SCS-C02 Mock Exam 73 — 25 Questions

Question 1

A security engineer is configuring a VPC flow log to detect unusual traffic patterns. The engineer notices that some traffic between two EC2 instances in the same VPC appears in the flow logs as NODATA records, and other connections appear as REJECT records. The engineer must determine what each record type indicates before building detections. Which statement correctly describes the difference?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

NODATA indicates that no traffic matched the flow log record during the aggregation interval, while REJECT indicates that traffic was present but was blocked by a security group or network ACL.. VPC flow logs emit ACCEPT, REJECT, and NODATA records. A REJECT record means packets were seen but denied, typically by a security group or network ACL, while NODATA means the aggregation interval elapsed with no matching packets captured, which is useful for confirming that a monitored flow simply never occurred.

Answer

NODATA indicates that a security group blocked the traffic, while REJECT indicates that a network ACL blocked the traffic.

Answer

NODATA indicates that traffic was rejected by an AWS WAF rule, while REJECT indicates that traffic was allowed by a security group.

Answer

NODATA indicates that the flow log was disabled for the resource, while REJECT indicates that the destination port was unreachable.

Question 2

A security team is using AWS CloudTrail and Amazon CloudWatch Logs to monitor for unauthorized API calls. They want to receive an alert when an API call is made with an access key that has been reported as compromised. They have configured CloudTrail to send logs to CloudWatch Logs. What should they do next to achieve this?

Accepted Answer

Create a CloudWatch Logs metric filter that matches the access key ID in the CloudTrail logs, and create a CloudWatch alarm that publishes to an SNS topic.. The most efficient and real-time method is to create a CloudWatch Logs metric filter that matches the compromised access key ID in the CloudTrail logs. When the filter matches, it increments a custom metric. A CloudWatch alarm on that metric can then publish to an SNS topic, alerting the team. This leverages the existing log delivery and requires no custom code.

Answer

Create an AWS Lambda function that periodically queries CloudTrail event history for the access key ID and sends an alert via Amazon SES.

Answer

Use Amazon GuardDuty to monitor for the compromised access key and configure it to send findings to an SNS topic.

Answer

Enable AWS CloudTrail Insights to automatically detect the compromised access key and send an alert.

Question 3

A security engineer is designing a solution to centrally manage security findings from multiple AWS services across an organization. The engineer needs to aggregate findings from Amazon GuardDuty, Amazon Inspector, and IAM Access Analyzer into a single view and take automated remediation actions based on severity. Which combination of AWS services should the engineer use?

Accepted Answer

AWS Security Hub with custom actions and Amazon EventBridge rules to trigger AWS Lambda for remediation.. AWS Security Hub is the central service that aggregates findings from GuardDuty, Inspector, IAM Access Analyzer, and other AWS services. By using Security Hub custom actions and EventBridge rules, you can automate remediation with Lambda based on severity, providing a single view and automated response.

Answer

AWS Trusted Advisor with Amazon EventBridge rules to trigger AWS Lambda for remediation.

Answer

Amazon CloudWatch Logs with metric filters and alarms to trigger AWS Lambda for remediation.

Answer

AWS Config with remediation actions and AWS Systems Manager Automation documents.

Question 4

A security engineer needs to monitor AWS account activity for suspicious API calls, such as disabling AWS CloudTrail or deleting an AWS Config recorder. The engineer wants to receive near-real-time alerts when such events occur. Which AWS service should the engineer use to meet these requirements?

Accepted Answer

Amazon CloudWatch Events (now Amazon EventBridge). Amazon EventBridge (formerly CloudWatch Events) can monitor AWS CloudTrail logs for specific API calls and trigger alerts in near real-time. By creating an event rule that matches events like StopLogging or DeleteConfigurationRecorder, the engineer can receive immediate notifications. This directly meets the requirement.

