SCS-C02 Mock Exam 71 — 25 Questions

Question 1

A company uses AWS Shield Advanced to protect its web application against DDoS attacks. The application is behind an Application Load Balancer (ALB) with a web application firewall (AWS WAF) in front. The security team notices that some requests are being blocked by AWS WAF, but the source IP addresses are legitimate customers. What step should the team take to minimize false positives?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement rate-based rules with a count action and use the count data to create custom rules.. Rate-based rules with a count action allow the team to monitor request patterns without blocking legitimate traffic. The count action logs matching requests, enabling analysis to create custom rules that accurately distinguish between malicious and legitimate traffic. This approach minimizes false positives by basing rule logic on observed data rather than static thresholds.

Answer

Switch to using AWS Managed Rules for IP reputation lists.

Answer

Increase the WAF rate-based rule threshold to allow more requests.

Answer

Reconfigure the ALB idle timeout to a higher value.

Question 2

What is the purpose of an AWS Service Control Policy (SCP) in AWS Organizations?

Accepted Answer

To set permission guardrails that restrict what actions accounts in the organization can perform.. SCPs are used to centrally control the maximum available permissions for all accounts in an organization. Option A is wrong because SCPs do not grant permissions; they restrict them. Option B is wrong because SCPs apply to all users and roles, not just root. Option C is wrong because SCPs are not for monitoring; they are permission guardrails.

Answer

To grant specific permissions to users in member accounts.

Answer

To restrict only the root user of each member account.

Answer

To monitor and log API activity across the organization.

Question 3

A security engineer notices that an IAM role used by an EC2 instance is generating a large number of API calls to an S3 bucket that is not part of the company's account. Which AWS service should be used to detect and alert on this suspicious activity?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is the correct service because it uses machine learning and anomaly detection to analyze AWS CloudTrail management and data events, VPC Flow Logs, and DNS logs. It can detect unusual API calls, such as an EC2 instance role making a high volume of requests to an S3 bucket outside the company's account, which is a classic indicator of compromised credentials or data exfiltration. GuardDuty generates findings and can integrate with Amazon CloudWatch Events to trigger alerts or automated remediation.

Answer

AWS CloudTrail

Answer

Amazon Inspector

Answer

AWS Config

Question 4

Which TWO actions are valid ways to enforce the principle of least privilege in an AWS environment?

Accepted Answer

Grant only the necessary actions in IAM policies. Option C is correct because least privilege means granting identities only the specific IAM actions and resources they actually need, so scoping IAM policy statements to the minimum required actions directly enforces that principle. Option D is correct because AWS Organizations Service Control Policies (SCPs) set a permissions boundary that can explicitly deny actions not required across accounts or OUs, preventing even otherwise-allowed IAM permissions from being used. Option A is wrong because using the root user for daily administration violates least privilege, as root has unrestricted access and should be reserved for a few account-level tasks. Option B is wrong because an S3 bucket policy allowing all IAM users grants broad access rather than the minimum necessary. Option E is wrong because attaching AdministratorAccess to all users gives full administrative permissions, the opposite of least privilege.

Answer

Use the root user for daily administration

Answer

Use S3 bucket policies to allow all IAM users

Answer

Assign the AdministratorAccess managed policy to all users

Question 5

A company needs to protect data at rest in Amazon S3. Which THREE server-side encryption mechanisms can be used to encrypt objects stored in S3?

Accepted Answer

Server-Side Encryption with S3-Managed Keys (SSE-S3). The question asks for server-side encryption mechanisms for S3 objects, and three options qualify. Option A, SSE-S3, is correct because Amazon S3 manages the encryption keys and applies AES-256 encryption to objects at rest, requiring only the x-amz-server-side-encryption: AES256 header. Option B, SSE-KMS, is correct because it uses AWS KMS customer master keys (CMKs) to generate and manage data keys, providing auditability via CloudTrail and granular key policies. Option E, SSE-C, is correct because the customer supplies their own encryption key with each request, and S3 performs the encryption/decryption server-side without storing the key. Option C, Client-Side Encryption, is not a server-side mechanism since data is encrypted before it reaches S3. Option D, SSE-IAM, does not exist as an S3 encryption option; IAM manages permissions, not encryption keys.

