SCS-C02 Practice Exam 70 — 20 Questions

Question 1

During incident response, a security engineer needs to preserve the state of a running EC2 instance for forensic analysis without losing volatile data. The instance is in an Auto Scaling group. Which action should the engineer take FIRST?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Suspend the `HealthCheck` and `ReplaceUnhealthy` processes on the Auto Scaling group.. Suspending the `HealthCheck` and `ReplaceUnhealthy` processes on the Auto Scaling group prevents the group from detecting the instance as unhealthy and terminating it while the engineer preserves volatile data. This is the first step to ensure the instance remains running and accessible for forensic collection (e.g., memory dump) before any other actions that could alter its state.

Answer

Detach the instance from the Auto Scaling group.

Answer

Stop the instance to preserve its EBS volumes.

Answer

Take an AMI of the instance immediately.

Question 2

A security engineer is investigating a possible data exfiltration from an S3 bucket. Which THREE AWS services can be used to detect and alert on suspicious activity? (Choose THREE.)

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty (B) is correct because it continuously monitors CloudTrail management and S3 data events, VPC Flow Logs, and DNS logs using threat intelligence and machine learning to generate findings such as Exfiltration:S3/ObjectRead.Unusual or Discovery:S3, which directly detect suspicious S3 access patterns. AWS CloudTrail (C) is correct because it records S3 data events (GetObject, PutObject, DeleteObject) and management events, providing the audit trail needed to identify anomalous API calls and feed GuardDuty and CloudWatch analysis. Amazon Macie (E) is correct because it uses machine learning and pattern matching to discover sensitive data in S3, and its findings (e.g., Policy:IAMUser/S3BucketPublic, SensitiveData:S3Object/Multiple) plus CloudWatch Events integration can alert on potential exfiltration of sensitive objects. Amazon CloudWatch Logs (A) is not a detection service for S3 activity by itself; it stores and monitors log streams but requires CloudTrail or other sources to capture S3 API calls. AWS Config (D) tracks resource configuration changes and compliance but does not analyze S3 object access behavior or sensitive data movement, so it cannot detect exfiltration activity.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Question 3

A company wants to allow only specific IP addresses to access an S3 bucket. Which two methods can achieve this? (Choose TWO.)

Accepted Answer

Use an IAM policy with a condition that limits access to specific IP addresses.. Option A is correct because an IAM policy can include a Condition element using the aws:SourceIp (or aws:SourceIp with NotIpAddress) key to allow or deny requests based on the requester's IP address, effectively restricting access to specific IPs for the identities the policy is attached to. Option E is correct because an S3 bucket policy is a resource-based policy that can also use the aws:SourceIp condition key to allow only specified IP addresses to access the bucket, which is the most direct way to enforce IP restrictions on the bucket itself. Option B is not correct because a network ACL operates at the subnet level and filters traffic by IP/port for resources in a VPC, but it cannot govern access to an S3 bucket endpoint (especially public S3 endpoints) and does not apply to bucket-level authorization. Option C is not correct because VPC Flow Logs only capture and record IP traffic metadata for monitoring; they do not filter or block traffic. Option D is not correct because security groups are attached to network interfaces (such as EC2 instances) and cannot be attached to an S3 bucket, and S3 does not use security groups for access control.

Answer

Configure a network ACL on the subnet that blocks traffic from all but specific IPs.

Answer

Enable VPC Flow Logs to filter traffic from specific IPs.

Answer

Attach a security group to the S3 bucket that allows traffic only from specific IPs.

Question 4

A security engineer is configuring a VPC for a three-tier application. The web tier must be accessible from the internet, the application tier must be accessible only from the web tier, and the database tier must be accessible only from the application tier. Which TWO security group configurations should be used? (Choose TWO.)