Answer

AWS CloudTrail Insights

Answer

Amazon GuardDuty

Answer

AWS Security Hub

Question 5

A company runs a two-tier application in a VPC. The web tier runs on EC2 instances in a public subnet behind an Application Load Balancer. The database tier runs on Amazon RDS for MySQL in two private subnets. A security engineer must harden the database tier so that only the web tier can reach the database on port 3306, and so that the database instances are not reachable from the internet under any circumstances. (Choose two.)

Accepted Answer

Configure the RDS subnet group to use only private subnets that have no route to an internet gateway.. Restricting port 3306 by referencing the web tier's security group enforces identity-based access, while keeping the database in private subnets without an internet gateway route removes any possible internet path. Together they satisfy both the least-privilege and the no-internet-exposure requirements without relying on address-based rules.

Answer

Attach an Elastic IP address to each RDS instance and restrict the security group to the web tier's public addresses.

Answer

Enable public accessibility on the RDS instances and rely on the security group to block unauthorized sources.

Answer

Create a network ACL on the private subnets that allows inbound TCP 3306 from 0.0.0.0/0 and denies all other inbound traffic.

Question 6

A security team wants to centrally manage and automatically remediate findings across 40 AWS accounts in an organization. They need a solution that aggregates security findings from GuardDuty, Inspector, and Macie into one place and can trigger automated remediation runbooks. Which combination of services BEST meets these requirements?

Accepted Answer

Enable AWS Security Hub in all accounts with the organization integration, then use Amazon EventBridge rules and AWS Systems Manager Automation runbooks for remediation.. Security Hub with organization integration ingests and normalizes findings from GuardDuty, Inspector, and Macie across all accounts, providing a single aggregation point. EventBridge rules can match Security Hub findings and invoke Systems Manager Automation runbooks for automated remediation. Trusted Advisor, Detective, and CloudTrail Lake do not aggregate these detection findings, and scheduled or S3-triggered remediation lacks native integration.

Answer

Enable Amazon Detective in all accounts and forward findings to a central S3 bucket, then use AWS Lambda functions triggered by S3 event notifications for remediation.

Answer

Enable AWS CloudTrail Lake in all accounts and create queries that detect GuardDuty, Inspector, and Macie findings, then use EventBridge Scheduler to run remediation scripts.

Answer

Enable AWS Trusted Advisor in all accounts and use AWS Config rules with automatic remediation for findings from GuardDuty, Inspector, and Macie.

Question 7

A security engineer needs to detect when an IAM access key is created for a user and then used from an unusual location. The engineer wants to receive an alert when such activity occurs. Which AWS service should be used to meet this requirement?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that analyzes CloudTrail management events, VPC Flow Logs, and DNS logs to identify malicious or anomalous activity. It can detect unusual access key usage from unexpected locations and generate findings that can be routed to alerting systems. CloudTrail, AWS Config, and Amazon Inspector do not provide this threat detection and alerting capability.

Answer

Amazon Inspector

Answer

AWS Config

Answer

AWS CloudTrail

Question 8

A company uses AWS Lambda functions that access an Amazon RDS for MySQL database. The Lambda functions are configured with environment variables containing the database credentials. A security audit reveals that the credentials are stored in plaintext in the Lambda configuration. The security team wants to remediate this by using AWS Secrets Manager to store and automatically rotate the credentials. The Lambda functions are invoked frequently, and the team wants to minimize the impact of rotation on running functions. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Store the credentials in Secrets Manager with automatic rotation enabled. Modify the Lambda functions to retrieve the secret at runtime using the Secrets Manager API and cache the secret using the AWS SDK.. AWS Secrets Manager is designed to store and rotate database credentials automatically. By modifying the Lambda function to retrieve the secret at runtime and caching it, you reduce the number of API calls while ensuring that rotated credentials are eventually used. This approach provides security with minimal operational overhead because Secrets Manager handles rotation without custom code.

Answer

Use AWS KMS to encrypt the environment variables in the Lambda configuration. Enable automatic rotation of the KMS key.

