SCS-C02 Mock Exam 72 — 25 Questions

Question 1

A company wants to ensure that all Amazon S3 buckets are encrypted at rest. Which THREE services can be used together to automatically remediate unencrypted S3 buckets?

Accepted Answer

Amazon EventBridge. AWS Config (D) is correct because it continuously evaluates S3 bucket configuration against a managed rule such as s3-bucket-server-side-encryption-enabled and flags buckets that are not encrypted at rest. Amazon EventBridge (C) is correct because it can receive the AWS Config compliance-change event (or a Config rule evaluation result) and route it to a target for automated remediation. AWS Lambda (E) is correct because it serves as the remediation target, running code that calls PutBucketEncryption to enable default encryption on the noncompliant bucket. Amazon S3 default encryption (A) is not a remediation mechanism by itself; it only defines encryption applied to objects when the bucket setting is enabled, so it cannot detect or fix an unencrypted bucket. AWS CloudTrail (B) records API activity for auditing but does not evaluate resource compliance or trigger automatic remediation.

Answer

Amazon S3 default encryption

Answer

AWS CloudTrail

Question 2

Which TWO are valid IAM identity-based policies? (Choose 2.)

Accepted Answer

Inline policy. An inline policy (B) is a valid IAM identity-based policy because it is an embedded JSON policy document attached directly to a single IAM user, group, or role, granting or denying that identity's permissions. An AWS managed policy (E) is also a valid identity-based policy since it is a standalone, AWS-authored policy that can be attached to IAM users, groups, or roles as their permissions policy. By contrast, a trust policy (A) is a resource-based policy on an IAM role that defines which principals may assume it via sts:AssumeRole, not an identity-based permissions policy. An S3 bucket policy (C) is a resource-based policy attached to the bucket, and a service control policy (D) is an AWS Organizations guardrail that sets maximum permissions for accounts, not an identity-based policy attached to an IAM identity.

Answer

Trust policy

Answer

S3 bucket policy

Answer

Service control policy (SCP)

Question 3

Which TWO are valid methods to centrally manage multiple AWS accounts? (Choose two.)

Accepted Answer

AWS Control Tower. AWS Control Tower (D) is correct because it provides a centralized landing zone that automates the setup of a multi-account AWS environment using AWS Organizations, IAM Identity Center, and guardrails (preventive and detective controls) to govern accounts at scale. AWS Organizations (E) is correct because it is the foundational service for centrally managing multiple AWS accounts, allowing consolidated billing, organizational units (OUs), service control policies (SCPs), and centralized policy-based governance across accounts. AWS IAM (A) is not correct because it manages users, groups, roles, and permissions within a single AWS account (or via roles across accounts), not centralized multi-account governance. AWS Service Catalog (B) is not correct because it lets administrators create and manage approved IT service portfolios for end users, but it does not itself centrally manage multiple AWS accounts. Amazon Cognito (C) is not correct because it provides identity, authentication, and authorization for web and mobile applications, not multi-account AWS management.

Answer

AWS IAM

Answer

AWS Service Catalog

Answer

Amazon Cognito

Question 4

A company is implementing AWS Organizations with multiple accounts. Which THREE are benefits of using service control policies (SCPs)? (Choose three.)

Accepted Answer

Prevent users from disabling CloudTrail. Option B is correct because an SCP can deny the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions at the OU or account level, ensuring member accounts cannot disable or delete CloudTrail trails even if their IAM policies allow it. Option C is correct because SCPs let you codify and enforce organizational compliance guardrails—such as blocking use of unapproved regions or services—uniformly across all accounts in an OU. Option E is correct because SCPs are the AWS Organizations mechanism for centrally setting the maximum available permissions for principals in member accounts, restricting what IAM policies can grant. Option A is not a benefit of SCPs because SCPs only filter/limit permissions; they never grant access, so cross-account access must be established with IAM roles, resource policies, or identity federation. Option D is not a benefit of SCPs because consolidated billing is a separate AWS Organizations feature handled by the management account's payment method, not by service control policies.

Answer

Grant cross-account access

Answer

Manage consolidated billing

Question 5

A security engineer is designing a system to manage access to an S3 bucket containing confidential data. Which TWO actions should the engineer take to implement least privilege?

