SCS-C02 Practice Exam 69 — 20 Questions

Question 1

A company wants to ensure that IAM users with console access have strong passwords. Which IAM password policy setting should the company configure to enforce the use of at least one uppercase letter?

Accepted Answer

RequireUppercaseCharacters. The IAM password policy setting `RequireUppercaseCharacters` specifically enforces that IAM user passwords contain at least one uppercase letter (A-Z). When enabled, any password created or changed must include an uppercase character, otherwise IAM rejects it. This directly satisfies the requirement to enforce uppercase letters for console users.

Answer

MinimumPasswordLength

Answer

RequireNumbers

Answer

RequireSymbols

Question 2

A company is storing sensitive data in Amazon S3 buckets. They want to ensure that all uploaded objects are encrypted at rest using server-side encryption with AWS KMS (SSE-KMS). Which bucket policy statement will enforce this?

Accepted Answer

{"Effect": "Deny", "Principal": "*", "Action": "s3:PutObject", "Resource": "arn:aws:s3:::bucket/*", "Condition": {"StringNotEquals": {"s3:x-amz-server-side-encryption": "aws:kms"}}}. It uses a Deny effect with a StringNotEquals condition on the s3:x-amz-server-side-encryption header set to 'aws:kms'. This ensures that any PutObject request that does not include the header specifying SSE-KMS is denied, effectively enforcing that all uploaded objects must be encrypted with AWS KMS. The Deny effect overrides any Allow, making this policy robust against accidental or malicious uploads without the required encryption.

Answer

{"Effect": "Deny", "Principal": "*", "Action": "s3:PutObject", "Resource": "arn:aws:s3:::bucket/*", "Condition": {"StringNotEquals": {"s3:x-amz-server-side-encryption": "AES256"}}}

Answer

{"Effect": "Allow", "Principal": "*", "Action": "s3:PutObject", "Resource": "arn:aws:s3:::bucket/*", "Condition": {"StringEquals": {"s3:x-amz-server-side-encryption": "aws:kms"}}}

Answer

{"Effect": "Deny", "Principal": "*", "Action": "s3:PutObject", "Resource": "arn:aws:s3:::bucket/*", "Condition": {"StringEquals": {"s3:x-amz-server-side-encryption": "aws:kms"}}}

Question 3

A company uses AWS KMS to encrypt data in Amazon S3. The security team needs to audit all KMS key usage, including who used the key, when, and what operation was performed. Which AWS service should be used to meet this requirement?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all AWS KMS API calls as events, including who made the request, the source IP address, the time of the request, and the specific operation performed (e.g., Encrypt, Decrypt, GenerateDataKey). These audit logs are stored in an S3 bucket and can be analyzed to meet the security team's requirement for full key usage auditing.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

AWS CloudHSM

Question 4

A company wants to host a static website in an Amazon S3 bucket. The bucket must be private and accessible only through an Amazon CloudFront distribution. Which configuration ensures that CloudFront can access the S3 bucket while blocking direct access via S3 URL?

Accepted Answer

Create an Origin Access Control (OAC) and update the bucket policy to allow access only to the CloudFront distribution. Origin Access Control (OAC) is the recommended way to secure an S3 origin for CloudFront. OAC allows CloudFront to sign requests to S3, and the bucket policy can be configured to allow access only from the specific CloudFront distribution using the OAC. This blocks direct access via S3 URL because the bucket policy does not grant public access.

Answer

Use CloudFront signed URLs and configure the bucket policy to allow access from CloudFront IP ranges

Answer

Enable S3 Block Public Access and configure CloudFront to use the bucket as an origin

Answer

Configure the bucket policy to allow s3:GetObject from the CloudFront service principal

Question 5

A company uses IAM roles for EC2 instances to access S3. A security audit reveals that some instances have roles with overly permissive policies. What is the BEST practice to scope down permissions while maintaining functionality?

Accepted Answer

Create custom IAM policies that grant only the necessary S3 actions on specific buckets. The best practice to scope down permissions while maintaining functionality is to create custom IAM policies that grant only the necessary S3 actions on specific buckets. This follows the principle of least privilege, ensuring that the EC2 instances have exactly the permissions they need to perform their tasks, and no more. This approach is more granular and secure than using broader policies or alternative methods.

Answer

Use S3 bucket policies instead of IAM policies

Answer

Attach the AdministratorAccess policy to the role and use S3 conditions

Answer

Create a new instance profile with a more restrictive permissions boundary

Question 6

Refer to the exhibit. A security engineer runs the AWS CLI command shown and receives an AccessDenied error. The IAM user Alice has a policy that grants kms:Decrypt on all resources. What is the most likely cause of the error?