Answer

Store the credentials in Secrets Manager and pass the secret ARN as an environment variable. Configure the Lambda function to retrieve the secret on each invocation without caching.

Answer

Store the credentials in AWS Systems Manager Parameter Store as a SecureString parameter with automatic rotation. Modify the Lambda function to read the parameter at runtime.

Question 9

A security engineer is configuring AWS WAF to protect an Application Load Balancer (ALB) from SQL injection attacks. The engineer must ensure that only requests with a specific header are allowed and that SQL injection attempts are blocked. Which combination of AWS WAF components should the engineer use?

Accepted Answer

A web ACL with a rule that blocks requests missing the required header, and a rule that uses the SQL injection match condition to block malicious requests.. AWS WAF web ACLs can contain multiple rules. To enforce a required header, a rule that blocks requests missing that header is needed. To block SQL injection, the built-in SQL injection match condition is the appropriate choice. Combining these two rules in a web ACL associated with the ALB meets both requirements.

Answer

A web ACL with a rule that allows requests with the header and a rule that uses the SQL injection match condition to count malicious requests.

Answer

A web ACL with a rule that blocks requests missing the header, and a rule that uses a regex pattern set to block SQL injection attempts.

Answer

A web ACL with a rate-based rule to limit requests and a rule that uses the SQL injection match condition to block malicious requests.

Question 10

A security engineer needs to provide a detailed report of all IAM users, their access keys, and the last time each key was used, to identify unused credentials. Which AWS service or feature should the engineer use to generate this report?

Accepted Answer

IAM credential report. The IAM credential report is specifically designed to provide a comprehensive list of IAM users and their credential details, including last used information for access keys. It is generated on demand and can be downloaded as a CSV. Other services like CloudTrail, Trusted Advisor, and GuardDuty do not offer this consolidated view, making the credential report the correct choice.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail logs

Answer

AWS Trusted Advisor

Question 11

A security engineer needs to grant a third-party auditor read-only access to all resources in an AWS account for a limited time. The auditor should not be able to make any changes. Which AWS service should the engineer use to provide temporary credentials?

Accepted Answer

AWS Security Token Service (AWS STS) with AssumeRole. AWS STS AssumeRole is the correct choice because it allows the creation of temporary credentials with a defined expiration and specific permissions. The engineer can create a role with read-only policies and allow the auditor to assume it. This provides secure, time-limited access without distributing long-term credentials. Other options either provide long-term credentials or are not designed for this use case.

Answer

AWS IAM Identity Center (successor to AWS Single Sign-On)

Answer

AWS Identity and Access Management (IAM) with long-term access keys

Answer

Amazon Cognito identity pools

Question 12

Which TWO AWS services can be used to monitor network traffic for malicious activity? (Select TWO.)

Accepted Answer

AWS Network Firewall. AWS Network Firewall (A) is correct because it is a managed, stateful network firewall and intrusion prevention service that inspects VPC traffic (including VPC-to-VPC, egress, and ingress) and can alert on or block malicious activity using Suricata-compatible rules and managed threat signatures. Amazon GuardDuty (B) is correct because it continuously monitors network traffic and account activity—analyzing VPC Flow Logs, DNS logs, and CloudTrail events—to detect malicious or unauthorized behavior such as crypto-mining, port scanning, and communication with known malicious IPs. AWS Shield (C) is not the right answer because it is a managed DDoS protection service that mitigates volumetric and layer 3/4 attacks but does not provide general network traffic monitoring for malicious activity. AWS WAF (D) is not the right answer because it filters HTTP(S) requests at layer 7 against web exploits like SQL injection and XSS, not network traffic monitoring. Amazon Inspector (E) is not the right answer because it is a vulnerability management service that scans EC2 instances, container images, and Lambda functions for software vulnerabilities and unintended network exposure, rather than monitoring live network traffic.

Answer

AWS Shield

Answer

AWS WAF

Answer

Amazon Inspector

Question 13

Refer to the exhibit. An IAM policy allows running EC2 instances. A developer tries to launch a t2.micro instance but receives an 'AccessDenied' error. What is the most likely reason?

