SCS-C02 Mock Exam 81 — 25 Questions

Question 1

A company is using AWS CloudFormation to deploy infrastructure. The security team wants to enforce that all S3 buckets created by CloudFormation have encryption enabled. Which approach should be used to enforce this policy?

Accepted Answer

Use AWS CloudFormation Guard to validate templates. Option B is correct because a CloudFormation Guard rule can validate templates before deployment to ensure encryption is configured. Option A is wrong because SCPs cannot enforce resource configurations within a stack. Option C is wrong because CloudTrail cannot enforce. Option D is wrong because Service Catalog enforces on products, not on all CloudFormation templates.

Answer

Use AWS Service Catalog to enforce encryption

Answer

Enable AWS CloudTrail to detect unencrypted buckets

Answer

Create an SCP to deny creation of unencrypted S3 buckets

Question 2

Refer to the exhibit. A company uses this CloudFormation template. What security best practice is being violated?

Accepted Answer

The security group allows SSH access from all IP addresses.. Option C is correct because the security group allows SSH from anywhere (0.0.0.0/0), which is a security risk. Option A is wrong because the instance type is not inherently a security issue. Option B is wrong because the AMI ID is not necessarily a vulnerability. Option D is wrong because there is no encryption setting; the EBS volume has Encrypted: false, which is a best practice violation, but the most critical is the open SSH.

Answer

The instance type is too small for production workloads.

Answer

The AMI ID is not specified as a parameter.

Answer

The EBS volume is not encrypted.

Question 3

A company wants to implement a least-privilege access model for their AWS resources. Which TWO of the following are best practices for achieving this?

Accepted Answer

Grant permissions only for the specific actions required.. Option A is correct: granting only the necessary permissions is the core of least-privilege. Option D is correct: using conditions to restrict access based on attributes like IP or time. Option B is wrong because using a single role for all users violates least-privilege. Option C is wrong because attaching policies to groups is good, but not specifically for least-privilege. Option E is wrong because using managed policies alone does not ensure least-privilege.

Answer

Use a single IAM role for all users in the account.

Answer

Attach IAM policies to groups rather than individual users.

Answer

Always use AWS managed policies instead of customer managed policies.

Question 4

A company uses AWS Organizations with many accounts. The security team wants to ensure that no account can disable AWS CloudTrail or stop logging. Which configuration should be used?

Accepted Answer

Apply an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail.. Option A is correct because an SCP can deny the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions at the organizational level. Option B is wrong because AWS Config rules can detect but not prevent. Option C is wrong because IAM policies in the master account do not affect member accounts. Option D is wrong because CloudTrail itself cannot prevent its own modification.

Answer

Enable CloudTrail log file validation.

Answer

Attach an IAM policy to the root user in each account.

Answer

Use AWS Config rules to detect and alert when CloudTrail is modified.

Question 5

A security engineer creates the IAM policy shown in the exhibit. The policy is attached to an IAM role. When a user assumes the role and attempts to upload an object to the bucket without specifying server-side encryption, what is the expected behavior?

Accepted Answer

The request is denied because the condition is not met.. Option A is correct because the policy requires the condition s3:x-amz-server-side-encryption to be equal to aws:kms. If the request does not include encryption, the condition fails and the request is denied. Option B is wrong because the policy does not allow requests without encryption. Option C is wrong because the condition applies to PutObject as well. Option D is wrong because the condition is not ignored.

Answer

The request succeeds because the condition is ignored for PutObject.

Answer

The request is denied only if the object is publicly accessible.

Answer

The request succeeds because the condition is only for GetObject.

Question 6

A company has a single AWS account with several IAM users. The security team wants to ensure that all IAM users have strong passwords and that passwords are rotated every 90 days. The team also wants to receive a notification if any user's password is older than 90 days. The team has enabled an IAM password policy that requires strong passwords and sets a maximum password age of 90 days. However, they are not receiving notifications about expired passwords. Which additional step should the security team take to receive notifications?

Accepted Answer

Create an AWS Config rule that checks the password policy and triggers an SNS notification.. Option A is correct because AWS Config can evaluate the password policy and trigger SNS notifications when non-compliant. Option B is wrong because CloudTrail does not evaluate password age. Option C is wrong because Trusted Advisor does not monitor IAM user password age. Option D is wrong because IAM itself does not send notifications for password expiration.