Accepted Answer

The KMS key policy does not grant kms:Decrypt to the IAM user Alice.. AWS KMS enforces a two-part authorization model: the caller must be allowed by both the identity-based IAM policy and the KMS key policy. Even though Alice's IAM policy grants kms:Decrypt on all resources, the key policy must also grant her (or her account with delegation) access to that key. If the key policy does not permit Alice, the request is denied, which is the most likely cause of the AccessDenied error.

Answer

The IAM user policy does not allow kms:Decrypt.

Answer

The command uses the wrong key ID.

Answer

The ciphertext blob is corrupted.

Question 7

Which TWO AWS services can be used to monitor and audit data access patterns to Amazon S3 buckets? (Choose 2.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail (C) is correct because it records S3 data-plane API calls such as GetObject and PutObject when data events are enabled, providing an audit trail of who accessed which objects and when. Amazon S3 Server Access Logs (D) is correct because S3 can deliver detailed, per-request access records (requester, bucket, operation, HTTP status, bytes) directly to a target bucket for auditing access patterns. AWS Config (A) tracks resource configuration changes and compliance, not object-level data access patterns. AWS CloudWatch (B) provides metrics, logs, and alarms but does not natively audit S3 object access requests. AWS Trusted Advisor (E) offers best-practice checks and recommendations, not access auditing.

Answer

AWS Config

Answer

AWS CloudWatch

Answer

AWS Trusted Advisor

Question 8

Which THREE measures can be taken to secure a VPC's network boundary? (Choose three.)

Accepted Answer

Use security groups to control inbound and outbound traffic at the instance level.. Option B is correct because security groups act as stateful virtual firewalls at the instance/ENI level, allowing you to permit only specific inbound and outbound traffic, which directly hardens the VPC boundary. Option D is correct because network ACLs provide stateless subnet-level filtering with allow and deny rules, adding a second layer of defense that complements security groups. Option E is correct because VPC Flow Logs capture IP traffic metadata to CloudWatch Logs or S3, enabling detection and analysis of suspicious or unauthorized traffic crossing the VPC boundary. Option A is not correct here because an S3 bucket policy secures access to an S3 bucket, not the VPC network boundary. Option C is not correct because attaching an internet gateway enables connectivity to the internet rather than restricting or securing the boundary.

Answer

Attach an S3 bucket policy to restrict access to the bucket.

Answer

Attach an internet gateway to the VPC.

Question 9

A security engineer needs to monitor DNS query logs for malicious domain names. Which THREE services can be used together to collect, analyze, and alert on DNS logs? (Choose THREE.)

Accepted Answer

Amazon CloudWatch Logs. Amazon Route 53 Resolver Query Logs (C) is the correct source because it captures DNS queries made by resources in a VPC, including the queried domain name, query type, and response code, which is exactly the raw DNS log data needed for detecting malicious domains. Amazon CloudWatch Logs (A) is correct because Resolver query logs can be published to a CloudWatch Logs log group, where they are stored and made available for metric filters, subscriptions, and retention management. AWS Lambda (B) is correct because a CloudWatch Logs subscription filter can stream matching log events to a Lambda function, which can then parse the DNS records, check domains against threat intelligence, and trigger alerts via SNS or other services. Amazon GuardDuty (D) is not part of this collection/analysis/alerting pipeline for raw DNS query logs; it is a managed threat detection service that analyzes its own findings rather than ingesting and processing Resolver query logs for custom alerting. Amazon Athena (E) is a query service for data in S3 and, while it can analyze logs stored in S3, it is not one of the three services used together here to collect, process, and alert on DNS logs in this scenario.

Answer

Amazon GuardDuty

Answer

Amazon Athena

Question 10

A company wants to detect anomalous behavior in their AWS environment. Which THREE AWS services can be used for threat detection? (Choose THREE.)

Accepted Answer

AWS Security Hub. Amazon GuardDuty (D) is correct because it is a managed threat detection service that continuously monitors VPC Flow Logs, AWS CloudTrail management and S3 data events, and DNS logs to identify malicious or anomalous activity such as cryptocurrency mining, credential compromise, and reconnaissance. AWS Security Hub (B) is correct because it aggregates and correlates findings from GuardDuty, Inspector, Macie, and other sources, applies security standards checks, and surfaces prioritized threat-detection insights across accounts and Regions. Amazon Inspector (E) is correct because it performs automated vulnerability management by scanning EC2 instances, container images in ECR, and Lambda functions for software vulnerabilities and unintended network exposure, which supports detecting risky or anomalous configurations. AWS Trusted Advisor (A) is not a threat-detection service; it provides best-practice checks on cost, performance, security, fault tolerance, and service quotas. AWS Config (C) is a configuration recording and compliance-evaluation service that tracks resource changes and rule compliance, but it does not itself detect threats or malicious behavior.