Accepted Answer

Use a condition in the IAM policy to restrict access to requests from a specific IP range.. Option A is correct because adding an IAM policy condition such as aws:SourceIp to restrict requests to a specific IP range narrows the circumstances under which the allowed S3 actions can be performed, which is a core least-privilege technique. Option B is correct because granting only the specific actions required (for example s3:GetObject instead of s3:*) limits permissions to exactly what the workload needs, directly implementing least privilege. Option C is wrong because allowing s3:* for all users in the organization grants far broader permissions than necessary and violates least privilege. Option D is wrong because making the bucket public exposes the confidential data and object ACLs alone are not a least-privilege access control mechanism. Option E is wrong because pre-signed URLs are a temporary delegation mechanism, not a substitute for scoping IAM permissions to the minimum required actions and conditions.

Answer

Use a policy that allows s3:* for all users in the organization.

Answer

Make the bucket public and rely on object ACLs to restrict access.

Answer

Use pre-signed URLs for all access to the bucket.

Question 6

A security engineer is designing a data protection strategy for an S3 bucket that contains sensitive documents. The bucket is accessed by multiple IAM users and roles. Which TWO actions will help protect the data at rest and in transit?

Accepted Answer

Add a bucket policy that denies requests without aws:SecureTransport. Enforcing HTTPS (aws:SecureTransport) protects data in transit by requiring all requests to use TLS. Option D is correct because enabling default encryption (SSE-S3 or SSE-KMS) ensures data at rest is automatically encrypted when written to S3. Option A is incorrect: S3 Access Logs are for auditing access, not for protecting data. Option C is incorrect: MFA Delete protects against accidental deletion, not data protection at rest or in transit. Option E is incorrect: pre-signed URLs provide time-limited access but do not inherently protect data at rest or enforce encryption in transit.

Answer

Enable S3 Access Logs and send them to a separate account

Answer

Enable MFA Delete on the S3 bucket

Answer

Use pre-signed URLs for all access

Question 7

A company stores sensitive data in an S3 bucket with default encryption (SSE-S3) enabled. A security audit reveals that objects are being accessed by users from unexpected IP addresses. The company wants to enforce that only objects encrypted with a specific KMS key (managed by the security team) can be accessed. Which combination of actions should be taken?

Accepted Answer

Modify the bucket policy to deny PutObject and GetObject unless the request includes the specific KMS key ID in the 'x-amz-server-side-encryption-aws-kms-key-id' header.. It uses a bucket policy with the 's3:x-amz-server-side-encryption-aws-kms-key-id' condition key to deny requests that do not include the specific KMS key ID in the 'x-amz-server-side-encryption-aws-kms-key-id' header. This enforces that only objects encrypted with the specified KMS key can be accessed. Option A is incorrect because SSE-C uses customer-provided keys and does not integrate with KMS key IDs; distributing a customer key does not enforce the specific KMS key. Option C is incorrect because S3 Block Public Access and AWS WAF do not control access based on encryption key. Option D is incorrect because lifecycle policies do not restrict access based on encryption key.

Answer

Use SSE-C and distribute the customer key to authorized users only.

Answer

Enable S3 Block Public Access and use AWS WAF to filter IP addresses.

Answer

Apply an S3 Lifecycle policy to transition objects to Glacier after 30 days.

Question 8

A security engineer needs to encrypt a 10 GB file before uploading it to Amazon S3. The encryption must use a customer managed key in AWS KMS, and the engineer wants to minimize the amount of data sent to KMS for encryption. Which approach should the engineer use?

Accepted Answer

Use the AWS Encryption SDK with a customer managed KMS key to encrypt the file locally, then upload the encrypted file to S3.. The AWS Encryption SDK implements envelope encryption locally, using a KMS customer managed key only to encrypt a data key. This minimizes data sent to KMS because only the small data key is transmitted. The encrypted file is then uploaded to S3. This meets the requirements for local encryption and efficient KMS usage.

Answer

Upload the file to S3 using SSE-KMS with the customer managed key, which encrypts the entire file with KMS.

Answer

Use the KMS Encrypt API directly to encrypt the entire file with the customer managed key, then upload the encrypted file to S3.

Answer

Use S3 client-side encryption with a customer provided key (SSE-C) and store the key in AWS KMS.