Answer

Client-Side Encryption

Answer

Server-Side Encryption with IAM-Managed Keys (SSE-IAM)

Question 6

A company wants to grant an IAM user the ability to manage (create and update) their own access keys. Which TWO IAM actions must be allowed in the policy?

Accepted Answer

iam:UpdateAccessKey. The scenario requires the IAM user to manage their own access keys, specifically to create and update them. Option B, iam:CreateAccessKey, is correct because it is the exact IAM action that permits a user to create a new access key for themselves. Option A, iam:UpdateAccessKey, is correct because it allows the user to change the status of an existing access key, such as activating or deactivating it, which falls under managing access keys. Option C, iam:GetAccessKeyLastUsed, is not required because it only retrieves metadata about when an access key was last used, not manage it. Option D, iam:DeleteAccessKey, is not required because the scenario specifies create and update, not delete. Option E, iam:ListAccessKeys, is not required because it only lists access keys and does not grant management capabilities.

Answer

iam:GetAccessKeyLastUsed

Answer

iam:DeleteAccessKey

Answer

iam:ListAccessKeys

Question 7

A company wants to protect sensitive data stored in S3 from being accessed by unauthorized users. Which TWO actions should be taken? (Choose two.)

Accepted Answer

Use IAM policies to restrict access to the bucket.. Option A is correct because IAM policies define which principals (users, roles, groups) can perform which S3 actions (such as s3:GetObject or s3:PutObject) on specific bucket or object ARNs, directly controlling authorized access to sensitive data. Option D is correct because enabling S3 Block Public Access at the account level applies account-wide safeguards that reject bucket policies or ACLs granting public access, preventing accidental exposure of sensitive objects to anonymous users. Option B is not correct because S3 Versioning only preserves multiple object versions for recovery and does not by itself prevent unauthorized access. Option C is not correct because default encryption protects data at rest but does not stop an authorized-but-malicious or improperly permissioned principal from reading the data. Option E is not correct because MFA Delete only requires multi-factor authentication for permanently deleting object versions or changing versioning state, which is a deletion control rather than an access control.

Answer

Enable S3 Versioning.

Answer

Enable default encryption on all S3 buckets.

Answer

Enable MFA Delete on the bucket.

Question 8

A company is designing a data protection strategy for Amazon EFS file systems. The security team requires encryption at rest and in transit. Additionally, the team needs to control which KMS keys can be used to encrypt the file system. Which THREE steps should the team take?

Accepted Answer

Configure a KMS key policy that allows the EFS service to use the key.. Option A is correct because the KMS key policy must explicitly grant the EFS service principal (elasticfilesystem.amazonaws.com) permission to use the customer-managed key for cryptographic operations; without this, EFS cannot use the key to encrypt or decrypt file data. Option B is correct because encryption at rest on EFS is enabled at file-system creation time by specifying a customer-managed KMS key, which is exactly how the team controls which key protects the file system. Option E is correct because EFS encryption in transit is achieved by mounting with the TLS option via the EFS mount helper (for example, using -o tls with amazon-efs-utils), which enforces TLS 1.2 for NFS traffic. Option C is wrong because EFS does not support SSE-S3; that is an Amazon S3 server-side encryption option, and EFS uses KMS keys instead. Option D is wrong because an IAM policy restricting who can create encrypted file systems does not itself enable encryption at rest or in transit, nor does it control which KMS keys are used for a given file system.

Answer

Enable default encryption on the EFS file system using SSE-S3.

Answer

Use an IAM policy to restrict which users can create encrypted file systems.

Question 9

A company is designing a data protection strategy for its Amazon S3 buckets. Which TWO actions can help protect data from accidental deletion or overwrite?