Accepted Answer

The policy does not grant permissions for other required resources such as images or security groups.. Even though the policy allows the ec2:RunInstances action on the instance resource, the RunInstances API call requires permissions for other resources such as Amazon Machine Images (AMI), security groups, and key pairs. Without explicit permissions for these resources, the API call fails with an AccessDenied error. Option B is incorrect because the condition specifies t2.micro, matching the developer's request. Option C is incorrect because the policy does not restrict by region. Option D is incorrect because there is no explicit deny; the denial is due to missing resource permissions.

Answer

The developer is trying to launch a different instance type.

Answer

The region in the policy does not match the developer's region.

Answer

The policy has an explicit deny elsewhere.

Question 14

A company needs to ensure that data in transit between an EC2 instance and an RDS database is encrypted. Which solution meets this requirement?

Accepted Answer

Enable SSL/TLS on the database connection. SSL/TLS is the appropriate solution to encrypt data in transit between the EC2 instance and the RDS database. It ensures that data is encrypted during transmission, preventing eavesdropping or tampering. Option A is incorrect because a VPN connection encrypts traffic between networks but is unnecessary for direct connectivity within the same VPC; SSL/TLS is more straightforward. Option B is incorrect because encryption at rest protects data stored on disk, not data in motion. Option D is incorrect because client-side encryption would require modifying the application to encrypt data before sending, which does not guarantee encryption of the entire communication channel.

Answer

Use a VPN connection between the VPC and the database

Answer

Enable encryption at rest on the RDS instance

Answer

Use client-side encryption on the application

Question 15

A company uses AWS Organizations and has a requirement to enforce that all EC2 instances launched in any account must have a specific tag "Environment" with value "Production". The security team wants to prevent any instance without this tag from being launched. They implement a service control policy (SCP) that denies the ec2:RunInstances action if the request does not include the required tag. However, they find that users are still able to launch instances without the tag. The SCP is attached to the root OU. The team also has an IAM policy that allows ec2:RunInstances with no conditions. What is the most likely reason the SCP is not preventing the launches?

Accepted Answer

The SCP uses ec2:ResourceTag instead of aws:RequestTag for the condition.. The SCP uses the condition key ec2:ResourceTag, which evaluates tags on the EC2 instance resource, but at the time of RunInstances, the instance does not yet exist, so the tag is not present. To enforce tagging at launch, the SCP must use the aws:RequestTag condition key, which checks tags included in the request. Therefore, the SCP fails to deny launches without the required tag.

Answer

The SCP does not apply to the root user in member accounts.

Answer

The IAM policy allows the action, which overrides the SCP deny.

Answer

The SCP is applied to the management account, not the member accounts.

Question 16

A security engineer runs the above AWS CLI command. The engineer notices that the security group has no outbound rules. What is the implication of this configuration?

Accepted Answer

The EC2 instances in this security group cannot initiate outbound connections. Security groups are stateful and, by default, allow all outbound traffic; however, if outbound rules are explicitly removed, the group has no rule permitting egress, so instances cannot initiate outbound connections. Return traffic for allowed inbound connections is still permitted due to statefulness, but new outbound-initiated flows are blocked. Thus the correct implication is that outbound connections cannot be initiated.

Answer

The EC2 instances cannot receive inbound HTTP traffic

Answer

The security group allows all outbound traffic by default

Answer

Outbound traffic is allowed because security groups are stateful

Question 17

A security engineer is designing a permissions boundary for an IAM user. Which TWO statements about permissions boundaries are correct?