Question 9

A security engineer is configuring AWS KMS to encrypt data in a new Amazon S3 bucket. The company requires that the KMS key used for encryption automatically rotate its key material every year, and that the rotation be transparent to applications. The engineer creates a customer managed key with key spec SYMMETRIC_DEFAULT and key usage ENCRYPT_DECRYPT. What should the engineer do next to meet the requirement?

Accepted Answer

Enable automatic key rotation on the customer managed key.. AWS KMS customer managed symmetric keys support automatic annual rotation of the backing key material while preserving the same key ID and ARN. This allows existing applications and policies to continue using the key without modification. Enabling automatic rotation satisfies the requirement for transparent yearly rotation. Other options either require manual key replacement, use a key type that does not support rotation, or rely on an AWS managed key that cannot be configured by the customer.

Answer

Enable automatic key rotation on the AWS managed key aws/s3.

Answer

Use an asymmetric KMS key with RSA_2048 and enable automatic rotation.

Answer

Create a new customer managed key each year and update the S3 bucket policy to use the new key.

Question 10

A security engineer is designing a solution to encrypt data at rest in an Amazon DynamoDB table. The data must be encrypted with a customer managed key in AWS KMS that the security team can rotate annually. The DynamoDB table is used by an AWS Lambda function. Which approach should the engineer take to meet these requirements?

Accepted Answer

Create a customer managed KMS key, enable automatic key rotation with a one-year rotation period, and specify this key when creating the DynamoDB table.. Using a customer managed KMS key with automatic rotation set to one year gives the security team control over the key lifecycle. DynamoDB supports specifying a customer managed key at table creation. The Lambda function must have IAM permissions to use the key. This solution meets both the encryption and rotation requirements.

Answer

Enable DynamoDB encryption at rest with the default AWS owned key and configure annual rotation of that key.

Answer

Enable DynamoDB encryption at rest with an AWS managed key and manually rotate the key every year using the AWS CLI.

Answer

Use AWS CloudHSM to generate a custom encryption key and configure DynamoDB to use that key for encryption at rest.

Question 11

A company stores sensitive data in an Amazon S3 bucket. The security team wants to ensure that all objects are encrypted with SSE-KMS using a specific customer managed key, and that any attempt to upload an object without this encryption is denied. The bucket policy must enforce this. Which bucket policy statement should the security engineer use?

Accepted Answer

Two deny statements for s3:PutObject: one where StringNotEquals on s3:x-amz-server-side-encryption is 'aws:kms', and another where StringNotEquals on s3:x-amz-server-side-encryption-aws-kms-key-id is the ARN of the specific KMS key.. To enforce a specific KMS key for SSE-KMS, the bucket policy must deny uploads that either do not use SSE-KMS or do not use the specified key. Using two separate deny statements with StringNotEquals conditions on s3:x-amz-server-side-encryption and s3:x-amz-server-side-encryption-aws-kms-key-id achieves this. A single statement with AND logic would not correctly deny when only one condition is violated.

Answer

A deny statement for s3:PutObject where the condition StringNotEquals on s3:x-amz-server-side-encryption is 'aws:kms' AND StringNotEquals on s3:x-amz-server-side-encryption-aws-kms-key-id is the ARN of the specific KMS key.

Answer

A deny statement for s3:PutObject where the condition StringNotEquals on s3:x-amz-server-side-encryption-aws-kms-key-id is the ARN of the specific KMS key.

Answer

A deny statement for s3:PutObject where the condition StringNotEquals on s3:x-amz-server-side-encryption is 'aws:kms'.

Question 12

A security engineer needs to ensure that all API activity in an AWS account is logged and that the logs are retained for 10 years for compliance. The engineer enables AWS CloudTrail with a multi-Region trail and delivers logs to an Amazon S3 bucket. The engineer must prevent any user, including administrators, from deleting or altering the logs during the retention period. Which solution meets these requirements?

Accepted Answer

Enable S3 Object Lock in compliance mode on the S3 bucket with a retention period of 10 years.. S3 Object Lock in compliance mode provides immutable storage for a specified retention period, even preventing the root user from deleting objects. This is the only option that guarantees logs cannot be deleted or altered for 10 years. Other options either allow administrators to bypass protections or do not enforce retention.

Answer

Apply an S3 bucket policy that denies s3:DeleteObject and s3:PutObject for all principals except the CloudTrail service.

