SCS-C02 Practice Test 8 — 10 Questions

Question 1

During an incident response, a security engineer needs to preserve the state of an EC2 instance's root volume for forensic analysis. The instance is still running. Which action should be taken to ensure the data is preserved without altering it?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a snapshot of the root volume.. Creating a snapshot of the root volume is the correct action because it captures a point-in-time, crash-consistent copy of the volume's data without requiring the instance to be stopped or the volume to be detached. This preserves the current state of the running instance for forensic analysis while ensuring the data is not altered by the snapshot process itself, as AWS snapshots are read-only and do not modify the source volume.

Answer

Stop the instance and then create an AMI.

Answer

Use dd if=/dev/xvda over SSH to copy the volume.

Answer

Detach the root volume and attach it to a forensics instance.

Question 2

A company uses Amazon GuardDuty and wants to automatically isolate a compromised EC2 instance by removing it from the security group. Which approach should be used?

Accepted Answer

Create an Amazon EventBridge rule that triggers an AWS Lambda function to remove the instance from the security group.. Amazon GuardDuty publishes findings to Amazon EventBridge, which can be used to trigger an AWS Lambda function. The Lambda function can then call the EC2 API to modify the security group and remove the compromised instance, achieving automated isolation without requiring direct GuardDuty integration with security groups.

Answer

Set up an AWS Config rule to detect the finding and remediate.

Answer

Configure GuardDuty to directly modify the security group.

Answer

Use AWS Systems Manager Automation to automatically modify the security group based on GuardDuty findings.

Question 3

A company is designing a data protection strategy for its Amazon RDS for PostgreSQL database. The database contains sensitive customer data. Compliance requirements mandate that all backups be encrypted at rest and that the encryption keys be rotated annually. Which solution meets these requirements?

Accepted Answer

Enable encryption at rest on the RDS instance using a customer managed KMS key. Enable automatic key rotation in KMS.. Enabling encryption at rest on the RDS instance with a customer managed KMS key gives the company control over the key, and enabling automatic key rotation in KMS satisfies the annual rotation requirement. Customer managed keys support automatic rotation (default 365 days), unlike AWS managed keys, which cannot be rotated on a customer-defined schedule.

Answer

Create an encrypted read replica of the RDS instance and use the replica for backups.

Answer

Use S3 server-side encryption with a customer managed key for automated backups. Configure lifecycle policies to rotate the key.

Answer

Enable encryption at rest on the RDS instance using an AWS managed KMS key. The key will be rotated automatically every year.

Question 4

A security team wants to automatically revoke public access to an S3 bucket when Amazon GuardDuty detects a suspicious API call from a known malicious IP address. Which AWS service should be used to orchestrate this automated response?

Accepted Answer

AWS Systems Manager Automation. AWS Systems Manager Automation is the correct service because it provides a runbook-based orchestration framework that can be triggered by Amazon EventBridge events from GuardDuty findings. It can execute predefined automation documents (e.g., AWS-DisableS3BucketPublicReadWrite) to modify S3 bucket policies and revoke public access without requiring custom code, making it ideal for automated incident response workflows.

Answer

AWS Config

Answer

AWS Lambda

Answer

AWS CloudTrail

Question 5

Which TWO steps should a security engineer take when responding to a confirmed security incident involving a compromised EC2 instance? (Choose 2.)

Accepted Answer

Isolate the instance by changing its security group to deny all traffic. Option C is correct because isolating the compromised EC2 instance by replacing its security group with one that denies all inbound and outbound traffic is the standard containment step that stops lateral movement and command-and-control communication while preserving the instance's volatile state for investigation. Option D is correct because taking EBS snapshots of the instance's volumes captures a point-in-time, read-only copy of the disk that can be mounted on a separate forensic workstation for evidence preservation and analysis without altering the original data. Option A is not appropriate as a first response because reimaging destroys volatile evidence and should only occur after containment and forensic capture are complete. Option B is wrong because deleting CloudTrail logs is log tampering that destroys the audit trail needed for the investigation. Option E is wrong because terminating the instance shuts it down and can destroy volatile memory and instance-store data before evidence is collected.

Answer

Reimage the instance from a clean AMI immediately

Answer

Delete all CloudTrail logs related to the instance

Answer

Immediately terminate the instance to stop the attack

Question 6

A security engineer needs to protect an S3 bucket that contains sensitive data. Which two methods should the engineer use?