Accepted Answer

Enable MFA Delete on the bucket.. Option A (Enable MFA Delete on the bucket) is correct because MFA Delete requires multi-factor authentication to permanently delete an object version or to suspend or re-enable versioning, adding a strong safeguard against accidental or malicious deletion. Option D (Enable versioning on the bucket) is correct because versioning keeps multiple variants of an object in the same bucket, so an overwrite creates a new version and a delete only adds a delete marker, allowing the prior version to be restored. Together, versioning preserves prior object states and MFA Delete protects those versions from being permanently removed. Option B (Cross-Region Replication) is not correct here because it copies objects to another bucket for durability and compliance, but it does not by itself prevent deletion or overwrite in the source bucket. Option C (default encryption) protects data confidentiality at rest but does not stop deletion or overwrite. Option E (a lifecycle policy to expire objects) actually deletes objects, which is the opposite of protecting against accidental deletion.

Answer

Enable Cross-Region Replication.

Answer

Enable default encryption.

Answer

Set a lifecycle policy to expire objects.

Question 10

Which TWO of the following are valid methods to enforce encryption at rest for an Amazon RDS for PostgreSQL DB instance? (Choose 2.)

Accepted Answer

Restore a DB instance from an encrypted snapshot. Option B is correct because restoring from an encrypted snapshot is a supported way to obtain an encrypted DB instance: you can encrypt a snapshot copy (or use an already encrypted snapshot) and restore it, producing a DB instance with encryption at rest enabled via KMS. Option E is correct because encryption at rest for Amazon RDS for PostgreSQL must be specified at creation time; when you create a new DB instance you can enable encryption, and the underlying storage, automated backups, read replicas, and snapshots are then encrypted with the selected AWS KMS key. Option A is not valid because you cannot enable encryption on an existing unencrypted RDS DB instance in place; you must create an encrypted copy/restore. Option C is not valid because you cannot take a snapshot of an unencrypted instance and simply 'enable encryption on the snapshot' in place; you must copy the snapshot with encryption enabled. Option D is not valid because an encrypted read replica cannot be created from an unencrypted source instance, so this method cannot enforce encryption at rest for the original unencrypted DB instance.

Answer

Enable encryption on an existing unencrypted DB instance

Answer

Take a snapshot of the unencrypted instance and enable encryption on the snapshot

Answer

Create an encrypted read replica and promote it

Question 11

Which THREE are benefits of using AWS CloudTrail for security governance? (Choose three.)

Accepted Answer

Supports compliance audits by providing event history. Option C is correct because CloudTrail retains a searchable history of management and data events that auditors can use to demonstrate who did what and when, satisfying compliance audit requirements. Option D is correct because CloudTrail's core function is to record AWS API activity (management events, and optionally data and insight events) in the account and deliver them as log files to Amazon S3 and/or CloudWatch Logs. Option E is correct because those API activity records include the identity (IAM user, role, federated user) and source IP, enabling security teams to analyze user behavior and detect anomalous or unauthorized actions. Option A is not correct as stated because CloudTrail itself does not perform real-time log analysis; it can deliver events to CloudWatch Logs, but the analysis is done by CloudWatch Logs metric filters/alarms, not by CloudTrail. Option B is not correct because CloudTrail is an auditing and logging service and does not automatically remediate noncompliant resources; remediation requires services such as AWS Config rules with remediation actions or Lambda-based automation.

Answer

Enables real-time log analysis with Amazon CloudWatch Logs

Answer

Automatically remediates noncompliant resources

Question 12

Which TWO of the following are valid ways to enforce encryption at rest for data in Amazon S3? (Choose TWO.)

Accepted Answer

Use SSE-KMS. SSE-KMS (option D) is correct because it enforces server-side encryption at rest by having Amazon S3 encrypt objects with keys managed in AWS KMS, providing envelope encryption and auditability via CloudTrail. SSE-C (option E) is also correct because it enforces server-side encryption at rest using a customer-provided encryption key that S3 applies to the object, so data is stored encrypted on disk. Option A (SSL/TLS) is incorrect because it only protects data in transit between the client and S3, not data at rest. Option B (IAM policies) is incorrect because IAM controls authorization and permissions, not the encryption of stored objects. Option C (CloudTrail) is incorrect because it records API activity for auditing, not encryption of data at rest.

Answer

Use SSL/TLS

Answer

Use IAM policies

Answer

Use AWS CloudTrail

Question 13

Which TWO actions are best practices for securing an AWS account root user? (Select TWO.)