Accepted Answer

Allow inbound HTTP/HTTPS from 0.0.0.0/0 on the web tier security group.. Option B is correct because the web tier is the only tier that must be reachable from the internet, so its security group should permit inbound HTTP (TCP 80) and HTTPS (TCP 443) from 0.0.0.0/0. Option D is correct because the application tier must be accessible only from the web tier, and referencing the web tier's security group as the source in the application tier's inbound rule enforces that tier-to-tier restriction. Option A is wrong because allowing SSH from 0.0.0.0/0 exposes the web tier to unrestricted remote administration and is not required by the scenario. Option C is wrong because the database tier should accept traffic only from the application tier, not directly from the web tier. Option E is wrong because exposing the database tier to inbound HTTP/HTTPS from the internet violates the requirement that it be accessible only from the application tier.

Answer

Allow inbound SSH from 0.0.0.0/0 on the web tier security group.

Answer

Allow inbound HTTP/HTTPS from the web tier security group on the database tier security group.

Answer

Allow inbound HTTP/HTTPS from the internet on the database tier security group.

Question 5

Which TWO actions can be taken to improve the security of an Amazon RDS for MySQL database instance? (Choose TWO.)

Accepted Answer

Place the RDS instance in a private subnet and restrict inbound traffic to the application security group.. Option A is correct because placing the RDS for MySQL instance in a private subnet removes it from direct internet reachability, and restricting inbound traffic to only the application's security group enforces least-privilege network access at the database port (3306 for MySQL). Option E is correct because enabling encryption at rest with AWS KMS protects the underlying storage, automated backups, read replicas, and snapshots, so data cannot be read if the storage media is compromised. Option B is incorrect because disabling automated backups reduces recoverability and does not improve security. Option C is incorrect because Multi-AZ is a high-availability/fault-tolerance feature, not a security control. Option D is incorrect because assigning a public IP address exposes the database to the internet and increases the attack surface.

Answer

Disable automated backups to reduce storage costs.

Answer

Enable Multi-AZ deployment for fault tolerance.

Answer

Assign a public IP address to the RDS instance for easier access from the internet.

Question 6

Which TWO AWS services can be used to detect and alert on suspicious API activity in real-time? (Choose two.)

Accepted Answer

AWS CloudTrail with CloudWatch Events. AWS CloudTrail with CloudWatch Events (A) is correct because CloudTrail records every API call as a management or data event, and CloudWatch Events (now EventBridge) can match those events in near real-time using rules and trigger alerts via SNS, Lambda, or other targets, enabling detection of suspicious API activity as it happens. Amazon GuardDuty (E) is correct because it continuously analyzes CloudTrail management events, VPC Flow Logs, and DNS logs with threat intelligence and machine learning to detect anomalous or malicious API activity and generate findings in real time. VPC Flow Logs (B) only capture IP traffic metadata at the network interface level, not API-level activity, so they cannot directly detect suspicious API calls. Amazon S3 (C) is an object storage service and provides no native detection or alerting for API activity. AWS Config (D) evaluates resource configuration compliance and records configuration changes, but it is not designed for real-time detection and alerting on suspicious API behavior.

Answer

VPC Flow Logs

Answer

Amazon S3

Answer

AWS Config

Question 7

During an incident response, a security engineer needs to capture a memory image of a compromised Amazon EC2 instance running Linux. The instance is in a production Auto Scaling group. Which approach is BEST?

Accepted Answer

Detach the instance from the Auto Scaling group, isolate it by changing security groups, and use AWS Systems Manager Run Command to execute a memory acquisition tool.. It preserves the volatile memory evidence by detaching the instance from the Auto Scaling group (preventing replacement) and isolating it via security group changes, then using AWS Systems Manager Run Command to execute a memory acquisition tool like LiME or AVML. This approach captures the memory image without shutting down the instance, which would destroy the evidence, and avoids the risk of the Auto Scaling group automatically terminating or replacing the instance during the investigation.

Answer

Use AWS CloudFormation to create a new stack with a forensic instance and copy the compromised instance's data.

Answer

Terminate the instance immediately to prevent further damage and launch a replacement.

Answer

Take a snapshot of the EBS volumes and attach them to a forensic instance to analyze memory.