Answer

Configure IAM to automatically send an email when a password expires.

Answer

Enable AWS CloudTrail to log password changes and use Amazon CloudWatch Events to monitor.

Answer

Use AWS Trusted Advisor to check password policy and send notifications.

Question 7

A company's security team discovers that an EC2 instance in the production account has been compromised. The instance has an IAM role attached that allows it to read from an S3 bucket containing sensitive data. The team needs to immediately stop the data exfiltration while preserving the evidence. What should the team do first?

Accepted Answer

Apply an inline policy to the IAM role that denies all S3 actions.. Option C is correct because applying a deny-all policy to the role's S3 access will immediately stop the exfiltration without terminating the instance, preserving evidence. Option A is wrong because terminating the instance may destroy evidence. Option B is wrong because modifying the bucket policy takes time and may not be immediate. Option D is wrong because removing the role may cause issues and does not immediately stop the exfiltration if the role is cached.

Answer

Detach the S3 bucket from the VPC endpoint.

Answer

Remove the IAM role from the EC2 instance.

Answer

Terminate the compromised EC2 instance immediately.

Question 8

A company has a multi-account AWS Organization with 50 accounts. The security team uses AWS CloudTrail to log all API calls and sends the logs to a central S3 bucket in the security account. The team wants to ensure that any attempt to disable CloudTrail logging or delete the trail is detected and automatically remediated within 5 minutes. They have configured an AWS Config rule that triggers an AWS Lambda function when the CloudTrail configuration changes. However, the Lambda function is not being invoked when they test by stopping the trail. The Lambda function's IAM role has permissions to start and update CloudTrail. CloudTrail logs show that the Config rule is evaluating the resource, but the Lambda function is not triggered. What is the most likely cause?

Accepted Answer

The AWS Config service does not have permission to invoke the Lambda function.. Option A is correct because AWS Config must have permissions to invoke the Lambda function. Even if the Lambda function has permissions to modify CloudTrail, Config needs permission to invoke it. Option B is wrong because CloudTrail does not need permissions to invoke Lambda. Option C is wrong because the Lambda function has permissions, but Config does not. Option D is wrong because the issue is not with the S3 bucket.

Answer

The S3 bucket policy does not allow CloudTrail to write logs.

Answer

The Lambda function's IAM role does not have permission to modify CloudTrail.

Answer

The CloudTrail trail does not have permission to send logs to the S3 bucket.

Question 9

A company has an AWS Organization with hundreds of accounts. The security team wants to enforce that no account can disable AWS CloudTrail logging. Which TWO approaches can achieve this?

Accepted Answer

Enable CloudTrail as a trusted service and create an organization trail.. Options A and D are correct. An SCP can deny the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions (A), and enabling CloudTrail as a trusted service with organization trail (D) prevents accounts from stopping logging. Option B is wrong because IAM policies are account-specific and cannot be enforced across all accounts. Option C is wrong because CloudWatch Logs does not prevent disabling CloudTrail. Option E is wrong because Config cannot prevent the disabling of CloudTrail.

Answer

Apply an IAM policy to each account's root user to prevent disabling CloudTrail.

Answer

Use AWS Config to automatically re-enable CloudTrail if it is disabled.

Answer

Configure CloudWatch Logs to monitor CloudTrail logs and alert if logging stops.

Question 10

A company is using AWS Organizations with a management account and several member accounts. The security team has created an SCP that denies access to all actions for the 'ec2:*' service unless the request comes from a specific VPC endpoint. The SCP is attached to the organization root. However, users in a member account are still able to launch EC2 instances from the AWS Management Console, which does not use a VPC endpoint. The SCP is as follows:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": "ec2:*",
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "aws:sourceVpce": "vpce-12345678"
        }
      }
    }
  ]
}

What is the most likely reason the SCP is not preventing the users from launching instances?

Accepted Answer

The condition key 'aws:sourceVpce' is not supported in SCPs.. Option D is correct because the condition key 'aws:sourceVpce' is not supported in SCPs; SCPs support only a subset of condition keys, and 'aws:sourceVpce' is not among them. Therefore, the condition is ignored, and the deny does not apply. Option A is wrong because SCPs apply to all principals. Option B is wrong because the SCP is attached to the root. Option C is wrong because the management account is not subject to SCPs, but the member accounts are.

Answer

The SCP is not applied to the root user in the member account.

Answer

The SCP is attached to the organization root but not to the member account.

