SCS-C02 Mock Exam 74 — 25 Questions

Question 1

A company needs to audit all changes to IAM policies in their AWS account. Which AWS service should they use to record these changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity in an AWS account, including all changes to IAM policies (CreatePolicy, PutRolePolicy, AttachRolePolicy, etc.). CloudTrail captures the identity of the caller, the time, the source IP, and the request parameters, making it the authoritative service for auditing IAM policy changes. It is enabled by default for management events and can be configured for multi-region and organization-wide trails.

Answer

Amazon S3

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Question 2

A security engineer is investigating a potential data exfiltration incident. The engineer notices that an EC2 instance with an attached IAM role has been making API calls to an S3 bucket in another AWS account. The engineer wants to identify the source of the API calls and determine if the calls are malicious. Which AWS service should the engineer use to view the API calls made by the IAM role?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made by IAM roles, including the source IP address, user agent, and the specific actions performed. In this scenario, CloudTrail logs will show the exact API calls made by the EC2 instance's IAM role to the S3 bucket in another account, enabling the security engineer to identify the source and determine if the calls are malicious.

Answer

VPC Flow Logs

Answer

Amazon GuardDuty

Answer

AWS Config

Question 3

A company uses Amazon GuardDuty for threat detection. The security team wants to automatically isolate an EC2 instance that is communicating with a known malicious IP address. Which combination of services should be used?

Accepted Answer

GuardDuty -> EventBridge -> Lambda -> modify security group. Amazon GuardDuty generates findings that can be sent to Amazon EventBridge as events. EventBridge can then trigger an AWS Lambda function that modifies the security group associated with the EC2 instance to deny traffic to/from the malicious IP address. This architecture provides a serverless, event-driven response mechanism without polling or additional services.

Answer

GuardDuty -> AWS Config -> Lambda -> modify security group

Answer

GuardDuty -> CloudWatch Alarm -> Lambda -> modify security group

Answer

GuardDuty -> AWS Shield -> modify security group

Answer

GuardDuty -> AWS Systems Manager -> modify security group

Question 4

A security engineer needs to protect data in transit between an EC2 instance and an RDS database. The RDS database uses SSL/TLS certificates. What is the MOST secure way to ensure that the connection is encrypted?

Accepted Answer

Download the RDS CA certificate to the EC2 instance and configure the database client to use SSL and verify the certificate.. It ensures both encryption and server authentication. Downloading the RDS CA certificate (the trusted root for the RDS instance's server certificate) and configuring the client to verify it prevents man-in-the-middle attacks by confirming the RDS endpoint's identity. Simply enabling SSL without verification (as in other options) leaves the connection vulnerable to spoofing, so this is the most secure approach.

Answer

Configure the EC2 instance to use a self-signed certificate for SSL connections.

Answer

Enable encryption at rest on the RDS instance to automatically encrypt in-transit traffic.

Answer

Create an IAM policy that requires SSL connections to the RDS endpoint.

Question 5

A security engineer discovers that an IAM user has a policy that allows them to delete any S3 bucket in the account. The engineer wants to audit all delete actions performed by this user. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity in an AWS account, including S3 DeleteBucket and DeleteObject calls, capturing the identity of the caller, source IP, timestamp, and request parameters. To audit all delete actions performed by a specific IAM user, the engineer enables CloudTrail (ideally an organization trail or a trail with S3 log delivery) and filters events by the user's ARN and event names. CloudTrail is the authoritative audit log for AWS API actions.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 6

A security engineer needs to monitor for suspicious API calls in near real-time and trigger an automated response. Which AWS service should be used to capture and analyze these API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it captures all API calls made to the AWS environment, including those from the AWS Management Console, SDKs, CLI, and AWS services. By enabling CloudTrail Insights or using CloudWatch Events with CloudTrail logs, you can monitor for suspicious API calls in near real-time and trigger automated responses via Lambda functions or SNS notifications.

Answer

AWS CloudHSM

Answer

Amazon GuardDuty

Answer

AWS Config

Question 7

A company uses AWS Organizations with SCPs to restrict services. An administrator creates an SCP that denies access to EC2. A developer in a member account tries to launch an EC2 instance but fails. What is the most likely reason?

Accepted Answer

The SCP from the organization denies EC2. Service Control Policies (SCPs) in AWS Organizations act as a centralized governance mechanism that applies a deny effect across all IAM principals in member accounts. When an SCP explicitly denies access to EC2, it overrides any allow permissions at the account level, including those granted by IAM policies. The developer's launch attempt fails because the SCP's deny is evaluated before any account-level permissions, effectively blocking the action regardless of the developer's IAM role or user permissions.