Question 8

A security engineer is investigating an AWS CloudTrail log entry that shows an unauthorized API call to delete an S3 bucket. Which service should the engineer use to analyze the log data for patterns of similar malicious activity?

Accepted Answer

Amazon CloudWatch Logs Insights. Amazon CloudWatch Logs Insights is the service designed for interactively querying and analyzing log data stored in CloudWatch Logs. In this scenario, the security engineer already has a CloudTrail log entry and needs to search through the logs for patterns of similar malicious activity. CloudWatch Logs Insights allows running queries to identify such patterns. Amazon GuardDuty is a threat detection service that automatically monitors for malicious activity, but it does not provide a means for the engineer to directly analyze log data; it generates findings based on its own analysis.

Answer

AWS Config

Answer

AWS Artifact

Answer

Amazon GuardDuty

Question 9

A company uses Amazon GuardDuty and receives a finding of type 'Backdoor:EC2/C&CActivity.B!DNS' for an EC2 instance. What does this finding indicate?

Accepted Answer

The instance is communicating with a known command and control server.. The finding 'Backdoor:EC2/C&CActivity.B!DNS' indicates that GuardDuty has detected DNS queries from the EC2 instance to a domain associated with known command and control (C&C) infrastructure. This is based on GuardDuty's threat intelligence feeds that map DNS request patterns to known malicious domains, signaling that the instance may be compromised and communicating with an attacker's server.

Answer

The instance is being targeted by an SSH brute force attack.

Answer

The instance is exfiltrating data to an S3 bucket.

Answer

The instance is being used in a DDoS attack.

Question 10

A security engineer applies the bucket policy shown in the exhibit to an S3 bucket. What is the effect of this policy?

Accepted Answer

Allows uploads only if they use SSE-KMS.. The bucket policy shown in the exhibit uses a Deny effect with a condition that checks whether the s3:x-amz-server-side-encryption header does not equal aws:kms, which means any upload request that does not specify SSE-KMS encryption is denied. Therefore, the policy effectively allows uploads only if they use SSE-KMS. This is a common pattern to enforce encryption at rest with a specific KMS key type.

Answer

Allows uploads only if they use SSE-S3.

Answer

Allows uploads without encryption.

Answer

Allows uploads with any server-side encryption.

Question 11

A company uses Amazon Route 53 for DNS and wants to log all DNS queries made from its VPC. The logs must be stored in Amazon S3 for compliance purposes. Which solution meets these requirements?

Accepted Answer

Enable Route 53 Resolver query logging and publish to an S3 bucket.. Route 53 Resolver query logging is the native AWS feature designed to capture DNS queries that originate from resources within a VPC. By enabling this feature and specifying an S3 bucket as the destination, you can log all DNS queries made by EC2 instances, Lambda functions, and other VPC resources without needing any additional agents or configuration. This directly meets the requirement for storing DNS query logs in S3 for compliance.

Answer

Install a CloudWatch Logs agent on each EC2 instance and configure it to send DNS logs to CloudWatch Logs.

Answer

Enable AWS CloudTrail for DNS API calls and deliver to an S3 bucket.

Answer

Enable VPC Flow Logs and publish to an S3 bucket.

Question 12

A security team wants to detect and alert on potential security threats such as compromised instances or malicious activity within their AWS environment. Which TWO AWS services should be used together to provide comprehensive threat detection?

Accepted Answer

AWS Security Hub. Amazon GuardDuty (E) is correct because it is the AWS managed threat detection service that continuously monitors VPC Flow Logs, DNS logs, and CloudTrail management/event logs using machine learning and threat intelligence feeds to identify compromised instances, reconnaissance, and malicious activity. AWS Security Hub (A) is correct because it aggregates and prioritizes findings from GuardDuty and other services into a single dashboard, enabling centralized alerting and automated response workflows for comprehensive threat visibility. Together, GuardDuty provides the detection engine while Security Hub provides aggregation and alerting. AWS CloudTrail (B) only records API activity for auditing and does not itself detect or alert on threats. Amazon Inspector (C) is a vulnerability management service that scans EC2 instances and container images for software vulnerabilities and unintended network exposure, not runtime threat detection. AWS Config (D) evaluates resource configuration compliance against rules and does not perform threat detection or alerting on malicious behavior.