Answer

The management account is not affected by SCPs, and the users are using the management account.

Question 11

Refer to the exhibit. An IAM policy is attached to a user. The user reports that they cannot upload files to the S3 bucket 'example-bucket' using the AWS CLI with HTTPS. What is the most likely reason?

Accepted Answer

The user does not have an explicit allow for s3:PutObject.. Option B is correct because the policy denies s3:* actions on objects in the bucket when SecureTransport is false, meaning it denies only HTTP requests. However, the user is using HTTPS, so the deny should not apply. But the policy also implicitly denies all other actions not explicitly allowed? Actually, an explicit deny overrides any allow, but the condition only denies when SecureTransport is false. Since the user uses HTTPS, the condition is not met, so the deny does not apply. But the user might have no allow for s3:PutObject, which is the issue. Option B is correct because there is no explicit allow for s3:PutObject, and the default implicit deny applies. Option A is wrong because the condition does not apply. Option C is wrong because the AccessDenied error indicates permissions, not bucket name. Option D is wrong because the error is not about encryption.

Answer

The bucket requires server-side encryption and the user did not specify it.

Answer

The policy denies all S3 actions when using HTTPS.

Answer

The bucket name is incorrect in the policy.

Question 12

A company wants to centrally manage backups for Amazon RDS instances across multiple AWS accounts. Which AWS service should be used to automate the creation and enforcement of backup policies?

Accepted Answer

AWS Backup. Option B is correct because AWS Backup allows centralized backup policies across accounts and regions. Option A is wrong because S3 Lifecycle policies are for object lifecycle, not RDS backups. Option C is wrong because CloudTrail is for auditing API calls. Option D is wrong because Systems Manager is for operational management, not backup policies.

Answer

S3 Lifecycle policies

Answer

AWS CloudTrail

Answer

AWS Systems Manager

Question 13

A company has a multi-account AWS environment managed with AWS Organizations. The security team wants to ensure that no EC2 instance in any account can be launched without a specific tag 'CostCenter'. The team has created a Service Control Policy (SCP) that denies the ec2:RunInstances action if the request does not include the tag 'CostCenter'. However, they find that instances are still being launched without the tag in some accounts. What is the most likely reason?

Accepted Answer

The accounts launching instances without tags are the management account.. Option C is correct because SCPs do not affect the management account; the management account is exempt from SCPs. Option A is wrong because IAM policies are account-specific; the SCP should still apply if attached. Option B is wrong because SCPs do not require explicit allow for all actions; they work by deny. Option D is wrong because the condition key for tags is 'aws:RequestTag', not 'aws:ResourceTag'.

Answer

The SCP uses the wrong condition key; it should use 'aws:ResourceTag' instead.

Answer

The SCP does not include an explicit allow for the action.

Answer

The SCP is not attached to the organizational units containing the accounts.

Question 14

A security team needs to ensure that all API calls made in the AWS account are logged and the logs are stored in a central S3 bucket that is encrypted with a KMS key. Which combination of steps should the team take to achieve this?

Accepted Answer

Enable CloudTrail and configure it to deliver logs to an encrypted S3 bucket.. Option D is correct because CloudTrail logs API calls and can deliver them to an encrypted S3 bucket. Option A is wrong because CloudWatch Logs does not directly store logs in S3. Option B is wrong because Config records resource changes, not API calls. Option C is wrong because VPC Flow Logs capture network traffic, not API calls.

Answer

Enable AWS Config and have it deliver configuration history to an encrypted S3 bucket.

Answer

Enable CloudWatch Logs and stream logs to an encrypted S3 bucket.

Answer

Enable VPC Flow Logs and publish to an encrypted S3 bucket.

Question 15

A company has an S3 bucket that contains sensitive data. The bucket policy allows access only from a specific VPC endpoint. A security engineer notices that objects in the bucket are being deleted by an IAM user from outside the VPC. The engineer checks the bucket policy and confirms that the policy denies access if the request does not come from the VPC endpoint. However, the deletions continue. What is the most likely cause?

Accepted Answer

The IAM user is the bucket owner and the bucket policy does not apply to the owner.. Option B is correct because the bucket owner's account has full control over the bucket, and bucket policies do not override the owner's permissions. Option A is wrong because if the bucket policy were incorrect, it would not deny access. Option C is wrong because ACLs are not used here. Option D is wrong because the deletion is happening, so the user is not blocked by the policy.

