SCS-C02 Practice Test 9 — 10 Questions

Question 1

Refer to the exhibit. An AWS Config rule 's3-bucket-ssl-requests-only' evaluates whether S3 buckets deny HTTP requests. The exhibit shows the evaluation result and the bucket policy. Why is the bucket marked as NON_COMPLIANT despite having a Deny policy for HTTP requests?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The bucket policy is missing the 'aws:SecureTransport': 'false' condition for the bucket resource (without /*).. The Config rule likely evaluates the bucket-level policy. The current policy only denies HTTP requests to objects (/*), not to the bucket itself. To be compliant, the bucket must also have a Deny for the bucket resource ARN without the /*.

Answer

The policy uses 'Deny' but the rule expects an 'Allow' statement for HTTPS only.

Answer

The bucket policy only denies HTTP requests to objects, not to the bucket itself.

Answer

The annotation says 'Bucket does not have a policy that denies HTTP requests.' but the policy does have one, so this is a false positive.

Question 2

A security team wants to detect and alert on potential security threats such as compromised instances or malicious activity within their AWS environment. Which TWO AWS services should be used together to provide comprehensive threat detection?

Accepted Answer

AWS Security Hub. Amazon GuardDuty (Option E) is a threat detection service that continuously monitors for malicious activity and unauthorized behavior using machine learning, anomaly detection, and integrated threat intelligence feeds. AWS Security Hub (Option A) aggregates findings from GuardDuty and other services, applies automated compliance checks, and enables centralized alerting and response. Together, they provide comprehensive threat detection by combining GuardDuty's raw threat detection with Security Hub's aggregation and orchestration capabilities.

Answer

AWS CloudTrail

Answer

Amazon Inspector

Answer

AWS Config

Question 3

A company runs a multi-account AWS environment using AWS Organizations. The security team needs to implement centralized logging for all AWS CloudTrail events across all accounts. They create a new trail in the management account with the following configuration: trail name 'central-trail', apply to all accounts in the organization, enable data events for all S3 buckets, and store logs in a centralized S3 bucket. After one week, they notice that some accounts are not delivering CloudTrail logs to the central bucket. The security engineer verifies that the trail is still configured to apply to all accounts and that the S3 bucket policy allows cross-account access. What is the MOST likely reason for the missing logs?

Accepted Answer

Some accounts were added to the organization after the trail was created, and the trail was not updated to include them. When a trail is created in the management account with 'apply to all accounts in the organization', it automatically includes all current member accounts. However, if new accounts are added to the AWS Organization after the trail is created, the trail does not automatically extend to those new accounts. The trail must be updated (e.g., via the CloudTrail console or API) to include the newly added accounts, or the organization trail feature must be re-enabled. This is why logs from accounts added after trail creation are missing.

Answer

The member accounts have not enabled CloudTrail Insights

Answer

The S3 bucket policy does not grant the correct permissions to the member accounts

Answer

The trail is not configured as a multi-region trail

Question 4

A startup is building a web application on AWS and needs to protect sensitive customer data at rest in an Amazon RDS for MySQL database. The compliance team requires that the encryption keys be managed by the company's on-premises hardware security module (HSM) and be rotated every 6 months. Which solution should the startup use?

Accepted Answer

Use AWS CloudHSM to store the encryption keys and enable RDS encryption with CloudHSM.. AWS CloudHSM provides a dedicated hardware security module (HSM) that allows you to manage encryption keys on-premises-style, meeting the requirement for key management on the company's own HSM. When you enable Amazon RDS for MySQL encryption with CloudHSM, the database encryption keys are stored and managed in the CloudHSM cluster, and you can rotate them every 6 months as required. This solution directly satisfies the compliance team's mandate for on-premises HSM key management and periodic rotation.

Answer

Use AWS KMS with a customer master key (CMK) and import key material from the on-premises HSM.

Answer

Store the encryption keys in AWS Secrets Manager and use them to encrypt the database.

Answer

Use AWS KMS with a custom key store backed by AWS CloudHSM.

Question 5

A company needs to protect data at rest in Amazon S3. Which THREE server-side encryption mechanisms can be used to encrypt objects stored in S3?

Accepted Answer

Server-Side Encryption with S3-Managed Keys (SSE-S3). Server-Side Encryption with S3-Managed Keys (SSE-S3), Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS), and Server-Side Encryption with Customer-Provided Keys (SSE-C) are the three server-side encryption mechanisms for Amazon S3. Client-side encryption (option C) encrypts data before upload and is also a valid method to protect data at rest, but it is not a server-side mechanism. Option D (SSE-IAM) is not a real feature. Thus, the correct choices are A, B, and E.

