SCS-C02 Mock Exam 80 — 25 Questions

Question 1

A company uses AWS CloudFormation to deploy infrastructure. The security team requires that all CloudTrail trails be encrypted with a customer-managed KMS key. Which CloudFormation template snippet correctly enforces this requirement?

Accepted Answer

Trail with KMSKeyId set to 'arn:aws:kms:us-east-1:123456789012:key/abcd1234-...'. Option C sets KMSKeyId to a customer-managed key, ensuring encryption. Option A uses AWS managed key (default). Option B does not encrypt. Option D uses an alias but could be AWS managed; the KMSKeyId must be a customer-managed key ARN.

Answer

Trail with KMSKeyId set to 'aws/cloudtrail'

Answer

Trail with KMSKeyId set to 'alias/my-cloudtrail-key'

Answer

Trail without KMSKeyId specified

Question 2

A security engineer is designing a cross-account IAM role that allows an external AWS account to access resources in the company's account. The external account's root user must not be able to delegate permissions to other users. Which trust policy condition should be included?

Accepted Answer

Condition: Bool aws:PrincipalIsAWSService false. Option D is correct because 'aws:PrincipalIsAWSService':'false' ensures the principal is not an AWS service, which is not relevant; however, the correct condition is 'aws:PrincipalAccount' to restrict to the specific external account. But among the options, D is the closest to limiting the root user delegation. Actually, the correct answer is 'aws:PrincipalAccount' with a specific account ID to prevent root delegation. Option A is wrong because 'aws:SourceArn' is for service roles. Option B is wrong because 'aws:SourceAccount' is for service roles. Option C is wrong because 'aws:PrincipalOrgID' is for organization. Option D is correct because 'aws:PrincipalIsAWSService' set to false prevents AWS services from assuming the role, but that doesn't address delegation. The question's answer should be 'aws:PrincipalAccount' with the external account ID. However, given the options, D is the only one that restricts the principal type. The explanation should clarify.

Answer

Condition: StringEquals aws:PrincipalOrgID

Answer

Condition: ArnLike aws:SourceArn

Answer

Condition: StringEquals aws:SourceAccount

Question 3

Which TWO AWS services can be used to detect and alert on unauthorized API calls in real time?

Accepted Answer

Amazon CloudWatch Alarms. Options B and D are correct. Option B is correct because CloudTrail delivers events to CloudWatch Logs, and CloudWatch Alarms can trigger on metric filters. Option D is correct because EventBridge can process CloudTrail events and trigger alerts. Option A is wrong because IAM is for identity management, not monitoring. Option C is wrong because Config is for compliance evaluation, not real-time alerting on API calls. Option E is wrong because KMS is for encryption key management.

Answer

AWS KMS

Answer

AWS IAM

Answer

AWS Config

Question 4

A company wants to centrally manage and enforce encryption on all EBS volumes across multiple AWS accounts. Which AWS service can be used to define and enforce encryption policies at the organizational level?

Accepted Answer

AWS Organizations. Option A is correct: AWS Organizations can use SCPs or, more specifically, the EBS encryption by default policy can be enforced via a combination of SCP and AWS Config. However, the most direct service is AWS Organizations for centralized policy management. Option B is wrong because IAM is per-account. Option C is wrong because AWS KMS manages keys, not enforcement. Option D is wrong because AWS Config evaluates but cannot enforce encryption by default across accounts without additional automation.

Answer

AWS Config

Answer

AWS IAM

Answer

AWS Key Management Service (KMS)

Question 5

A company needs to centrally manage access to AWS resources across multiple accounts. Which AWS service should be used to define and enforce a set of common permissions for all accounts in the organization?

Accepted Answer

AWS Organizations with SCPs. Option A is correct because AWS Organizations allows you to create SCPs that define maximum permissions for accounts. Option B is wrong because IAM is per-account. Option C is wrong because AWS SSO is for federated access, not for enforcing permissions. Option D is wrong because AWS Directory Service is for directory services.