Accepted Answer

Create an IAM user with administrative privileges and use it instead of the root user.. Option D is correct because AWS best practice is to create an IAM user (or federated identity) with the required administrative permissions and use that identity for day-to-day administration, reserving the root user only for the few tasks that specifically require it, such as changing the account name, closing the account, or changing the support plan. Option E is correct because enabling multi-factor authentication (MFA) on the root user adds a second authentication factor, so a compromised root password alone is insufficient to sign in; AWS strongly recommends a hardware MFA device for the root user. Option A is wrong because using the root user for everyday administrative tasks violates least privilege and greatly increases the blast radius if those credentials are compromised. Option B is wrong because AWS advises against creating access keys for the root user; if root access keys already exist, they should be deleted, since long-lived root keys are a major security risk. Option C is wrong because the root user cannot be deleted; it is permanently tied to the account and can only be secured by protecting its credentials and limiting its use.

Answer

Use the root user for everyday administrative tasks.

Answer

Create access keys for the root user.

Answer

Delete the root user to prevent unauthorized access.

Question 14

Which TWO AWS services can be used to detect and alert on unauthorized API calls in real time?

Accepted Answer

Amazon CloudWatch Alarms. Amazon CloudWatch Alarms (A) is correct because you can create metric filters on CloudTrail log groups that match unauthorized API calls (e.g., AccessDenied or specific error codes), and the alarm triggers an SNS notification in near real time. Amazon EventBridge (C) is correct because it can receive CloudTrail management events, match patterns for unauthorized API activity (such as errorCode values), and route them to targets like SNS, Lambda, or SQS for immediate alerting. AWS KMS (B) is a key management service, not an API-call detection or alerting service. AWS IAM (D) controls authentication and authorization but does not itself detect or alert on unauthorized calls. AWS Config (E) evaluates resource configuration compliance and records configuration changes, not real-time API-call alerting.

Answer

AWS KMS

Answer

AWS IAM

Answer

AWS Config

Question 15

Which TWO services can be used to manage identity and access across multiple AWS accounts? (Choose TWO.)

Accepted Answer

AWS Organizations. AWS Organizations (B) is correct because it centrally manages multiple AWS accounts under a single organization, enabling consolidated billing and centralized policy-based governance through Service Control Policies (SCPs) that control access across all member accounts. AWS Single Sign-On (C) is correct because it provides centralized identity and access management across multiple AWS accounts, letting users sign in once with their existing corporate credentials and access assigned accounts and roles via permission sets. Amazon Cognito (A) is incorrect because it is a customer-facing identity service for web and mobile applications (user pools and identity pools), not for managing access across AWS accounts. AWS Config (D) is incorrect because it is a configuration compliance and auditing service that records resource changes, not an identity and access management service. AWS CloudTrail (E) is incorrect because it logs API activity and account events for auditing, not identity or access management.

Answer

Amazon Cognito

Answer

AWS Config

Answer

AWS CloudTrail

Question 16

Which THREE of the following are characteristics of IAM roles? (Choose 3.)

Accepted Answer

Roles can be assumed by IAM users in another AWS account.. Option C is correct because IAM roles are designed for cross-account access: a role in Account A can have a trust policy granting the principal in Account B permission to call sts:AssumeRole, so users in another AWS account can assume it. Option D is correct because every IAM role has a trust policy (the AssumeRolePolicyDocument) that defines which principals (users, accounts, services, federated identities) are allowed to assume the role. Option E is correct because an instance profile delivers a role's temporary credentials to an EC2 instance, letting applications on that instance call AWS APIs with the role's permissions without embedding long-term keys. Option A is wrong because roles do not have long-term credentials like access keys; they issue temporary credentials via AWS STS. Option B is wrong because assuming a role uses the sts:AssumeRole API and the trust policy, not a password.

Answer

Roles have long-term credentials like access keys.

Answer

Roles require a password for assumption.

Question 17

A company wants to use AWS CloudTrail to log all API calls in an AWS account. The security engineer needs to ensure that the logs are encrypted at rest and are accessible only to authorized personnel. Which THREE steps should the engineer take? (Choose THREE.)