Answer

AWS Trusted Advisor

Answer

AWS Config

Question 11

A company has an S3 bucket with versioning and MFA Delete enabled. A user attempts to delete an object version using the AWS CLI without MFA. What will happen?

Accepted Answer

The request fails with an AccessDenied error.. When MFA Delete is enabled on an S3 bucket, any request to permanently delete an object version or to change the versioning state of the bucket must include a valid MFA token. If a user attempts to delete an object version without MFA, the request fails with an AccessDenied error. This is the expected behavior to protect against accidental or malicious deletions.

Answer

The object version is marked for deletion and will be deleted after 30 days.

Answer

The object version is deleted and a delete marker is created.

Answer

The object version is deleted but not permanently.

Question 12

Refer to the exhibit. A security engineer runs the IAM Policy Simulator with the provided policy input. The result shows 'explicitDeny' for ec2:RunInstances even though the policy only contains an Allow. What is the most likely reason?

Accepted Answer

The user has an attached policy or SCP that explicitly denies ec2:RunInstances.. The IAM Policy Simulator evaluates the effective permissions by combining all applicable policies — identity-based policies, resource-based policies, permissions boundaries, SCPs, and session policies. An 'explicitDeny' result means some policy in the evaluation chain contains an explicit Deny statement for ec2:RunInstances, which always overrides any Allow. Since the input policy only has an Allow, the deny must originate from an attached policy or an SCP in the account hierarchy.

Answer

The policy input has a syntax error.

Answer

The simulate-custom-policy command does not support ec2:RunInstances.

Answer

The resource ARN is incorrect for ec2:RunInstances.

Question 13

A company runs a multi-tier web application on AWS. The web tier uses an Application Load Balancer (ALB) in a public subnet, and the application tier runs on EC2 instances in private subnets. The security team recently ran a vulnerability scan and found that the application instances are accessible from the internet on port 8080. The EC2 instances have a security group that allows inbound traffic on port 8080 from the ALB's security group only. However, the ALB's security group allows inbound traffic on port 8080 from 0.0.0.0/0. The architecture also includes a NAT Gateway for outbound internet access from private subnets. The security engineer needs to ensure that only the ALB can communicate with the application instances on port 8080, and that the application instances cannot be directly accessed from the internet. What should the security engineer do?

Accepted Answer

Modify the ALB security group to remove the inbound rule for port 8080 from 0.0.0.0/0, and configure the ALB listener to forward traffic from port 80/443 to port 8080 on the target group.. The ALB security group should only allow inbound traffic on the listener ports (80/443) from the internet, not port 8080. The ALB listener then forwards to the target group on port 8080, and the EC2 security group already restricts 8080 to the ALB's security group. Removing the 0.0.0.0/0 rule on 8080 from the ALB SG closes the exposure while preserving the ALB-to-instance path.

Answer

Change the EC2 instance security group to allow inbound traffic on port 8080 from 0.0.0.0/0, and rely on the subnet network ACL to block traffic.

Answer

Add a rule to the EC2 security group that denies inbound traffic from 0.0.0.0/0 on port 8080.

Answer

Place the EC2 instances in a public subnet and use a network ACL to block inbound traffic on port 8080 from the internet.

Question 14

A company wants to ensure that all data transferred between its on-premises data center and AWS is encrypted in transit. Which AWS service should be used to meet this requirement?

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN encrypts data in transit between an on-premises network and AWS by establishing IPsec tunnels over the public internet, satisfying the requirement for encryption in transit. It uses IKE for key exchange and IPsec ESP for payload encryption, providing confidentiality and integrity for all traffic traversing the VPN connection. This is the standard AWS service for encrypted hybrid connectivity.

Answer

Amazon CloudFront

Answer

AWS Transit Gateway

Answer

AWS Direct Connect

Question 15

An IAM policy grants access to a DynamoDB table with a condition that the request must originate from a specific VPC endpoint. However, requests from an EC2 instance in that VPC are being denied. What is the most likely cause?

Accepted Answer

The EC2 instance is not using the VPC endpoint to access DynamoDB; it is using an internet gateway.. The IAM policy condition uses aws:SourceVpce to restrict access to requests routed through a specific VPC endpoint. If the EC2 instance reaches DynamoDB via an internet gateway (using the public DynamoDB endpoint), the request's source is not the VPC endpoint, so the condition evaluates to false and access is denied. The instance must be configured to resolve the DynamoDB service name to the VPC endpoint's private DNS name (via the endpoint's private DNS or a Route 53 private hosted zone) so traffic actually flows through the endpoint.

