SCS-C02 Mock Exam 87 — 25 Questions

Question 1

A company uses AWS Systems Manager Patch Manager to apply patches to EC2 instances. The security team wants to ensure that instances are patched within 7 days of a patch release. Which service should be used to monitor and report compliance?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides continuous monitoring and evaluation of your AWS resource configurations, including patch compliance status via Systems Manager Patch Manager. You can create an AWS Config rule (e.g., 'ec2-managedinstance-patch-compliance-status') that checks whether instances have the required patches installed within a specified time frame (e.g., 7 days). AWS Config then reports noncompliant resources, enabling the security team to track and remediate patching gaps.

Answer

AWS Security Hub

Answer

Amazon Inspector

Answer

AWS Trusted Advisor

Question 2

A security engineer is designing a threat detection solution for a multi-account AWS environment. The engineer needs to detect and respond to suspicious API activity across all accounts. Which TWO services should be used together to achieve this? (Choose two.)

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious or unauthorized behavior across AWS accounts, including suspicious API activity. By enabling GuardDuty in all accounts and aggregating findings to a central administrator account, it provides the necessary detection layer for multi-account environments.

Answer

Amazon CloudWatch

Answer

Amazon Inspector

Answer

AWS Config

Question 3

A company wants to restrict access to an S3 bucket so that only requests from a specific VPC are allowed. Which policy should be used?

Accepted Answer

S3 bucket policy with aws:SourceVpc condition. Option C is correct because S3 bucket policies support the `aws:SourceVpc` condition key, which allows you to restrict access to requests originating from a specific VPC. This works by evaluating the VPC ID from which the request was made, using the source VPC information that AWS automatically includes in requests from VPC endpoints. No other mechanism (security groups, IAM source IP conditions, or network ACLs) can directly enforce VPC-level access control on S3.

Answer

Security group assigned to the S3 bucket

Answer

IAM policy with aws:SourceIp condition

Answer

Network ACL attached to the S3 bucket

Question 4

A company has a security group that allows inbound SSH from 0.0.0.0/0. The security team wants to restrict access to only the company's public IP range 203.0.113.0/24. What change should be made?

Accepted Answer

Modify the inbound SSH rule in the security group to source 203.0.113.0/24.. Option B is correct because security groups are stateful and act as a virtual firewall for instances. To restrict inbound SSH access from 0.0.0.0/0 to only the company's public IP range, you must modify the existing inbound rule's source CIDR from 0.0.0.0/0 to 203.0.113.0/24. This change directly updates the allowed source IP range, and since security groups evaluate all rules before making a decision, the more specific allowed range will take effect without needing additional rules.

Answer

Add a network ACL rule to deny SSH from 0.0.0.0/0.

Answer

Add a network ACL rule to allow SSH from 203.0.113.0/24.

Answer

Remove the inbound SSH rule from the security group.

Question 5

A company is designing a new AWS account structure using AWS Organizations. The security team wants to restrict the use of specific AWS services across all member accounts. Which feature should they use?

Accepted Answer

Service control policies (SCPs). Service control policies (SCPs) are the correct feature because they allow you to centrally restrict which AWS services and actions are permitted across all member accounts in an AWS Organization. SCPs act as a permission guardrail that applies to all IAM users, roles, and root users within the affected accounts, enabling the security team to enforce service restrictions without modifying individual account configurations.

Answer

AWS Single Sign-On (SSO)

Answer

AWS CloudTrail

Answer

AWS Identity and Access Management (IAM) cross-account roles

Question 6

Which TWO are IAM best practices? (Choose two.)

Accepted Answer

Use conditions in IAM policies to restrict access based on tags or IP addresses.. Option D is correct because using conditions in IAM policies (e.g., `aws:SourceIp`, `aws:RequestTag`) allows you to enforce fine-grained access control based on contextual attributes like IP addresses or resource tags. This follows the principle of least privilege by restricting permissions to only the necessary scope, reducing the attack surface. For example, you can deny access to S3 buckets unless the request originates from a corporate IP range.

Answer

Avoid using IAM roles and instead attach policies directly to users.

Answer

Use the root user for everyday administrative tasks.

Answer

Grant broad permissions to all users to simplify management.

Question 7

Which AWS service can be used to create a private network connection between a VPC and an on-premises data center over dedicated physical lines?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct service because it establishes a dedicated, private network connection from an on-premises data center to a VPC using physical Ethernet cables routed through an AWS Direct Connect location. This bypasses the public internet entirely, providing consistent latency, higher bandwidth, and a more reliable connection than internet-based options.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

VPC Peering

Question 8

Which of the following is a best practice for securing an AWS account root user?