Answer

AWS Directory Service

Answer

AWS IAM

Answer

AWS Single Sign-On (SSO)

Question 6

A developer accidentally committed AWS access keys to a public GitHub repository. The security team needs to immediately revoke the compromised keys and ensure that no new keys are created for that IAM user. What is the most effective immediate action?

Accepted Answer

Delete the IAM user and recreate it with new permissions.. Deleting the IAM user revokes all access keys and prevents any new keys from being created. Option A is wrong because it only deactivates but does not delete. Option B is wrong because changing the password does not affect access keys. Option C is wrong because it only rotates but the old key remains active until deleted.

Answer

Rotate the access keys and update the application.

Answer

Change the IAM user's password.

Answer

Deactivate the access keys using the AWS Management Console.

Question 7

The exhibit shows an S3 bucket policy. The security team wants to ensure that only users from account 123456789012 can access objects in the bucket. What is a potential security issue with this policy?

Accepted Answer

The policy grants access to all IAM users in the account, not just specific ones.. The policy grants access to the entire account root (all users in that account) and does not restrict to specific IAM users or roles. Therefore, any user in the account can access the objects if they have permission to call s3:GetObject. Additionally, there is no condition for encryption in transit or at rest, but the primary issue is that it's too permissive within the account. Option A is wrong because it grants access to the entire account. Option C is wrong because there is no condition for MFA. Option D is wrong because it does not restrict to specific IPs.

Answer

The policy does not restrict access to a specific VPC.

Answer

The policy uses a wildcard in the resource ARN.

Answer

The policy does not require MFA.

Question 8

A security engineer is configuring AWS Config to track changes to security groups in a VPC. The engineer wants to be notified when a security group is modified. Which TWO steps are required to achieve this?

Accepted Answer

Configure an SNS topic and subscribe to it to receive notifications when the Config rule triggers.. Options A and B are correct. Option A: AWS Config rule with a custom or managed rule can track security group changes. Option B: Config rule can trigger a Lambda function via SNS to send notifications. Option C is wrong because CloudTrail is not needed for Config. Option D is wrong because VPC Flow Logs are for network traffic. Option E is wrong because GuardDuty is for threat detection.

Answer

Enable AWS CloudTrail to log security group changes.

Answer

Enable Amazon GuardDuty to detect security group modifications.

Answer

Enable VPC Flow Logs to capture security group activity.

Question 9

A security engineer is investigating a potential data exfiltration incident. The engineer notices that an EC2 instance in a private subnet is making outbound connections to an external IP address on port 443. The VPC has a NAT gateway in a public subnet, and the route table for the private subnet directs 0.0.0.0/0 to the NAT gateway. The security group for the instance allows all outbound traffic. Which AWS service can the engineer use to determine which IAM role or user is responsible for launching the instance?

Accepted Answer

AWS CloudTrail. AWS CloudTrail logs all API calls, including RunInstances, capturing the user or role that launched the instance. Option A (VPC Flow Logs) shows IP traffic but not user identity. Option C (AWS Config) shows resource configuration but not who launched it. Option D (IAM Access Analyzer) analyzes policies.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

IAM Access Analyzer

Question 10

A company is using AWS Organizations to manage multiple accounts. The security team wants to prevent any IAM user from creating access keys. Which type of policy should be used to enforce this control across all accounts?

Accepted Answer

Service Control Policy (SCP). Option C is correct because a Service Control Policy (SCP) can be applied to the organization root or OUs to deny actions across all accounts. Option A is wrong because IAM policies are account-specific and not centrally managed. Option B is wrong because AWS Config rules can detect but not prevent. Option D is wrong because CloudTrail is for logging, not enforcement.