Answer

Configure AWS CloudTrail to use a customer-managed AWS KMS key to encrypt the logs and enable key rotation.

Answer

Enable S3 Versioning and configure a lifecycle rule to transition objects to S3 Glacier Deep Archive after 30 days.

Question 13

A security engineer is configuring AWS KMS key policies for a customer managed key used to encrypt data in multiple AWS services. The engineer needs to allow the key to be used by principals in the same account and by a specific IAM role in another account for cross-account access. Which two statements should be included in the key policy to meet these requirements? (Choose two.)

Accepted Answer

A statement that allows the account root user to have full KMS permissions, enabling IAM policies in the account to delegate access to the key.. For same-account access, the key policy must allow the account root user full KMS permissions so that IAM policies can delegate access. For cross-account access, the key policy must explicitly allow the external IAM role to use the key. The external role also needs an IAM policy allowing the KMS actions. These two statements together satisfy the requirements.

Answer

A statement that allows AWS services to use the key on behalf of the account, with a condition that the request comes from the same account.

Answer

A statement that allows all principals in the other account to use the key, with a condition that they have the appropriate IAM permissions.

Answer

A statement that denies all access to the key except for the account root user, to enforce strict control.

Question 14

A security engineer manages a VPC with a fleet of Amazon EC2 instances running behind an Application Load Balancer. The engineer needs to capture, in near real time, metadata about all IP traffic entering and leaving the network interfaces in the VPC, including source and destination IP, ports, and protocol, and then store the records in Amazon S3 for later analysis. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Enable VPC Flow Logs at the VPC level with a destination of Amazon S3 and the default format.. VPC Flow Logs are the native AWS feature for capturing IP traffic metadata for network interfaces in a VPC. Publishing directly to Amazon S3 avoids the need for agents or custom pipelines and provides the required fields in the default format. The other options either capture the wrong type of data or introduce unnecessary complexity.

Answer

Install the CloudWatch agent on each EC2 instance and configure it to collect network traffic metrics and send them to CloudWatch Logs.

Answer

Deploy a third-party network monitoring appliance on an EC2 instance and mirror all VPC traffic to it using AWS PrivateLink.

Answer

Enable AWS CloudTrail data events on the network interfaces and deliver the logs to Amazon S3.

Question 15

A security analyst needs to detect and respond to suspicious API activity in a multi-account AWS environment. The analyst wants near real-time detection of anomalous IAM behavior and the ability to automatically invoke a remediation Lambda function when a specific finding occurs. Which combination of AWS services provides this with the least operational overhead?

Accepted Answer

Amazon GuardDuty with an AWS Organizations delegated administrator, an Amazon EventBridge rule matching the finding, and the remediation Lambda function as the rule target.. GuardDuty provides managed, near real-time threat detection using CloudTrail, VPC Flow Logs, DNS logs, and threat intelligence, and it integrates with Organizations through a delegated administrator so all accounts are covered centrally. EventBridge receives GuardDuty findings as events, and a rule can target a Lambda function directly, enabling automated remediation without building custom detection logic or per-account rules.

Answer

Amazon Detective with an organization-wide graph, Amazon EventBridge rules for each account, and AWS Systems Manager Automation documents to run remediation.

Answer

AWS Security Hub with custom insights, Amazon CloudWatch Logs metric filters on CloudTrail, and a CloudWatch alarm that invokes the remediation Lambda function.

Answer

AWS CloudTrail with an organization trail, Amazon Athena queries scheduled by AWS Glue, and an Amazon SNS topic that invokes the remediation Lambda function.

Question 16

A security engineer needs to ensure that all data stored in a new Amazon DynamoDB table is encrypted at rest using a key that the company can manage, audit, and rotate. The company also wants to receive alerts if the key is used in an unauthorized way. Which solution meets these requirements with the LEAST operational effort?

Accepted Answer

Use AWS KMS customer managed keys with DynamoDB encryption at rest.. AWS KMS customer managed keys with DynamoDB encryption at rest provide customer control, auditability through CloudTrail, and automatic rotation with minimal effort. AWS owned keys lack customer control and auditing. Client-side encryption with Secrets Manager or CloudHSM introduces extra operational burden and does not integrate natively with DynamoDB encryption at rest.

Answer

Use AWS CloudHSM to generate and store keys, and integrate with DynamoDB encryption.