Answer

AWS CloudTrail

Answer

Amazon Inspector

Answer

AWS Config

Question 13

Refer to the exhibit. A security engineer finds this CloudTrail log entry. What is the most significant security concern indicated by this event?

Accepted Answer

The security group rule allows SSH access from any IP address (0.0.0.0/0).. The CloudTrail log entry shows an `AuthorizeSecurityGroupIngress` API call that adds a rule allowing SSH (port 22) from 0.0.0.0/0. This is a critical security concern because it exposes the EC2 instance to SSH access from any IP address on the internet, creating a high risk of brute-force attacks, unauthorized access, and potential compromise. Security best practices mandate restricting SSH access to specific trusted IP ranges, not the entire internet.

Answer

The event is a normal administrative action and poses no security concern.

Answer

The user did not have MFA enabled when assuming the AdminRole.

Answer

The source IP address (203.0.113.5) is from an unusual location.

Question 14

A security team wants to centrally collect and analyze VPC Flow Logs from multiple AWS accounts for security monitoring. Which solution is MOST scalable and cost-effective?

Accepted Answer

Use AWS Organizations to centralize logging by delivering VPC Flow Logs to a centralized S3 bucket and query with Amazon Athena.. Using AWS Organizations to centrally deliver VPC Flow Logs to a centralized S3 bucket, then querying with Amazon Athena, is both scalable and cost-effective. S3 provides durable, low-cost storage for large volumes of log data, and Athena allows serverless, pay-per-query analysis without provisioning infrastructure. This approach avoids the operational overhead of managing EC2 instances or streaming pipelines, and scales seamlessly as log volume grows.

Answer

Aggregate logs in an EC2 instance running an ELK stack.

Answer

Use Amazon Kinesis Data Firehose to stream logs to an S3 bucket and process with AWS Lambda.

Answer

Configure VPC Flow Logs to send to a centralized CloudWatch Logs account using cross-account subscriptions.

Question 15

A security engineer wants to detect and alert on AWS account root user activity. Which THREE services can be used together to achieve this? (Select THREE.)

Accepted Answer

Amazon CloudWatch Events (EventBridge). Amazon CloudTrail (C) is correct because it records AWS API activity including root user sign-in events and console logins, which are captured as management events in the CloudTrail event history and delivered to an S3 bucket or CloudWatch Logs. Amazon CloudWatch Logs (D) is correct because CloudTrail can be configured to send its trail logs to a CloudWatch Logs log group, where log data can be retained and made available for metric filters and alarms. Amazon CloudWatch Events (EventBridge) (B) is correct because it can match specific CloudTrail API events (for example, events with a userIdentity type of Root) via event patterns and route them to targets such as SNS or Lambda to generate alerts. AWS Config (A) is not correct because it evaluates resource configuration compliance and records configuration changes, not real-time API activity or root user sign-in events. Amazon GuardDuty (E) is not correct because it is a threat detection service that analyzes VPC flow logs, DNS logs, and CloudTrail management events for malicious or anomalous behavior, but it does not provide the event-matching and alerting pipeline for root user activity described here.

Answer

AWS Config

Answer

Amazon GuardDuty

Question 16

A company is storing sensitive data in Amazon S3. They want to ensure that all data is encrypted at rest using server-side encryption. Which THREE options are available for server-side encryption in S3? (Select THREE.)

Accepted Answer

SSE-KMS. SSE-KMS (B) is a valid S3 server-side encryption option in which S3 encrypts objects using keys managed by AWS KMS, giving you control over key policies, audit trails via CloudTrail, and separation of permissions. SSE-S3 (C) is also correct: S3 manages the encryption keys entirely with AES-256, and it is the default server-side encryption applied to objects at rest. SSE-C (D) is correct as well: the customer provides the encryption key on each request, and S3 performs the encryption/decryption server-side without storing the key. Client-side encryption (A) is not server-side encryption because data is encrypted before it reaches S3, so S3 never performs the encryption. AWS CloudHSM (E) is a dedicated hardware security module service, not an S3 server-side encryption option, though it can be used with SSE-C or custom key management.