Accepted Answer

Apply an S3 bucket policy that restricts access to specific IAM users or roles.. Option C is correct because an S3 bucket policy is a resource-based policy attached directly to the bucket that can explicitly allow or deny access based on principals (specific IAM users, roles, or accounts), conditions such as source VPC endpoint or IP range, and actions, making it the primary tool for restricting who can reach sensitive objects. Option D is correct because IAM policies are identity-based policies attached to users, groups, or roles that define which S3 actions (for example s3:GetObject, s3:PutObject) those identities may perform on the bucket and its objects; combined with the bucket policy, they enforce least-privilege access. Option A is not correct because CloudFront is a content-delivery service that can front an S3 bucket for performance or OAC-based access, but it does not by itself protect the bucket's data or restrict direct S3 access. Option B is not correct because VPC Flow Logs capture IP traffic metadata for network interfaces in a VPC and have no relationship to S3 bucket access control. Option E is not correct because S3 object ACLs are legacy access-control lists that grant only coarse read/write permissions to individual objects and are not the recommended mechanism for restricting sensitive bucket data to specific IAM principals.

Answer

Use Amazon CloudFront to serve the content.

Answer

Enable VPC Flow Logs on the bucket.

Answer

Enable S3 object ACLs.

Question 7

A company uses AWS Organizations with multiple accounts. The security team wants to prevent all users in the production account from disabling AWS CloudTrail or modifying its configuration. What is the MOST effective way to achieve this?

Accepted Answer

Create an SCP in AWS Organizations that denies cloudtrail:StopLogging, cloudtrail:DeleteTrail, cloudtrail:UpdateTrail, and similar actions.. Service Control Policies (SCPs) in AWS Organizations provide centralized, preventive control over the maximum permissions for all accounts in an organization or OU. By creating an SCP that denies CloudTrail actions such as StopLogging, DeleteTrail, and UpdateTrail, the security team can ensure that no user or role in the production account can disable or modify CloudTrail, even if they have IAM permissions. This is the most effective and scalable way to enforce this restriction across the account.

Answer

Use IAM policies to deny only cloudtrail:DeleteTrail for all users.

Answer

Enable CloudTrail log file validation and use AWS Config to detect changes.

Answer

Attach an IAM permissions boundary to all IAM roles in the production account that denies CloudTrail modifications.

Question 8

Refer to the exhibit. A security engineer runs this AWS CLI command to investigate root user logins. The output shows a successful ConsoleLogin event. What should the engineer do next to improve security?

Accepted Answer

Enable multi-factor authentication (MFA) for the root user.. Enabling multi-factor authentication (MFA) for the root user adds an extra layer of security, making it much harder for an attacker to compromise the root account even if the password is known. While AWS recommends avoiding routine use of the root user, the root account cannot be deleted; instead, securing it with MFA is a best practice. Options A and B are incorrect because root user cannot be deleted, and disabling the password alone does not prevent root user login via password recovery or other methods. Option C is incorrect because IAM Access Analyzer analyzes resource-based policies for unintended access, not root user activity; it does not generate findings for ConsoleLogin events.

Answer

Delete the root user account.

Answer

Disable the root user password and require all logins via IAM users.

Answer

Enable IAM Access Analyzer to detect and alert on root user activity.

Question 9

A security engineer wants to capture all DNS queries made by EC2 instances to detect potential data exfiltration. Which AWS service should be used to log the DNS requests?

Accepted Answer

Use Route 53 Resolver DNS Firewall with query logging. Route 53 Resolver DNS Firewall with query logging is the correct choice because it is specifically designed to log all DNS queries made by EC2 instances that use the Route 53 Resolver. This service captures the domain names being queried, the source IP, and the response, enabling detection of DNS-based data exfiltration (e.g., DNS tunneling). It integrates directly with the VPC's DNS resolver, ensuring all outbound DNS traffic from EC2 instances is logged without additional agents.

Answer

Use Amazon GuardDuty

Answer

Enable VPC Flow Logs

Answer

Enable AWS CloudTrail

Question 10

A company uses AWS Organizations with multiple accounts. The security team wants to centralize security logs (CloudTrail, VPC Flow Logs, AWS Config) from all accounts into a single S3 bucket for analysis. What is the MOST secure way to set up this centralized logging?

Accepted Answer

Create a dedicated S3 bucket in the security account with a bucket policy that grants write access to the logging services of all accounts and enforces encryption in transit and at rest.. It uses a dedicated S3 bucket in a security account (not the management account) with a bucket policy that explicitly grants write access to the logging services (CloudTrail, VPC Flow Logs, AWS Config) from all accounts, while enforcing encryption in transit (aws:SecureTransport) and at rest (default SSE-S3 or SSE-KMS). This follows the security best practice of isolating logs in a separate account and using resource-based policies to restrict access, preventing accidental deletion or modification by other accounts.

Answer

Create a dedicated S3 bucket in the management account, enable S3 default encryption, and configure service delivery for each account.

Answer

Configure each account to deliver logs to the same S3 bucket used for other data.

Answer

Create an S3 bucket in each account and use S3 replication to copy logs to a central bucket.