Answer

The EC2 instance does not have a public IP address.

Answer

The security group on the EC2 instance does not allow outbound traffic to the DynamoDB endpoint.

Answer

The VPC endpoint policy does not allow the specific DynamoDB action.

Question 16

A company is deploying a multi-tier web application across multiple Availability Zones. The application includes a web tier, application tier, and database tier. The security team requires that the web tier can communicate with the application tier only on port 8080, and the application tier can communicate with the database tier only on port 3306. Which security group configuration should be used?

Accepted Answer

In the application tier security group, allow inbound from the web tier security group on port 8080. In the database tier security group, allow inbound from the application tier security group on port 3306.. Referencing security groups as sources (security group referencing) is the AWS-recommended, least-privilege approach for tiered applications. The application tier SG allows inbound on 8080 only from the web tier SG, and the database tier SG allows inbound on 3306 only from the application tier SG. This ensures traffic is permitted based on the identity of the source instances, not on IP ranges, and it scales automatically as instances are added or removed.

Answer

In the database tier security group, allow inbound from the application tier's CIDR block on port 3306.

Answer

In the application tier security group, allow inbound from the web tier's CIDR block on port 8080.

Answer

In the web tier security group, allow outbound to 0.0.0.0/0 on port 8080.

Question 17

A company is using AWS CloudTrail to log API calls. The security team wants to ensure that log files are not modified after they are created. Which feature should they enable?

Accepted Answer

Log file integrity validation. CloudTrail log file integrity validation uses SHA-256 hashing and RSA digital signatures to create digest files that let you verify log files have not been altered or deleted after delivery. It is the native CloudTrail feature designed specifically for tamper detection.

Answer

Server-side encryption with AWS KMS

Answer

S3 Object Lock

Answer

CloudWatch Logs integration

Question 18

A developer needs to run an application on an EC2 instance that accesses an S3 bucket. What is the best practice for granting permissions?

Accepted Answer

Create an IAM role with S3 access and attach it to the EC2 instance profile.. Attaching an IAM role to an EC2 instance profile provides temporary, automatically rotated credentials to the instance, eliminating the need to hardcode or manage long-term access keys. This follows the AWS best practice of using IAM roles for EC2 to grant least-privilege permissions to AWS services like S3. The instance profile acts as a container for the role and allows the EC2 instance to assume it, with credentials delivered via the Instance Metadata Service (IMDS).

Answer

Use an SCP to allow S3 access for the instance.

Answer

Create a bucket policy that grants access to the instance ID.

Answer

Store AWS access keys on the instance and use them in the application.

Question 19

A security engineer is designing a VPC with public and private subnets. The application servers in the private subnets need to access the internet for software updates, but must not be directly reachable from the internet. Which TWO actions satisfy these requirements?

Accepted Answer

Add a route in the private subnet's route table pointing to the NAT gateway.. Option B is correct because the private subnet's route table must contain a route (typically 0.0.0.0/0) targeting the NAT gateway so that outbound internet-bound traffic from private instances is forwarded through the NAT. Option E is correct because the NAT gateway itself must reside in a public subnet with a route to an internet gateway, allowing it to translate private instances' traffic to the internet while preventing inbound connections to those instances. Together, B and E provide outbound-only internet access for the private application servers. Option A is wrong because allowing inbound 0.0.0.0/0 on the private subnet's security group would make the servers reachable from the internet, violating the requirement. Option C is wrong because attaching an internet gateway to a private subnet's route table would make the subnet public and expose the instances directly. Option D is wrong because a VPC gateway endpoint for Amazon S3 only provides private access to S3, not general internet access for software updates.

Answer

Configure the private subnet's security group to allow inbound traffic from 0.0.0.0/0.

Answer

Attach an internet gateway to the private subnet's route table.

Answer

Create a VPC gateway endpoint for Amazon S3.

Question 20

A company uses AWS CloudTrail to log all API calls. The security team needs to be alerted when an IAM user creates a new access key. Which approach is most efficient?

Accepted Answer

Create a CloudWatch Events rule that matches the CreateAccessKey event and targets an SNS topic.. CloudWatch Events (now part of Amazon EventBridge) can directly match the CreateAccessKey API call from AWS CloudTrail in real time and trigger an SNS notification. This approach is the most efficient as it requires no polling, no additional infrastructure, and provides immediate alerting with minimal latency.

Answer

Enable AWS Config managed rule to detect access key creation and trigger an SNS notification.

Answer

Use CloudWatch Logs Insights to run a query every minute on CloudTrail logs and send results to SNS.

Answer

Configure CloudTrail to send logs to an S3 bucket and enable S3 event notifications to an SNS topic.