HTTPS (aws:SecureTransport is false). Since the user made the request over HTTP, the Deny statement matches, so the request is denied regardless of the IP-based Allow.

Answer

Allowed because the IP is in the range

Answer

Allowed because the condition does not match

Answer

Denied because the IP is not in the range

Question 10

A company is designing a data protection strategy for Amazon S3. Which TWO of the following are valid methods to protect data at rest in S3?

Accepted Answer

Server-side encryption with S3-managed keys (SSE-S3). Options D and E are correct because both are encryption mechanisms that protect S3 object data at rest: SSE-S3 (D) encrypts objects with AES-256 keys fully managed by Amazon S3, while SSE-KMS (E) encrypts objects using keys managed in AWS KMS, giving you control over key policies, rotation, and audit trails via CloudTrail. These directly satisfy the requirement of protecting data at rest in S3. Option A (S3 Versioning) preserves multiple object versions to aid recovery from overwrites or deletions but does not encrypt data. Option B (S3 bucket policies) is an access-control mechanism governing who can perform actions on the bucket, not encryption at rest. Option C (MFA Delete) adds an authentication requirement for deleting versions or changing versioning state, which is a deletion-protection control rather than data-at-rest encryption.

Answer

S3 Versioning

Answer

S3 bucket policies

Answer

MFA Delete

Question 11

A company uses AWS CloudTrail and wants to ensure that log files are encrypted at rest and that access to the logs is logged. Which combination of S3 features should be enabled on the destination bucket?

Accepted Answer

Default encryption and server access logging. Enabling default encryption on the S3 bucket ensures that all CloudTrail log files are encrypted at rest using SSE-S3 or SSE-KMS, satisfying the encryption requirement. Enabling server access logging on the same bucket creates detailed records of every request made to the bucket, including who accessed the logs and from where, thus logging access to the logs themselves. This combination directly addresses both requirements: encryption at rest and access logging.

Answer

S3 Transfer Acceleration and default encryption

Answer

MFA Delete and versioning

Answer

S3 Object Lock and versioning

Question 12

A financial services company has a production AWS account with hundreds of EC2 instances running a mix of Linux and Windows workloads. The security team is responsible for detecting and responding to security incidents. They have enabled CloudTrail, VPC Flow Logs, and GuardDuty. Recently, GuardDuty generated a finding indicating that an EC2 instance is communicating with a known malicious IP address. The security engineer needs to investigate the incident. The engineer examines the GuardDuty finding and sees the affected resource is an EC2 instance ID. The engineer wants to identify which user or role launched the instance and what security groups were associated with it at launch time. Which approach should the engineer take to gather this information?

Accepted Answer

Search CloudTrail logs for the RunInstances event that created the instance, using the instance ID to filter.. CloudTrail records every EC2 API call, including RunInstances, with the identity of the caller (user or role), the request parameters (including security group IDs), and the response (including the instance ID). By searching CloudTrail logs for the RunInstances event and filtering by the instance ID in the response elements, the engineer can determine who launched the instance and which security groups were specified at launch.

Answer

Log in to the EC2 console and view the instance details under the 'Security' tab.

Answer

Use AWS Systems Manager Inventory to collect metadata about the instance.

Answer

Use AWS Config to view the configuration history of the EC2 instance and check the security group changes.

Question 13

A company is using AWS WAF to protect a web application. The security team wants to receive alerts when a specific rule block is triggered. Which AWS service should they use to achieve this?

Accepted Answer

CloudWatch Alarms with SNS. AWS WAF integrates with Amazon CloudWatch to provide metrics for each rule, including the 'BlockedRequests' count. By creating a CloudWatch Alarm on this metric, you can trigger an SNS notification when the threshold is exceeded, alerting the security team. This is the standard pattern for receiving alerts on WAF rule actions, as CloudWatch Alarms with SNS provide the necessary monitoring and notification pipeline.