Answer

Enable DynamoDB encryption at rest with AWS owned keys.

Answer

Implement client-side encryption using a key stored in AWS Secrets Manager.

Question 17

A security engineer manages a fleet of Amazon EC2 instances in a VPC. The instances must be able to reach the internet for software updates, but they must not be directly reachable from the internet. The VPC has a private subnet with a route to a NAT gateway in a public subnet. The engineer notices that instances in the private subnet cannot reach the internet, and the NAT gateway's CloudWatch metrics show zero active connections. Which of the following is the MOST likely cause?

Accepted Answer

The private subnet's route table does not have a route to the NAT gateway.. The NAT gateway's zero active connections indicate that traffic from the private instances is not reaching it. The most common reason is a missing or incorrect route in the private subnet's route table directing internet-bound traffic to the NAT gateway. Without that route, instances have no path to the NAT gateway, so they cannot access the internet.

Answer

The security group on the instances does not allow outbound traffic to the NAT gateway.

Answer

The NAT gateway is not associated with an Elastic IP address.

Answer

The network ACL on the private subnet is blocking outbound traffic to the NAT gateway.

Question 18

A security engineer is building an incident response playbook for compromised IAM credentials. The engineer wants to automatically revoke access and preserve evidence when an access key is suspected of being compromised. Which TWO actions should be included in the playbook? (Choose two.)

Accepted Answer

Deactivate the access key and attach an explicit deny policy to the IAM user to prevent any further API calls.. A credential compromise playbook must both revoke access and preserve evidence. Deactivating the key and attaching an explicit deny policy stops further API calls immediately while keeping the identity intact for analysis. Capturing the user's policies, key metadata, and recent CloudTrail events before changes preserves the activity history needed to determine impact and support notifications. Deleting the user, rotating the key, or disabling logging would destroy evidence or fail to revoke access effectively.

Answer

Rotate the access key by creating a new key and attaching it to the same IAM user, then delete the old key.

Answer

Delete the IAM user and all associated access keys to ensure the compromised identity cannot be used again.

Answer

Disable AWS CloudTrail logging to prevent the attacker from observing the security team's remediation actions.

Question 19

A security engineer needs to allow an application running on an Amazon EC2 instance to access an Amazon S3 bucket. The application must not use long-term credentials. The engineer has created an IAM role with the necessary permissions and attached it to the instance profile. However, the application is still receiving access denied errors. Upon investigation, the engineer finds that the application is using the AWS SDK for Java and is explicitly setting credentials via environment variables. What is the MOST likely cause of the access denied errors?

Accepted Answer

The environment variables contain credentials that are expired or lack the necessary permissions.. The AWS SDK credential provider chain checks environment variables before instance profile credentials. If the application sets AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY, those credentials are used exclusively. If they are expired or lack permissions, access is denied. The solution is to remove the environment variables so the SDK uses the instance profile's temporary credentials.

Answer

The IAM role's trust policy does not allow the EC2 service to assume the role.

Answer

The S3 bucket policy denies access to the IAM role associated with the instance profile.

Answer

The EC2 instance metadata service is disabled, preventing the SDK from retrieving temporary credentials.

Question 20

A security engineer is reviewing AWS CloudTrail logs and notices a large number of DeleteBucket API calls from an unfamiliar IAM role. The engineer wants to automatically notify the security team when similar suspicious API activity occurs in the future. The notification must be sent within minutes and should include details such as the IAM role and the bucket name. Which solution should the engineer implement?

Accepted Answer

Create an Amazon EventBridge rule that matches AWS API calls via CloudTrail, filter for the DeleteBucket event, and route the event to an Amazon SNS topic that notifies the security team.. EventBridge can match CloudTrail management events and filter for specific API calls like DeleteBucket. Routing the event to SNS provides near real-time notification with the full event details, including the IAM role and bucket name. This is the most direct and low-latency solution for the requirement.

Answer

Enable CloudTrail Insights and configure an Amazon CloudWatch alarm on the Insights metric to send notifications via Amazon SNS.

Answer

Use Amazon GuardDuty to monitor for S3 bucket deletion activity and configure GuardDuty findings to send notifications via Amazon SNS.

Answer

Configure AWS Config to record configuration changes for S3 buckets and use an AWS Config rule to trigger an Amazon SNS notification when a bucket is deleted.