Accepted Answer

Enable multi-factor authentication (MFA) and avoid using the root user.. Option B is correct because the AWS root user has unrestricted access to all AWS resources and services, making it a high-value target. Enabling multi-factor authentication (MFA) adds an extra layer of security beyond the password, and AWS best practices dictate that the root user should only be used for a limited set of tasks (e.g., changing account settings) and never for daily operations. This minimizes the attack surface and reduces the risk of compromise.

Answer

Create access keys for the root user and use them for API calls.

Answer

Use the root user for daily administrative tasks.

Answer

Share the root user password with the IT team for emergency access.

Question 9

A company is required to retain CloudTrail logs for 7 years for compliance. Which solution meets this requirement with the LEAST operational overhead?

Accepted Answer

Configure an S3 Lifecycle policy to transition logs to S3 Glacier Deep Archive after 90 days and expire after 7 years.. Option D is correct because it uses an S3 Lifecycle policy to automatically transition CloudTrail logs to S3 Glacier Deep Archive after 90 days (reducing storage costs) and then expire (delete) the objects after 7 years, meeting the retention requirement with zero ongoing operational effort. This is the least operational overhead solution as it is fully automated within S3, requiring no custom code, manual intervention, or additional services.

Answer

Store logs in CloudWatch Logs with a retention period of 7 years.

Answer

Configure CloudTrail to automatically delete logs older than 7 years.

Answer

Use an AWS Lambda function to delete logs older than 7 years.

Answer

Export logs to AWS Snowball for offline archival.

Question 10

A company runs a web application on Amazon EC2 behind an Application Load Balancer (ALB). The security team wants to allow only traffic from the ALB to reach the EC2 instances. Which security group configuration should be used?

Accepted Answer

Allow inbound traffic from the ALB's security group ID on the EC2 security group.. Option C is correct because security groups can reference each other by ID, allowing you to create a rule on the EC2 security group that permits inbound traffic only from the ALB's security group. This ensures that only traffic that has passed through the ALB can reach the EC2 instances, regardless of the ALB's IP addresses, which can change due to scaling or replacement.

Answer

Allow inbound traffic from the ALB's private IP addresses on the EC2 security group.

Answer

Allow inbound traffic from the VPC CIDR block on the EC2 security group.

Answer

Allow inbound HTTP traffic from 0.0.0.0/0 on the EC2 security group.

Question 11

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to download patches from the internet. Which combination of components provides a highly available, managed solution? (Select TWO.)

Accepted Answer

Add a route to the private subnet's route table pointing 0.0.0.0/0 to the NAT gateway.. Option A is correct because a NAT gateway enables outbound internet access for instances in a private subnet while preventing inbound connections from the internet. It is a managed AWS service that automatically scales and is highly available within a single Availability Zone. By adding a route for 0.0.0.0/0 to the NAT gateway in the private subnet's route table, traffic destined for the internet is forwarded to the NAT gateway, which then uses an internet gateway to reach the internet.

Answer

Launch a NAT instance in a public subnet.

Answer

Create a VPC endpoint for Amazon S3.

Answer

Attach an internet gateway to the VPC.

Question 12

A company is required to audit all changes to IAM policies. Which AWS service should be used to record these changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API activity in your AWS account, including all IAM policy changes made via the AWS Management Console, SDKs, CLI, or AWS services. Each event is captured as a CloudTrail event with details such as the identity making the request, the time of the request, and the request parameters, enabling a complete audit trail of IAM policy modifications.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

Amazon S3

Answer

IAM Access Analyzer

Question 13

A security engineer is configuring a VPC for a new application. Which TWO actions will improve network security? (Choose two.)

Accepted Answer

Use network ACLs to allow or deny traffic at the subnet level.. Option C is correct because network ACLs (NACLs) operate at the subnet level as a stateless firewall, allowing you to explicitly allow or deny inbound and outbound traffic based on rules (e.g., source/destination IP, port, protocol). This provides a critical layer of defense at the subnet boundary, complementing security groups. Option E is correct because security groups act as a stateful virtual firewall at the instance (ENI) level, controlling traffic based on allow rules only, which is essential for granular per-instance security.

Answer

Configure VPC endpoints to connect to AWS services privately.

Answer

Deploy a NAT gateway to allow outbound internet access.