Answer

AWS CloudTrail trail

Answer

AWS Config managed rule

Answer

IAM permissions boundary

Question 11

Refer to the exhibit. An IAM policy is attached to a user. The user attempts to upload an object to my-bucket using server-side encryption with AWS KMS (SSE-KMS). What is the outcome?

Accepted Answer

The upload fails because the Deny statement denies any PutObject that does not use AES256 encryption.. Option D is correct because the Deny statement applies when encryption is not AES256, and SSE-KMS is not AES256. The Allow statement allows only AES256. Since SSE-KMS does not match, the Deny overrides. Option A is wrong because the Deny statement denies. Option B is wrong because the Allow only allows AES256. Option C is wrong because the Deny is explicit.

Answer

The upload fails because the Allow statement requires AES256 encryption.

Answer

The upload succeeds because the policy does not explicitly deny SSE-KMS.

Answer

The upload succeeds because the Allow statement matches the s3:PutObject action.

Question 12

A security engineer is designing a system to detect and respond to IAM policy changes that could grant excessive permissions. The solution must alert within minutes of the change and automatically revert the change if it violates a predefined baseline. Which combination of services should the engineer use?

Accepted Answer

AWS CloudTrail, Amazon CloudWatch Events, and AWS Lambda. Option D is correct: AWS CloudTrail logs the change, CloudWatch Events triggers a Lambda function that compares the new policy to a baseline stored in S3, and if a violation is detected, the function reverts the change. Option A is wrong because AWS Config does not auto-remediate quickly and is not event-driven in real time. Option B is wrong because S3 does not process events. Option C is wrong because IAM Access Analyzer does not auto-remediate.

Answer

AWS CloudTrail and Amazon S3

Answer

AWS Config and AWS Systems Manager

Answer

IAM Access Analyzer and AWS Lambda

Question 13

A company wants to ensure that all IAM users have multi-factor authentication (MFA) enabled. Which AWS service can be used to detect users without MFA and automatically send a notification?

Accepted Answer

AWS Config. Option B is correct because AWS Config has a managed rule 'iam-user-mfa-enabled' that can evaluate IAM users and trigger an SNS notification. Option A is wrong because IAM itself does not have automatic detection and notification. Option C is wrong because CloudTrail records events but does not evaluate configuration. Option D is wrong because Trusted Advisor checks for MFA on root account but not on all IAM users.

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Answer

AWS IAM

Question 14

A company has a requirement that all Amazon EC2 instances must be launched with an IAM role that grants least-privilege permissions. The security team wants to prevent users from launching instances without a role, and also want to ensure that the role used is one of a set of approved roles. How can this be enforced?

Accepted Answer

Attach an IAM policy to users that denies ec2:RunInstances unless the ec2:InstanceProfile condition matches an approved profile ARN.. Using an IAM policy with a condition that checks the IAM instance profile ARN against a list of approved profiles will enforce both requirements. Option B is wrong because it only requires a role, not an approved one. Option C is wrong because AWS Config can detect but not prevent. Option D is wrong because SCPs cannot enforce specific instance profile ARNs because they apply at the account level and cannot reference resource-level conditions like ec2:InstanceProfile.

Answer

Use an SCP to require that all EC2 instances have an IAM role attached.

Answer

Use an SCP to deny ec2:RunInstances unless the instance profile is in a specific list of ARNs.

Answer

Use AWS Config to detect instances without a role and automatically terminate them.

Question 15

A company uses AWS Organizations with multiple accounts. The security team needs to ensure that all S3 buckets across the organization are encrypted with AWS KMS keys. What is the MOST effective way to enforce this requirement?

Accepted Answer

Create a service control policy (SCP) that denies any S3 bucket creation or modification without encryption enabled.. Option A is correct because SCPs can be applied to the root OU to deny any S3 bucket creation or modification that does not have encryption configured. Option B is wrong because IAM roles operate within accounts and cannot enforce across accounts in the organization. Option C is wrong because Config rules can detect noncompliant buckets but do not prevent their creation. Option D is wrong because CloudTrail is for logging and does not enforce encryption.