Answer

Client-Side Encryption

Answer

Server-Side Encryption with IAM-Managed Keys (SSE-IAM)

Question 6

A company has a critical application that stores sensitive data in Amazon DynamoDB. The security team requires that all data stored in DynamoDB is encrypted at rest using a customer-managed KMS key. Additionally, they want to ensure that the key can be rotated automatically every year. Which combination of actions should be taken?

Accepted Answer

Use a customer-managed KMS key and enable automatic key rotation. DynamoDB supports encryption at rest with a customer-managed KMS key, and KMS supports automatic annual rotation for customer-managed keys. Option A is wrong because DynamoDB does not use CloudHSM. Option C is wrong because automatic rotation is not available for AWS managed keys (which DynamoDB uses by default). Option D is wrong because you cannot enable encryption on a table created without encryption except by recreating it.

Answer

Use a CloudHSM key store and enable automatic rotation

Answer

Use an AWS managed KMS key and enable automatic key rotation

Answer

Enable encryption on the existing DynamoDB table and use a customer-managed KMS key

Question 7

A large enterprise uses AWS Organizations to manage multiple accounts. The security team has implemented a Service Control Policy (SCP) at the root level that denies all actions unless the request originates from the corporate IP range (10.0.0.0/8). Recently, a developer in a member account tried to launch an EC2 instance from the AWS Management Console while connected via a VPN that provides an IP address within the corporate range. However, the launch failed with an 'AccessDenied' error. The developer is using an IAM user with full EC2 permissions (ec2:*). The SCP is as follows: {"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"*","Resource":"*","Condition":{"NotIpAddress":{"aws:SourceIp":"10.0.0.0/8"}}}]}. What is the MOST likely reason for the failure?

Accepted Answer

The aws:SourceIp condition key does not work correctly for requests made via the AWS Management Console because the console may use a different IP.. The SCP uses the aws:SourceIp condition, but when accessing the Management Console, the IP address seen by AWS is the console's IP, which may not be the same as the developer's VPN IP if the console uses a proxy or if the VPN is configured incorrectly. Option A is wrong because SCPs affect all principals, including the root user. Option B is wrong because the SCP denies actions, not allows them; an explicit deny overrides allows. Option D is wrong because the SCP denies all actions, so even if the developer has permissions, the SCP denies them.

Answer

The SCP allows actions only from the specified IP range, but the developer's IP is not in that range.

Answer

The SCP does not apply to IAM users in member accounts; it only applies to the root user.

Answer

The IAM user does not have the necessary permissions because the SCP explicitly denies all actions.

Question 8

Which THREE actions should be taken when preserving forensic evidence from an EC2 instance during an incident? (Select THREE.)

Accepted Answer

Create an EBS snapshot of all volumes.. Creating an EBS snapshot preserves the exact state of the volume at the time of the incident, including any malicious files, logs, or artifacts. This snapshot can be used for offline forensic analysis without altering the original evidence. AWS recommends this as a first step in forensic acquisition to maintain chain of custody.

Answer

Reboot the instance to clear any malicious processes.

Answer

Terminate the instance to prevent further compromise.

Question 9

A security engineer applies the bucket policy shown in the exhibit to an S3 bucket. What is the effect of this policy?

Accepted Answer

Allows uploads only if they use SSE-KMS.. The bucket policy includes a Deny statement that restricts uploads based on encryption headers. Specifically, it denies requests where the x-amz-server-side-encryption header is not set to 'aws:kms' or where the x-amz-server-side-encryption-aws-kms-key-id is missing. This effectively allows only uploads that use SSE-KMS. Therefore, Option D is correct.

Answer

Allows uploads only if they use SSE-S3.

Answer

Allows uploads without encryption.

Answer

Allows uploads with any server-side encryption.

Question 10

A security engineer notices that an IAM role used by an EC2 instance is generating a large number of API calls to an S3 bucket that is not part of the company's account. Which AWS service should be used to detect and alert on this suspicious activity?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is the correct service because it uses machine learning and anomaly detection to analyze AWS CloudTrail management and data events, VPC Flow Logs, and DNS logs. It can detect unusual API calls, such as an EC2 instance role making a high volume of requests to an S3 bucket outside the company's account, which is a classic indicator of compromised credentials or data exfiltration. GuardDuty generates findings and can integrate with Amazon CloudWatch Events to trigger alerts or automated remediation.

Answer

AWS CloudTrail

Answer

Amazon Inspector

Answer

AWS Config