Answer

Client-side encryption

Answer

AWS CloudHSM

Question 17

A company uses AWS CloudTrail to log all API activity. The security team wants to detect when an IAM user creates an access key for another user, which is a potential privilege escalation. Which TWO actions should the team take to set up this detection?

Accepted Answer

Create a CloudWatch alarm based on the metric filter.. Option C is correct because CloudTrail delivers API activity to a CloudWatch Logs log group, and a metric filter with a filter pattern matching the eventName "CreateAccessKey" converts those log events into a numeric CloudWatch metric that can be alarmed on. Option B is correct because a CloudWatch alarm on that metric filter's metric fires when the metric crosses the threshold, which is the standard way to detect and notify on the specific CreateAccessKey activity. Option A is not appropriate because AWS Config managed rules evaluate resource configuration compliance, not individual API calls. Option D is not correct for this two-action pair because an EventBridge rule that triggers a Lambda function is a separate single-step alternative, not one of the two actions needed in the CloudWatch Logs metric filter and alarm setup. Option E is wrong because GuardDuty custom threat lists are for IP addresses and domains, not for detecting specific IAM API calls.

Answer

Create an AWS Config managed rule to detect CreateAccessKey calls.

Answer

Use Amazon EventBridge to create a rule that matches the CloudTrail event and triggers an AWS Lambda function.

Answer

Enable Amazon GuardDuty and create a custom threat list.

Question 18

Which THREE actions should be taken when preserving forensic evidence from an EC2 instance during an incident? (Select THREE.)

Accepted Answer

Create an EBS snapshot of all volumes.. Option B is correct because creating an EBS snapshot of all attached volumes captures a point-in-time, block-level copy of the instance's disk data (including the root volume) that can later be restored and analyzed without altering the original evidence. Option D is correct because volatile memory contains artifacts such as running processes, network connections, and encryption keys that are lost on shutdown, so capturing a memory dump with a tool like LiME preserves this critical evidence. Option E is correct because modifying the security group to remove inbound/outbound rules isolates the instance from the network, preventing further compromise or data exfiltration while keeping the instance running so volatile evidence remains intact. Option A is not appropriate because rebooting destroys volatile memory and can trigger anti-forensic behavior, and Option C is not appropriate because terminating the instance destroys the ephemeral storage and volatile state and may delete the very evidence needed for investigation.

Answer

Reboot the instance to clear any malicious processes.

Answer

Terminate the instance to prevent further compromise.

Question 19

A security analyst needs to detect and alert on suspicious API calls in real time. Which combination of AWS services should be used?

Accepted Answer

AWS CloudTrail, Amazon CloudWatch Logs, and Amazon EventBridge.. AWS CloudTrail captures API calls and delivers log files to Amazon CloudWatch Logs, where you can define metric filters to detect suspicious patterns. Amazon EventBridge then consumes those filtered log events to trigger real-time alerts or automated remediation actions. This combination provides the end-to-end pipeline needed for real-time detection and alerting on API activity.

Answer

Amazon Inspector and AWS CloudTrail.

Answer

Amazon GuardDuty and AWS Lambda.

Answer

AWS Config and Amazon SNS.

Question 20

A company wants to automatically detect and notify about any S3 buckets that have public read access. Which combination of services should be used?

Accepted Answer

AWS Config and Amazon EventBridge. AWS Config continuously records S3 bucket configurations and can evaluate them against managed rules such as 's3-bucket-public-read-prohibited', flagging any bucket with public read access as non-compliant. Amazon EventBridge can then route Config's compliance change events to targets like SNS or Lambda for notification. This combination provides both detection and automated notification without custom code.

Answer

AWS CloudTrail and AWS Lambda

Answer

AWS IAM Access Analyzer and Amazon CloudWatch

Answer

AWS Trusted Advisor and Amazon SES