Answer

The bucket policy is missing a Deny statement for the s3:DeleteObject action.

Answer

The VPC endpoint policy allows the deletion.

Answer

The bucket has an ACL that allows the IAM user to delete objects.

Question 16

A company has a security policy that requires all IAM users to use multi-factor authentication (MFA) when accessing the AWS Management Console. The company also wants to enforce this policy using an SCP. Which TWO conditions must be met for the SCP to be effective?

Accepted Answer

The SCP must use a condition that checks if MFA is present.. Options A and E are correct. The SCP must deny actions if the user has not authenticated with MFA (A), and the SCP must be attached to the root organizational unit (E) to apply to all accounts. Option B is wrong because the condition key aws:MultiFactorAuthPresent is the correct one. Option C is wrong because SCPs cannot enforce MFA registration; they can only deny access. Option D is wrong because MFA authentication is required for console access, not just API calls.

Answer

The SCP must use the condition key 'aws:SourceIp' to allow only MFA-enabled IPs.

Answer

The SCP must require users to register MFA devices before accessing the console.

Answer

The SCP must be attached to individual IAM users.

Question 17

A company wants to implement a least-privilege security model for its AWS environment. The security team has identified that many IAM users have overly permissive policies. The team wants to use AWS IAM Access Analyzer to identify policies that grant access to external principals. However, the team is not seeing any findings. What is the most likely reason?

Accepted Answer

IAM Access Analyzer is not enabled for the account.. Option A is correct because IAM Access Analyzer analyzes policies that grant access to external principals from the perspective of the account. If the analyzer is not enabled for the account, it will not generate findings. Option B is wrong because the analyzer works with existing policies. Option C is wrong because findings are generated for policies that grant access to external principals, not just security groups. Option D is wrong because IAM Access Analyzer does not require the organization to be enabled.

Answer

IAM Access Analyzer only analyzes S3 bucket policies, not IAM policies.

Answer

IAM Access Analyzer requires AWS Organizations to be enabled.

Answer

All policies are already least-privilege and do not grant access to external principals.

Question 18

A company is using AWS Organizations to manage multiple accounts. The security team wants to prevent the creation of Amazon EC2 instances with public IP addresses in all accounts. Which TWO actions should the team take to implement this control using Service Control Policies (SCPs)?

Accepted Answer

Create an SCP with a Deny effect for ec2:RunInstances where the request parameter ec2:AssociatePublicIpAddress is true.. Options B and D are correct. The SCP must deny the ec2:RunInstances action when the parameter for public IP is set to true (B), and it must be attached to the root organizational unit (D) to cover all accounts. Option A is wrong because SCPs cannot modify IAM permissions; they can only deny or allow actions. Option C is wrong because SCPs cannot enforce tagging; they can deny actions based on tags. Option E is wrong because the condition key for public IP is ec2:AssociatePublicIpAddress.

Answer

Use the condition key 'ec2:LaunchTemplate' to deny public IPs.

Answer

Create an SCP that adds an IAM policy to deny ec2:RunInstances.

Answer

Create an SCP that requires the tag 'PublicIP' to be set to 'false'.

Question 19

A company wants to ensure that all Amazon S3 buckets are encrypted at rest. Which THREE services can be used together to automatically remediate unencrypted S3 buckets?

Accepted Answer

Amazon EventBridge. Options A, C, and D are correct. AWS Config can detect unencrypted buckets (A), Amazon EventBridge can trigger a remediation action (C), and AWS Lambda can execute the remediation (D). Option B is wrong because S3 itself does not automatically remediate; it can be configured with default encryption but that is per-bucket. Option E is wrong because CloudTrail is for auditing, not remediation.

Answer

Amazon S3 default encryption

Answer

AWS CloudTrail

Question 20

A company uses AWS Organizations and wants to centrally manage CloudTrail trails across all accounts. Which feature should be enabled?

Accepted Answer

CloudTrail organization trail. Option B is correct because CloudTrail organization trails allow a single trail to log events for all accounts in the organization. Option A is wrong because CloudTrail does not support cross-account trails without organization trails. Option C is wrong because SCPs are for permissions, not logging. Option D is wrong because Config aggregators are for configuration compliance, not logging.

Answer

Cross-account CloudTrail

Answer

Service Control Policy for CloudTrail

Answer

AWS Config aggregator