Answer

The root user of the account has denied EC2

Answer

The developer's IAM permissions boundary blocks EC2

Answer

The EC2 instance has a resource-based policy denying access

Question 8

A company wants to monitor failed SSH login attempts to its EC2 instances. Which AWS service should be used to collect and analyze these logs?

Accepted Answer

Amazon CloudWatch Logs with the unified CloudWatch agent. Amazon CloudWatch Logs with the unified CloudWatch agent is the correct choice because the agent can be configured to collect and forward system log files, such as /var/log/secure (Amazon Linux) or /var/log/auth.log (Ubuntu), which record SSH authentication attempts including failures. This allows centralized monitoring and analysis of failed SSH logins via CloudWatch Logs Insights or metric filters.

Answer

VPC Flow Logs

Answer

AWS CloudTrail

Answer

AWS Config

Question 9

A company has a requirement to retain CloudTrail logs for 7 years for compliance. The logs are stored in an S3 bucket. The security team needs to ensure that logs are not deleted before the retention period ends, even by users with full S3 permissions. Which action should be taken?

Accepted Answer

Enable S3 Object Lock in Compliance mode on the bucket with a retention period of 7 years.. S3 Object Lock in Compliance mode prevents any user, including the root user, from overwriting or deleting objects until the retention period expires. This meets the requirement to retain CloudTrail logs for 7 years, even against users with full S3 permissions, because Compliance mode cannot be bypassed or removed by any user.

Answer

Enable MFA Delete on the bucket and require MFA for all delete operations.

Answer

Enable S3 Versioning and set a lifecycle policy to expire noncurrent versions after 7 years.

Answer

Create a bucket policy that denies s3:DeleteObject for all users.

Question 10

A security engineer is designing a web application that will run on EC2 instances behind an Application Load Balancer (ALB). The application must be protected from common web exploits like SQL injection and cross-site scripting. Which AWS service should be used to provide this protection?

Accepted Answer

AWS WAF. AWS WAF is a Layer 7 web application firewall that inspects HTTP/HTTPS requests and can block common exploits like SQL injection and cross-site scripting using managed rule groups (e.g., AWSManagedRulesCommonRuleSet, SQLiRuleSet, XSSRuleSet). It integrates natively with ALB, CloudFront, and API Gateway, making it the correct choice for protecting an ALB-fronted web app.

Answer

Network ACLs

Answer

Security Groups

Answer

AWS Shield Advanced

Question 11

A security engineer needs to ensure that all Amazon EBS volumes attached to EC2 instances in a production account are encrypted at rest. The engineer wants to enforce this requirement automatically and prevent the creation of unencrypted volumes. Which action should the engineer take?

Accepted Answer

Enable EBS encryption by default in the AWS Region.. Enabling EBS encryption by default in the Region ensures that all new EBS volumes are automatically encrypted at rest. This is a simple, effective way to enforce encryption and prevent the creation of unencrypted volumes. It applies to all new volumes regardless of how they are created, providing a robust control.

Answer

Attach a bucket policy to the EBS service that requires encryption.

Answer

Create an IAM policy that denies the ec2:CreateVolume action unless the encrypted parameter is true.

Answer

Use AWS Config to monitor for unencrypted volumes and automatically delete them.

Question 12

A company has a VPC with a CIDR block of 10.0.0.0/16. The company wants to connect this VPC to an on-premises network that uses the CIDR block 10.0.0.0/8. The company has set up an AWS Site-to-Site VPN connection. After configuration, the on-premises network cannot reach resources in the VPC, and the VPC cannot reach on-premises resources. What is the most likely cause of the connectivity issue?

Accepted Answer

The on-premises network CIDR block overlaps with the VPC CIDR block, causing routing conflicts.. The on-premises network CIDR 10.0.0.0/8 overlaps with the VPC CIDR 10.0.0.0/16. This overlap causes routing conflicts because the same IP range exists on both sides of the VPN. Traffic cannot be correctly routed, leading to connectivity failure. The solution is to re-address either the VPC or the on-premises network to eliminate the overlap.

Answer

The VPC route table does not have a route for the on-premises CIDR block pointing to the virtual private gateway.

Answer

The security group attached to the VPC resources does not allow traffic from the on-premises CIDR block.