Answer

Enable VPC Flow Logs to analyze traffic patterns.

Question 14

A company uses AWS Organizations with SCPs to restrict services. An administrator creates an SCP that denies access to EC2. A developer in a member account tries to launch an EC2 instance but fails. What is the most likely reason?

Accepted Answer

The SCP from the organization denies EC2. The correct answer is A because Service Control Policies (SCPs) in AWS Organizations act as a centralized governance mechanism that applies a deny effect across all IAM principals in member accounts. When an SCP explicitly denies access to EC2, it overrides any allow permissions at the account level, including those granted by IAM policies. The developer's launch attempt fails because the SCP's deny is evaluated before any account-level permissions, effectively blocking the action regardless of the developer's IAM role or user permissions.

Answer

The root user of the account has denied EC2

Answer

The developer's IAM permissions boundary blocks EC2

Answer

The EC2 instance has a resource-based policy denying access

Question 15

Which IAM entity can be used to grant temporary access to AWS resources for users from a different AWS account?

Accepted Answer

IAM role. An IAM role is the correct entity because it is specifically designed to grant temporary, cross-account access to AWS resources. When a user from a different AWS account assumes a role, AWS STS (Security Token Service) issues temporary security credentials (access key, secret key, and session token) that are valid for a configurable duration (default 1 hour, max 12 hours). This avoids the need to create permanent IAM users or share long-term credentials across accounts.

Answer

IAM group

Answer

IAM policy

Answer

IAM user

Question 16

A security engineer needs to ensure that an Amazon RDS database instance is not accessible from the internet. Which configuration step will achieve this?

Accepted Answer

Set the DB instance to be not publicly accessible and place it in a private subnet.. Option C is correct because setting a DB instance to be not publicly accessible ensures that it does not receive a public IP address, and placing it in a private subnet (one without a route to an internet gateway) prevents any direct inbound or outbound traffic from the internet. This combination guarantees that the RDS instance is isolated from the public internet, aligning with the security requirement.

Answer

Deploy the DB instance in a multi-AZ configuration.

Answer

Set the DB instance to be publicly accessible and restrict security group inbound rules.

Answer

Use the default VPC security group for the DB instance.

Question 17

Which THREE are best practices for securing IAM in an AWS environment? (Choose THREE.)

Accepted Answer

Use IAM roles for applications running on EC2.. Option A is correct because using IAM roles for EC2 instances eliminates the need to store long-term AWS credentials (access keys) on the instance. Instead, the instance assumes the role via the EC2 metadata service, which automatically rotates temporary security credentials (via AWS STS). This follows the principle of least privilege and reduces the risk of credential leakage.

Answer

Use the AWS account root user for daily administrative tasks.

Answer

Grant broad permissions to simplify management.

Question 18

A company wants to encrypt data at rest for an Amazon S3 bucket. Which action should be taken?

Accepted Answer

Enable default encryption on the S3 bucket.. Enabling default encryption on the S3 bucket ensures that all objects stored in the bucket are automatically encrypted at rest using server-side encryption (SSE-S3, SSE-KMS, or SSE-C). This meets the requirement for encrypting data at rest without requiring any client-side changes, as the encryption is applied by S3 upon write.

Answer

Use client-side encryption before uploading objects.

Answer

Enable SSL/TLS for the bucket.

Answer

Use AWS CloudHSM to encrypt the bucket.

Question 19

A company wants to protect its Amazon EC2 instances from distributed denial-of-service (DDoS) attacks at the network layer. Which AWS service should be used?

Accepted Answer

AWS Shield Advanced. AWS Shield Advanced provides enhanced protections for Amazon EC2 instances against network-layer (Layer 3/4) DDoS attacks, such as SYN floods, UDP reflection attacks, and other volumetric attacks. It includes always-on traffic monitoring, automated mitigation, and access to the DDoS Response Team (DRT) for custom mitigations, making it the correct choice for network-layer DDoS protection.

Answer

Amazon CloudFront

Answer

Amazon GuardDuty

Answer

AWS WAF

Question 20

A security engineer is designing a secure VPC architecture. Which THREE components should be used to implement defense in depth? (Choose three.)

Accepted Answer

Security groups. Security groups (C) are stateful virtual firewalls that control inbound and outbound traffic at the instance level. They operate at the network interface (ENI) level, allowing only explicitly permitted traffic and automatically allowing return traffic for permitted sessions. This provides a critical layer of host-level defense within the VPC.

Answer

VPN connection

Answer

Internet gateway