SCS-C02 Practice Test 9 — 10 Questions

Question 1

A company is using AWS CloudTrail to log all management events and has enabled log file validation. What additional security benefit does log file validation provide?

Accepted Answer

It ensures the integrity of the log files by detecting tampering.. Log file validation uses a digital signature (SHA-256 hash) created for each log file, which is stored in a separate digest file. When validation is enabled, CloudTrail automatically creates a hash for each log file and signs it with a private key, allowing you to verify that the log files have not been modified, deleted, or tampered with after they were delivered. This ensures the integrity of the log files by detecting any unauthorized changes.

Answer

It prevents anyone from deleting the log files.

Answer

It encrypts the log files at rest.

Answer

It provides real-time monitoring for API calls.

Question 2

A company has a requirement to automatically rotate encryption keys for S3 objects every 90 days. They are using SSE-KMS with a customer managed key. Which action will meet the requirement without breaking access to existing objects?

Accepted Answer

Use S3 Batch Operations to re-encrypt existing objects with the new key. (S3 Batch Operations) allows re-encrypting existing objects with a new key without breaking access because the previous key remains available for decryption. Option E (Enable automatic key rotation in AWS KMS) rotates the key annually, not every 90 days, so it does not meet the requirement. No other combination of options fully satisfies the 90-day rotation requirement; thus only B is correct.

Answer

Configure an S3 lifecycle policy to re-encrypt objects

Answer

Manually rotate the key every 90 days and re-encrypt all objects

Answer

Delete the existing key and create a new one each 90 days

Answer

Enable automatic key rotation in AWS KMS for the customer managed key

Question 3

A security engineer is configuring an S3 bucket policy to restrict access to only requests that originate from a specific VPC endpoint. Which condition key should be used?

Accepted Answer

aws:SourceVpce. The aws:SourceVpce condition key is the correct choice because it evaluates the VPC endpoint ID (e.g., vpce-12345678) through which the request reached S3. When you attach a bucket policy that includes a condition like "aws:SourceVpce": "vpce-abc123", S3 only allows requests that traverse that specific endpoint, effectively locking the bucket to your private VPC endpoint and blocking all public internet access. This is the standard pattern for enforcing private-only access to S3 from a VPC.

Answer

aws:VpcSourceIp

Answer

aws:SourceVpc

Answer

aws:SourceIp

Question 4

A security engineer notices that a developer's IAM user has full administrator access. The engineer wants to implement the principle of least privilege for the developer. What is the best way to proceed?

Accepted Answer

Use IAM Access Advisor to review the developer's historical usage and create a custom policy that only includes the services and actions used.. The best way to implement least privilege is to use IAM Access Advisor to review the developer's historical usage and then create a custom policy that only includes the services and actions actually used. This approach is data-driven and ensures that the developer retains necessary permissions while removing unnecessary ones. It aligns with the principle of least privilege by tailoring permissions to actual needs.

Answer

Create a new IAM group with the AdministratorAccess policy and add the developer to the group.

Answer

Replace the AdministratorAccess policy with a managed job function policy such as PowerUserAccess.

Answer

Remove the administrative access and ask the developer to request permissions as needed.

Question 5

A company runs a web application on Amazon EC2 behind an Application Load Balancer (ALB). The security team wants to allow only traffic from the ALB to reach the EC2 instances. Which security group configuration should be used?

Accepted Answer

Allow inbound traffic from the ALB's security group ID on the EC2 security group.. Security groups can reference other security groups by ID. By setting an inbound rule on the EC2 security group that references the ALB's security group ID, only traffic originating from the ALB is allowed. This is the recommended approach as ALB private IP addresses are dynamic and can change, making IP-based rules (Option A) unreliable.

Answer

Allow inbound traffic from the ALB's private IP addresses on the EC2 security group.

Answer

Allow inbound traffic from the VPC CIDR block on the EC2 security group.

Answer

Allow inbound HTTP traffic from 0.0.0.0/0 on the EC2 security group.

Question 6

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that no IAM user in any account can create new IAM users. Which approach should be used?

Accepted Answer

Apply a service control policy (SCP) at the root organizational unit that denies IAM:CreateUser.. Service control policies (SCPs) are the correct mechanism because they allow you to centrally restrict permissions across all accounts in an AWS Organization. By attaching an SCP at the root organizational unit that denies the `iam:CreateUser` action, you ensure that no IAM user in any member account can create new IAM users, regardless of any IAM policies applied within those accounts. SCPs act as a guardrail that overrides any allow permissions granted by IAM policies.