Accepted Answer

The effective permissions are the intersection of the identity-based policy and the permissions boundary.. Option C is correct because AWS evaluates a permissions boundary as a filter: the effective permissions for an IAM principal are the intersection of what the identity-based policy allows and what the permissions boundary allows, so an action must be permitted by both to succeed. Option E is correct because a permissions boundary is only a maximum-permissions guardrail; it never grants access by itself, and the principal still needs an identity-based policy (or another applicable policy) that allows the action. Options A and B are wrong because permissions boundaries can be attached to IAM users and IAM roles (including service roles), but not to service-linked roles, which are managed by AWS and do not support permissions boundaries. Option D is wrong because permissions boundaries only limit identity-based permissions and cannot expand or override resource-based policies; resource-based policies are evaluated separately and can grant access independently of the boundary.

Answer

Permissions boundaries can be applied to service-linked roles.

Answer

Permissions boundaries can only be applied to IAM users, not roles.

Answer

Permissions boundaries can override resource-based policies.

Question 18

A company has a requirement that all access keys for IAM users must be rotated every 90 days. A security engineer needs to implement an automated solution to identify and disable keys that are older than 90 days. Which approach meets the requirement with the least operational overhead?

Accepted Answer

Use an AWS Config rule with auto-remediation to disable keys older than 90 days.. AWS Config can evaluate IAM access key age against a desired rule (e.g., 'iam-access-key-rotated') and trigger automatic remediation using SSM Automation documents to disable keys older than 90 days. This provides a fully automated, low-overhead solution that continuously enforces the requirement without manual intervention.

Answer

Use AWS Trusted Advisor to check key age and send notifications.

Answer

Use AWS CloudTrail to monitor CreateAccessKey events and trigger a Lambda function to check key age.

Answer

Use IAM Access Analyzer to generate findings for unused keys and manually disable them.

Question 19

A security engineer is designing a network architecture in AWS. The engineer needs to ensure that all outbound traffic from a VPC goes through a centrally managed NAT device for logging and filtering. The VPC has multiple private subnets. Which TWO steps are required to accomplish this? (Choose TWO.)

Accepted Answer

Create a route table for the private subnets with a default route (0.0.0.0/0) pointing to the NAT device.. Option B is correct because the private subnets' route table must have a default route (0.0.0.0/0) whose target is the central NAT device (e.g., a NAT instance or NAT Gateway), which forces all outbound traffic to be sent to that device for logging and filtering instead of going directly to an internet gateway. Option E is correct because the NAT device itself must reside in a public subnet and have a route to an internet gateway so it can forward the private subnets' traffic to the internet while performing the required logging and filtering. Option A is not required because an HTTP forward proxy is an application-layer solution and is not the mechanism that routes VPC subnet traffic to a NAT device; the question asks for the routing/placement steps. Option C is unnecessary because a transit gateway is used to interconnect VPCs or on-premises networks, not to route a single VPC's outbound traffic through a NAT device. Option D is incorrect because a gateway endpoint for Amazon S3 only provides private access to S3 and does not handle general outbound internet traffic through a NAT device.

Answer

Deploy an HTTP forward proxy in the public subnet.

Answer

Set up a transit gateway and attach the VPC to it.

Answer

Create a gateway endpoint for Amazon S3.

Question 20

A developer needs to grant an EC2 instance read-only access to an S3 bucket. Which of the following is the most secure way to provide these permissions?

Accepted Answer

Create an IAM role with read-only access and attach it to the EC2 instance profile.. Using an IAM role attached to an instance profile grants temporary credentials and eliminates long-term access keys. Option A is incorrect because storing credentials in Parameter Store (or any static storage) is less secure than using an instance profile, and IAM roles do not have static credentials to store. Option C is incorrect because a bucket policy cannot grant access based on an instance's public IP in a secure or reliable way, and it would grant access to anyone with that IP, not just the instance. Option D is incorrect because storing IAM user access keys in user data exposes long-term credentials, which is less secure than using an instance profile.

Answer

Use an IAM role and store the credentials in AWS Systems Manager Parameter Store, then retrieve them at instance launch.

Answer

Create a bucket policy that grants read-only access to the instance's public IP address.

Answer

Create an IAM user with read-only access and store the access keys in the instance's user data.