Answer

The VPN connection is using dynamic routing (BGP) instead of static routing, which is required for overlapping CIDRs.

Question 13

A company uses AWS Secrets Manager to store database credentials for an application running on EC2 instances. The security engineer needs to ensure that the credentials are automatically rotated every 30 days and that the application can retrieve the credentials without hardcoding them. The engineer has configured a rotation Lambda function and enabled rotation. However, the application is still using hardcoded credentials. What should the engineer do to ensure the application retrieves credentials dynamically?

Accepted Answer

Modify the application code to call the Secrets Manager GetSecretValue API using the AWS SDK, and grant the EC2 instance role permission to access the secret.. The application must be modified to use the Secrets Manager API to retrieve credentials at runtime. This ensures that the application always gets the current credentials after rotation. The EC2 instance role must have permissions to call GetSecretValue on the secret. This is the standard pattern for dynamic secret retrieval.

Answer

Use AWS AppConfig to deploy the credentials to the EC2 instances and configure the application to read from a local file.

Answer

Store the credentials in AWS Systems Manager Parameter Store as a SecureString parameter and modify the application to retrieve them from there.

Answer

Configure the application to read the credentials from an environment variable that is updated by the rotation Lambda function.

Question 14

A financial services company runs a production AWS account. A security engineer must ensure that IAM users cannot disable AWS CloudTrail logging in any region. The engineer attaches a permissions boundary to every IAM user. Which permissions boundary policy statement BEST enforces this requirement?

Accepted Answer

A Deny statement for cloudtrail:StopLogging with no conditions, plus an Allow statement for all other actions the users need.. A permissions boundary defines the maximum permissions an identity can have, and an explicit Deny within it cannot be overridden by identity-based policies. Combining a Deny for cloudtrail:StopLogging with Allow for needed actions prevents any user from disabling logging while preserving normal access. Conditional or tag-scoped statements leave gaps that allow the prohibited action.

Answer

An Allow statement for cloudtrail:StopLogging with a condition that the request originates from the corporate CIDR range.

Answer

A Deny statement for cloudtrail:StopLogging with a condition that aws:PrincipalTag/role equals 'security-auditor'.

Answer

An Allow statement for cloudtrail:* with a condition that aws:RequestedRegion is not the production region.

Question 15

A security engineer needs to protect sensitive data stored in an Amazon S3 bucket. The data must be encrypted at rest using a customer managed key in AWS KMS, and the engineer wants to ensure that all requests to upload objects without encryption are automatically denied. The bucket is in account 111122223333. Which S3 bucket policy statement should the engineer use?

Accepted Answer

A statement that denies s3:PutObject if the request lacks the s3:x-amz-server-side-encryption header with value aws:kms.. To enforce that all objects uploaded to an S3 bucket are encrypted with SSE-KMS, the bucket policy must include a Deny statement that blocks PutObject requests when the s3:x-amz-server-side-encryption header is missing or not set to aws:kms. This ensures that any upload without the required encryption header is rejected. Allow statements alone do not prevent non-compliant uploads, and conditions specifying AES256 enforce SSE-S3, not SSE-KMS.

Answer

A statement that denies s3:PutObject if the request includes the s3:x-amz-server-side-encryption header with value aws:kms.

Answer

A statement that denies s3:PutObject if the request does not include the s3:x-amz-server-side-encryption header with value AES256.

Answer

A statement that allows s3:PutObject only if the request includes the s3:x-amz-server-side-encryption header with value AES256.

Question 16

A security engineer is configuring AWS IAM Identity Center (successor to AWS Single Sign-On) for a company that uses an external identity provider (IdP) supporting SAML 2.0. The company wants to assign users to AWS accounts based on their groups in the IdP. The engineer has already configured the IdP and the SAML trust. What is the next step to ensure that users can access the correct AWS accounts with the appropriate permissions?

Accepted Answer

In IAM Identity Center, create permission sets that define the policies, then assign the IdP groups to AWS accounts with those permission sets.. After configuring the SAML trust with the external IdP, the next step in IAM Identity Center is to create permission sets that define the policies for access, and then assign those permission sets to the IdP groups for specific AWS accounts. This maps group memberships to AWS permissions without creating IAM users, enabling centralized and scalable access management.

Answer

Use AWS Organizations SCPs to grant permissions to IdP groups based on their group names.

Answer

Configure IAM roles in each AWS account with trust policies that allow the IdP to assume them, and then map groups to roles.

Answer

Create IAM users in each AWS account and map them to the IdP groups.