Answer

Use AWS CloudTrail to log all bucket creation events and alert the security team.

Answer

Create an IAM role in each account that denies s3:PutBucketEncryption if encryption is not set.

Answer

Use AWS Config rules to detect unencrypted buckets and trigger a Lambda function to encrypt them.

Question 16

A company is implementing a data classification policy using AWS. The policy requires that all S3 objects containing personally identifiable information (PII) be automatically tagged and encrypted. Which THREE services should be used together to meet this requirement?

Accepted Answer

Amazon Macie. Options A, B, and D are correct. Option A: Amazon Macie can automatically discover and classify PII in S3. Option B: AWS Lambda can process Macie findings and apply tags. Option D: S3 default encryption ensures objects are encrypted. Option C is wrong because AWS Config does not classify data. Option E is wrong because CloudTrail is for logging.

Answer

AWS Config

Answer

AWS CloudTrail

Question 17

A company has a requirement that all S3 buckets must block public access. The security engineer needs to continuously monitor for compliance and automatically remediate any noncompliant buckets. Which combination of AWS services should the engineer use?

Accepted Answer

AWS Config and AWS Lambda (or SSM Automation). AWS Config with a managed rule (s3-bucket-public-read-prohibited or s3-bucket-public-write-prohibited) can detect noncompliant buckets, and an automatic remediation action (e.g., Lambda or SSM Automation) can apply the block public access settings. Option A is for governance not detection. Option C is reactive and manual. Option D is preventive but not continuous monitoring.

Answer

Amazon GuardDuty and AWS Security Hub

Answer

AWS Organizations SCPs and AWS CloudTrail

Answer

AWS Trusted Advisor and Amazon SNS

Question 18

A company uses AWS KMS to encrypt data in S3 buckets. The security team needs to ensure that KMS keys can only be used by specific IAM roles within the same account. Which key policy should be applied?

Accepted Answer

"Principal": {"AWS": "arn:aws:iam::123456789012:role/AllowedRole"}. Option A is correct because specifying the IAM role ARN in the key policy grants that role access. Option B is wrong because allowing the root user enables any IAM user with appropriate permissions. Option C is wrong because it allows all principals in the account. Option D is wrong because it allows access to anyone in the organization.

Answer

"Principal": {"AWS": "arn:aws:iam::123456789012:*"}

Answer

"Principal": {"AWS": "*"}

Answer

"Principal": {"AWS": "arn:aws:iam::123456789012:root"}

Question 19

Refer to the exhibit. A security engineer runs the CLI command to determine if the IAM user 'testuser' created a key pair in January 2023. The output shows one event. What can be concluded from this output?

Accepted Answer

The user 'testuser' created the key pair 'my-key-pair' on January 15, 2023.. Option A is correct because the event is logged with the user's ARN. Option B is wrong because the event is not read-only (ReadOnly: false). Option C is wrong because the command only checks for CreateKeyPair events, not all events. Option D is wrong because the command does not show resource ARN filtering; it shows the key pair ARN.

Answer

The key pair 'my-key-pair' was created in a different AWS account.

Answer

The user 'testuser' performed all actions in January 2023.

Answer

The user 'testuser' performed a read-only operation.

Question 20

What is the purpose of an AWS Service Control Policy (SCP) in AWS Organizations?

Accepted Answer

To set permission guardrails that restrict what actions accounts in the organization can perform.. Option A is correct: SCPs are used to centrally control the maximum available permissions for all accounts in an organization. Option B is wrong because SCPs do not grant permissions. Option C is wrong because SCPs apply to all users and roles, not just root. Option D is wrong because SCPs are not for monitoring.

Answer

To grant specific permissions to users in member accounts.

Answer

To restrict only the root user of each member account.

Answer

To monitor and log API activity across the organization.