Answer

Amazon EventBridge

Answer

Amazon S3

Answer

Amazon SNS

Question 14

A company runs a critical application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application processes financial transactions and must store transaction logs in an Amazon S3 bucket. The security team requires that all API calls to AWS services are logged and that the logs are stored in a secure, tamper-proof manner. The team enables AWS CloudTrail to log management events and Amazon S3 server access logs for the S3 bucket. They also enable AWS Config to track resource changes. The compliance team wants to ensure that no one can disable CloudTrail logging or delete the CloudTrail log files. The security engineer proposes a solution using an SCP in AWS Organizations to deny actions that would disable CloudTrail or delete log files. However, the engineer is concerned that the SCP might be applied too broadly and affect legitimate administrative actions. The engineer wants to ensure that only the security team’s IAM role (SecurityAdminRole) can perform these restricted actions, while all other principals (including IAM users, roles, and the root user) are denied. The engineer creates an SCP that denies cloudtrail:StopLogging, cloudtrail:DeleteTrail, and s3:DeleteObject on the CloudTrail S3 bucket. The SCP includes a condition that allows the action if the principal is SecurityAdminRole. However, after applying the SCP, the security team finds that even SecurityAdminRole is unable to stop CloudTrail logging. What is the most likely cause of this issue?

Accepted Answer

The condition in the SCP is incorrectly scoped, causing the deny to apply to all principals including SecurityAdminRole.. The SCP's condition is likely misconfigured — for example, using a StringNotEquals on aws:PrincipalArn without accounting for the role's assumed-role ARN format, or placing the condition on the wrong element — causing the Deny to apply to all principals including SecurityAdminRole. SCPs are evaluated as a union of allows and an intersection of denies, so a mis-scoped Deny overrides any Allow.

Answer

The SCP is applied to the root organizational unit (OU), which includes the management account where the root user is not affected by SCPs.

Answer

The SecurityAdminRole does not have the necessary IAM permissions to stop CloudTrail logging.

Answer

The S3 bucket policy on the CloudTrail bucket denies access to the SecurityAdminRole.

Question 15

A company uses AWS Organizations and wants to centrally manage CloudTrail trails across all accounts. Which feature should be enabled?

Accepted Answer

CloudTrail organization trail. A CloudTrail organization trail is a trail created in the management account of an AWS Organization that automatically applies to all member accounts. It logs events from every account in the organization to a single S3 bucket, enabling centralized management and compliance. This is the native feature designed for multi-account CloudTrail governance, requiring no per-account configuration.

Answer

Cross-account CloudTrail

Answer

Service Control Policy for CloudTrail

Answer

AWS Config aggregator

Question 16

A security engineer receives an Amazon GuardDuty finding for 'UnauthorizedAccess:EC2/SSHBruteForce'. The engineer needs to automatically isolate the compromised EC2 instance and then perform forensic analysis. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Create an Amazon EventBridge rule that triggers an AWS Lambda function to isolate the instance by modifying its security group and then take a forensic snapshot.. It automates the isolation and forensic capture of the compromised EC2 instance with minimal operational overhead. An Amazon EventBridge rule listens for the specific GuardDuty finding and triggers an AWS Lambda function that modifies the instance's security group to deny all inbound/outbound traffic (isolation) and then creates an EBS snapshot for forensic analysis. This serverless, event-driven approach eliminates manual intervention and ensures consistent, rapid response.

Answer

Manually SSH into the instance, stop it, and create an AMI for analysis.

Answer

Use AWS Config rules to automatically stop the instance.

Answer

Configure an Auto Scaling lifecycle hook to terminate the instance and launch a new one.

Question 17

A developer needs to allow an EC2 instance to access an S3 bucket. Which is the best practice for granting permissions?

Accepted Answer

Create an IAM role with S3 access and attach it to the EC2 instance profile.. The best practice for granting an EC2 instance access to S3 is to create an IAM role with the necessary S3 permissions and attach it to the EC2 instance via an instance profile. This provides temporary credentials that are automatically rotated, eliminating the need to store long-term access keys on the instance. It follows the principle of least privilege and is the most secure method.