Answer

Apply an IAM policy to the root user of each account.

Answer

Use an SCP attached to each IAM user.

Answer

Use an IAM permissions boundary on each IAM user.

Question 7

A security engineer is designing a network architecture for a multi-tier application. The web servers must be accessible from the internet, while the application servers must only be accessible from the web servers. Which TWO configurations should be used? (Choose TWO.)

Accepted Answer

Place the web servers in a public subnet with a route to an internet gateway.. Option B is correct because placing the web servers in a public subnet with a route to an internet gateway (0.0.0.0/0 → igw-xxxx) is exactly what makes them reachable from the internet, satisfying the requirement that web servers be internet-accessible. Option E is correct because referencing the web servers' security group as the source in the application servers' security group inbound rules enforces that only instances in that web security group can reach the application tier, which is the recommended, identity-based way to restrict access in a multi-tier design. Option A is not needed here: a NAT gateway provides outbound-only internet access for private subnets and does not control inbound access from the web tier, so it does not satisfy the stated requirement. Option C is not the best fit because network ACLs are stateless subnet-level filters based on CIDR ranges; while they can restrict traffic, they are not the mechanism that ties access to the web servers' identity, and the question asks for the configuration that limits application access to the web servers specifically. Option D is wrong because putting the application servers in a public subnet with an internet gateway route would expose them to the internet, directly violating the requirement that they be reachable only from the web servers.

Answer

Configure a NAT gateway in the private subnet for the application servers.

Answer

Use a network ACL on the application subnet to allow inbound traffic from the web subnet's IP range.

Answer

Place the application servers in a public subnet with a route to an internet gateway.

Question 8

A company wants to protect data at rest in Amazon S3 using client-side encryption. The application will run on Amazon EC2 instances. Which approach meets these requirements?

Accepted Answer

Use the AWS Encryption SDK to encrypt data before uploading to S3. Client-side encryption requires the encryption process to occur on the client side before data is uploaded to S3. The AWS Encryption SDK is designed for this purpose, allowing you to encrypt data locally on the EC2 instance using your own keys, ensuring that S3 never sees the plaintext data. This meets the requirement to protect data at rest with client-side encryption, as the data is encrypted before leaving the application environment.

Answer

Use SSE-S3 and rely on S3 to manage keys

Answer

Enable S3 default encryption on the bucket

Answer

Use SSE-KMS with a customer managed key

Question 9

A company uses Amazon GuardDuty and AWS Security Hub in a single AWS account. The security team has created a custom action in Security Hub to send findings to a custom Lambda function for automated response. The Lambda function is designed to take remediation actions based on the finding type. During testing, the team notices that the Lambda function is not being invoked when new findings are generated. The Lambda function's resource-based policy allows invocations from Security Hub, and the function's execution role has necessary permissions. What is the most likely reason for the failure?

Accepted Answer

No Amazon EventBridge rule is configured to send Security Hub findings to the Lambda function.. Security Hub custom actions do not automatically invoke a Lambda function. When a custom action is triggered, Security Hub publishes an event to the default EventBridge bus, and you must create an EventBridge rule that matches the custom action ARN and targets the Lambda function. Without that rule, the Lambda is never invoked, even though the resource-based policy and execution role are correctly configured.

Answer

GuardDuty is not enabled for all required resource types.

Answer

The Lambda function's execution role does not have permission to access GuardDuty.

Answer

The Lambda function's resource-based policy does not include Security Hub as a principal.

Question 10

A company uses AWS CloudTrail to log all API calls. The security team notices that some expected log entries are missing for actions performed by an IAM role assumed by an EC2 instance. The instance has the required permissions. What is the MOST likely cause of the missing log entries?

Accepted Answer

CloudTrail is not logging read-only API calls by default; the trail must be configured to log read events.. CloudTrail logs management events by default, but the trail can be configured to log only write events or only read events. If the trail is set to log only write events, read-only API calls (such as Describe* or Get* actions) made by the IAM role will not be recorded. Since the missing log entries are likely read operations, the lack of read event logging would result in missing entries. Option B correctly identifies this scenario.

Answer

The EC2 instance is in a VPC that has a VPC endpoint for CloudTrail, but the endpoint policy denies logging.

Answer

CloudTrail trail is not configured to log data events for EC2.

Answer

The IAM role used by the EC2 instance has a permissions boundary that excludes cloudtrail:PutLogEvents.