Accepted Answer

Enable server-side encryption on the S3 bucket that stores CloudTrail logs.. Option B is correct because enabling server-side encryption (SSE-S3, SSE-KMS, or SSE-C) on the S3 bucket that stores CloudTrail logs ensures the log objects are encrypted at rest, satisfying the encryption requirement. Option D is correct because an IAM policy scoped to specific users or roles enforces least-privilege access, ensuring only authorized personnel can read the CloudTrail log objects. Option E is correct because a bucket policy condition requiring aws:SecureTransport=true denies any non-TLS (HTTP) requests, protecting logs in transit and preventing unencrypted access. Option A does not belong because MFA delete protects against accidental or malicious deletion of objects but does not provide encryption at rest or restrict read access to authorized personnel. Option C does not belong because an SCP attached to the root account only sets permission guardrails for accounts in an organization and does not encrypt CloudTrail logs or grant/restrict access to the specific S3 bucket.

Answer

Enable MFA delete on the S3 bucket.

Answer

Attach a service control policy (SCP) to the root account.

Question 18

Which TWO of the following are best practices for managing IAM user credentials? (Choose TWO.)

Accepted Answer

Enable MFA for all IAM users.. Option C is correct because enabling multi-factor authentication (MFA) for all IAM users adds a second authentication factor beyond the password, significantly reducing the risk of credential compromise if a password is leaked or guessed. Option D is correct because regularly rotating access keys limits the window of exposure if a key is compromised and aligns with AWS security best practices for credential lifecycle management. Option A is incorrect because sharing a single IAM user across multiple developers eliminates individual accountability and makes it impossible to audit or revoke access per person; each developer should have a unique IAM user or federated identity. Option B is incorrect because storing access keys in source code repositories exposes them to anyone with repository access and is a common cause of credential leakage; secrets should be stored in AWS Secrets Manager or similar. Option E is incorrect because relying on long-term access keys for all users increases risk; temporary credentials via IAM roles or AWS STS are preferred where possible.

Answer

Create a single IAM user for multiple developers.

Answer

Store access keys in source code repositories for convenience.

Answer

Use long-term access keys for all users.

Question 19

A company is using AWS Organizations and wants to restrict the use of specific AWS services in member accounts. Which TWO approaches can be used to enforce these restrictions? (Choose TWO.)

Accepted Answer

Apply a service control policy (SCP) to the organizational unit (OU).. Option C is correct because service control policies (SCPs) in AWS Organizations define the maximum available permissions for accounts in an OU, and an SCP that denies access to specific AWS services will block those services for all principals in the affected member accounts (except the management account). Option D is correct because IAM policies attached to users, groups, or roles in each member account can include explicit Deny statements for the actions of the services to be restricted, thereby enforcing the restriction at the identity level within that account. Option A is not correct because Service Quotas only cap the quantity of resources or API rates per service; they do not block the use of a service. Option B is not correct because AWS CloudTrail only records API activity for auditing and does not enforce any restriction. Option E is not correct because AWS Config rules evaluate and report on resource compliance; they detect and can trigger remediation, but they do not themselves prevent or terminate service usage as an enforcement mechanism.

Answer

Use Service Quotas to limit the number of resources per service.

Answer

Enable AWS CloudTrail to log service usage.

Answer

Use AWS Config rules to automatically terminate resources.

Question 20

Which THREE AWS services can be used to centrally manage and audit permissions across multiple accounts in AWS Organizations?

Accepted Answer

AWS IAM Access Analyzer. AWS IAM Access Analyzer (C) is correct because it continuously analyzes resource policies across accounts in AWS Organizations to identify resources shared with external entities, helping centrally manage and audit permissions. AWS CloudTrail (D) is correct because it records API activity across all accounts in an organization into a centralized trail, enabling auditing of who did what and when for permission-related changes. AWS Config (E) is correct because it continuously assesses and records resource configurations and policy compliance across accounts, allowing centralized auditing of permission-related configuration drift. Amazon Inspector (A) is not correct because it is a vulnerability management service for EC2, Lambda, and container images, not a permissions auditing tool. AWS Shield (B) is not correct because it is a managed DDoS protection service, unrelated to centrally managing or auditing permissions.

Answer

Amazon Inspector

Answer

AWS Shield