Answer

Store IAM user access keys in a configuration file on the EC2 instance.

Answer

Use a security group to allow the EC2 instance to access S3.

Answer

Attach an S3 bucket policy that grants access to the EC2 instance ID.

Question 18

A company uses AWS Organizations with multiple accounts and wants to ensure that all newly created S3 buckets have encryption enabled. The Security team needs a solution that automatically remediates non-compliant buckets without manual intervention. What should they do?

Accepted Answer

Enable AWS Config with the s3-bucket-server-side-encryption-enabled rule and set up automatic remediation using Systems Manager Automation.. AWS Config can continuously evaluate S3 buckets against the s3-bucket-server-side-encryption-enabled rule and automatically remediate non-compliant buckets using Systems Manager Automation, requiring no manual intervention. Option A is incorrect because a service control policy (SCP) cannot enforce encryption on bucket creation; the described SCP is circular and unenforceable since it denies s3:PutBucketEncryption unless encryption is already enabled, which is impossible to satisfy at creation time.

Answer

Apply a service control policy (SCP) that denies the s3:PutBucketPublicAccessBlock and s3:PutBucketEncryption actions unless the bucket has encryption enabled.

Answer

Use an S3 bucket policy that denies PutObject unless the request includes the x-amz-server-side-encryption header.

Answer

Create an IAM role with permissions to enforce encryption and attach it to all accounts in the organization.

Question 19

A company uses Amazon GuardDuty to monitor for threats. The security team receives a high-severity finding: 'UnauthorizedAccess:EC2/SSHBruteForce'. The finding indicates a single EC2 instance with a public IP is receiving SSH connection attempts from multiple external IPs. The instance is part of an Auto Scaling group and is fronted by an Application Load Balancer (ALB). The security team wants to block the attacking IPs without disrupting legitimate traffic. What is the MOST effective approach?

Accepted Answer

Modify the security group of the EC2 instance to deny inbound SSH from the attacking IPs.. Modifying the security group of the EC2 instance to deny inbound SSH from the attacking IPs directly blocks the SSH brute force attempts at the instance level. Since the instance is part of an Auto Scaling group, security group modifications will apply to all instances launched with that security group, and updates are immediate. Option D (AWS WAF on ALB) is ineffective because WAF only inspects HTTP/HTTPS traffic at Layer 7, while SSH traffic operates at Layer 4 and does not pass through the ALB; the ALB only handles HTTP/HTTPS, not SSH. The attackers are targeting the instance's public IP directly over SSH, not through the ALB. Therefore, WAF cannot block SSH traffic. Option A (stop instance) is disruptive and unnecessary. Option C (network ACL) would block traffic at the subnet level but would affect all instances in the subnet and is less granular than a security group.

Answer

Stop the EC2 instance and launch a new one in a different subnet.

Answer

Create a network ACL rule on the subnet to deny inbound traffic from the attacking IPs.

Answer

Configure AWS WAF on the ALB to block the attacking IPs using an IP set rule.

Question 20

A company wants to provide temporary, limited-privilege credentials to users so they can access AWS resources from mobile applications. Which AWS service should the company use?

Accepted Answer

AWS Security Token Service (STS). AWS Security Token Service (STS) is the correct service because it enables the generation of temporary, limited-privilege credentials (access key, secret key, and session token) that can be used to access AWS resources. These credentials are ideal for mobile applications where long-term keys are a security risk, as they can be scoped with an IAM role and have a configurable expiration (default 1 hour, max 36 hours). STS supports the AWS Signature Version 4 signing process and can be called via the AssumeRole or GetFederationToken APIs to provide federated access.

Answer

AWS Single Sign-On (SSO)

Answer

AWS Identity and Access Management (IAM) users

Answer

Amazon Cognito user pools