Question 17

A company uses AWS Organizations with a service control policy (SCP) that denies all actions except those explicitly listed. A developer in a member account needs to launch an EC2 instance with an IAM role that grants access to an S3 bucket. The SCP currently allows ec2:RunInstances and s3:GetObject but denies iam:PassRole. What is the MOST likely effect?

Accepted Answer

The developer cannot launch the instance because the SCP denies iam:PassRole, which is required to associate the role with the instance.. iam:PassRole is mandatory for a principal to associate an IAM role with an EC2 instance. When an SCP denies iam:PassRole, the RunInstances action fails even if ec2:RunInstances is allowed. This prevents unauthorized role escalation. The other options incorrectly assume the launch can succeed or misunderstand the scope of SCPs.

Answer

The developer can launch the instance, but the instance will not be able to assume the IAM role because iam:PassRole is denied.

Answer

The developer can launch the instance, and the instance will use the role's permissions because the SCP only applies to the developer, not the instance.

Answer

The developer can launch the instance if they use an existing instance profile instead of passing the role directly.

Question 18

A company wants to enforce that all IAM users must use multi-factor authentication (MFA) to access the AWS Management Console. The security team creates an IAM policy that denies all actions unless MFA is present. However, users report they can still perform actions without MFA. What is the most likely reason for this?

Accepted Answer

The policy does not include a condition to check for MFA, or the condition is incorrect.. The most likely reason is that the policy does not include a condition to check for MFA, or the condition is incorrect. To enforce MFA, the policy must include a Deny statement with a condition like 'aws:MultiFactorAuthPresent': 'false' or 'true' depending on the logic. If the condition is missing, the deny will not be effective. It is also important to ensure the policy is attached to all users or groups.

Answer

MFA policies only apply to API calls, not console access.

Answer

The users are using root account credentials, which bypass MFA policies.

Answer

The policy was attached to the wrong IAM group.

Question 19

A security engineer needs to centrally aggregate AWS CloudTrail management events from all accounts in an AWS Organizations organization and retain them for 7 years in immutable storage. The engineer has already created an organization trail that delivers to a central S3 bucket in the security account. Which additional configuration is required to make the logs tamper-evident and to detect if any account attempts to disable CloudTrail?

Accepted Answer

Enable S3 Object Lock in compliance mode on the central bucket and enable CloudTrail log file validation, then create an Amazon EventBridge rule for the CloudTrail StopLogging API call.. Immutability and tamper detection are two distinct controls. S3 Object Lock in compliance mode enforces WORM retention so logs cannot be altered or deleted for the retention period, and CloudTrail log file validation produces digest files that let you verify delivered logs were not modified. Because disabling a trail stops future delivery, an EventBridge rule matching the StopLogging event (and related trail APIs) is needed to alert the security team immediately.

Answer

Enable S3 Versioning and MFA Delete on the central bucket, then configure AWS Config to record the cloudtrail:StopLogging API as a configuration change.

Answer

Enable AWS CloudTrail Insights on the organization trail and configure an Amazon SNS topic to notify the security team when unusual API activity is detected.

Answer

Enable Amazon Macie on the central bucket to detect anomalous access and configure an S3 bucket policy that denies s3:DeleteObject to all principals except the CloudTrail service principal.

Question 20

A security engineer is investigating a suspected compromise of an Amazon EC2 instance that is a member of an Auto Scaling group. The instance is still running and the engineer must preserve volatile evidence before the Auto Scaling group replaces it. Which sequence of actions best preserves the evidence while maintaining the ability to analyze it later?

Accepted Answer

Capture memory with an approved forensic tool, take EBS snapshots of all attached volumes, record instance metadata and network connections, then isolate the instance by replacing its security group with a quarantine group.. Preserving volatile evidence requires acting before any shutdown or termination. Capturing memory first retains processes and credentials, EBS snapshots preserve disk state for offline analysis, and recording metadata and network connections provides investigative context. Isolating the instance with a quarantine security group stops exfiltration and command-and-control traffic without destroying the evidence, and it keeps the instance alive so additional artifacts can be collected if needed.

Answer

Stop the instance, detach the root EBS volume, create a snapshot of the volume, and then reattach the original volume to the instance.

Answer

Create an AMI of the instance, terminate the instance to prevent further malicious activity, and launch a new instance from the AMI for analysis.

Answer

Detach the instance from the Auto Scaling group, reboot the instance into single-user mode, and copy the root filesystem to an S3 bucket using the AWS CLI.