SCS-C02 Mock Exam 92 — 25 Questions

Question 1

A startup uses a single AWS account for development. The security engineer wants to detect if any EC2 instances have been compromised and are performing reconnaissance by probing open ports on other internal instances. The engineer has enabled VPC Flow Logs for all subnets. What is the most cost-effective way to detect this behavior?

Accepted Answer

Enable Amazon GuardDuty and review the findings.. Amazon GuardDuty is a managed threat detection service that uses machine learning and integrated threat intelligence to analyze VPC Flow Logs, DNS logs, and other data sources. It can automatically detect reconnaissance behavior such as port probing or port scanning from compromised EC2 instances without requiring any additional infrastructure or manual query setup. This makes it the most cost-effective solution because it operates on a pay-per-volume basis and eliminates the need for custom log analysis or per-instance agents.

Answer

Install a third-party intrusion detection system on each EC2 instance.

Answer

Use Amazon CloudWatch Logs Insights to query VPC Flow Logs for rejected traffic patterns.

Answer

Use AWS Config rules to check for security group changes.

Question 2

A company uses AWS Lambda functions to process sensitive data. The security team wants to ensure that if a Lambda function is compromised, the attacker cannot use the function's IAM role to access other AWS resources. The team has implemented the principle of least privilege by restricting the IAM role's permissions. However, they are concerned about a scenario where an attacker could use the Lambda function to execute AWS API calls that are not intended by the application. What additional measure should the team implement to reduce the risk of such lateral movement?

Accepted Answer

Use AWS IAM Access Analyzer to generate and refine the IAM policy based on actual usage.. Option A is correct because AWS IAM Access Analyzer can generate IAM policies based on the actual API calls made by the Lambda function over a specified period. By reviewing and refining the policy to include only those actions, the team can further tighten least privilege beyond manual estimation, reducing the risk that an attacker could abuse unintended API calls. This directly addresses the concern of lateral movement by ensuring the function's role cannot perform actions not observed in normal operation.

Answer

Enable AWS CloudTrail data events for the Lambda function.

Answer

Attach a service control policy (SCP) that denies all actions except those explicitly allowed.

Answer

Place the Lambda function inside a VPC with no internet access.

Question 3

A company uses Amazon RDS for MySQL with automated backups enabled. The security team suspects that a database administrator (DBA) with full RDS access has exfiltrated data by creating a snapshot of the database and sharing it with an external AWS account. The team wants to detect such exfiltration in the future. Which step should the team take to detect and alert on snapshot sharing?

Accepted Answer

Create an Amazon EventBridge rule that triggers on the `ModifyDBSnapshotAttribute` API call and sends an alert via Amazon SNS.. Option C is correct because the `ModifyDBSnapshotAttribute` API call is the specific action used to share an RDS snapshot with an external AWS account. By creating an Amazon EventBridge rule that triggers on this API call, the team can immediately send an alert via Amazon SNS, enabling real-time detection and response to unauthorized snapshot sharing. This approach is automated, event-driven, and directly targets the exfiltration vector.

Answer

Use AWS Config to detect changes to RDS snapshot attributes.

Answer

Enable Amazon GuardDuty with RDS Protection.

Answer

Enable AWS CloudTrail and review logs manually.

Question 4

A company uses AWS CloudFormation to deploy infrastructure. During a security incident, the security team needs to quickly capture a point-in-time snapshot of the entire environment for forensic analysis. The environment includes EC2 instances, RDS databases, and EBS volumes. What is the fastest way to preserve the state of the environment?

Accepted Answer

Create EBS snapshots of all EC2 instances and RDS snapshots of all databases.. Option C is correct because creating EBS snapshots of EC2 instances and RDS snapshots of databases captures point-in-time, crash-consistent copies of the underlying block storage, preserving the exact disk state for forensic analysis. This is the fastest method as snapshots are incremental and initiated asynchronously, allowing the environment to remain operational while the snapshot is being created.

Answer

Create Amazon Machine Images (AMIs) of all EC2 instances.

Answer

Enable AWS CloudTrail and start logging.

Answer

Export the CloudFormation stack template.

Question 5

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The security team receives an alert from Amazon GuardDuty that one of the EC2 instances is generating outbound traffic to a known command-and-control (C2) IP address. The instance is part of an Auto Scaling group (ASG) with a minimum of 2 and maximum of 10 instances. The security incident response playbook instructs the team to isolate the compromised instance without affecting the application's availability. The team needs to preserve the instance for forensic analysis. Which action should the team take first?

Accepted Answer

Remove the instance from the ALB target group and attach a security group that denies all traffic.. Option D is correct because removing the instance from the ALB target group immediately stops new traffic from reaching the application, while attaching a security group that denies all traffic (e.g., a custom security group with no inbound/outbound rules) effectively isolates the instance at the network layer. This preserves the instance for forensic analysis and does not affect application availability, as the ASG will not automatically terminate the instance (since it is still running and healthy from the ASG's perspective). The ALB will continue to route traffic to the remaining healthy instances in the target group, maintaining service continuity.

Answer

Terminate the compromised EC2 instance and allow the ASG to launch a replacement.

Answer

Detach the EBS root volume from the instance and attach it to a forensic instance.

Answer

Shut down the instance from within the OS using AWS Systems Manager Run Command.

Question 6

A company has an S3 bucket that stores sensitive data. The bucket policy allows access only from a specific VPC endpoint. A security engineer notices that an EC2 instance in the same VPC can access the bucket, but an instance in a peered VPC cannot. Both instances have the same IAM role attached. The VPC endpoint is in the first VPC and is shared via a transit gateway. What is the MOST likely reason the second instance cannot access the bucket?

Accepted Answer

The bucket policy condition on aws:sourceVpce does not match requests from the peered VPC.. Option D is correct. The bucket policy condition aws:sourceVpce checks the VPC endpoint ID. If the request comes from a peered VPC, it does not go through the VPC endpoint; it goes through the transit gateway, so the condition fails. Option A is wrong because IAM policies are not the issue. Option B is wrong because the transit gateway does not inherently block S3. Option C is wrong because VPC peering does not automatically provide access to the endpoint.

Answer

The IAM role does not have permissions for the second instance.

Answer

The VPC endpoint is not accessible from the peered VPC.

Answer

The transit gateway does not support S3 traffic.

Question 7

A company uses IAM roles for EC2 instances to access DynamoDB. The security team wants to ensure that the instances can only access specific DynamoDB tables. They create an IAM policy that allows dynamodb:GetItem and dynamodb:PutItem on the specific table ARN. The policy is attached to the instance role. However, when an application on the instance tries to read from the table, it receives an 'AccessDeniedException'. The application is using the correct table name. What is the MOST likely cause?

Accepted Answer

The policy does not include dynamodb:DescribeTable action.. Option B is correct. DynamoDB requires the user to have permission on the table ARN, but also on the index ARN if using indexes. However, the most common mistake is that the policy does not allow the necessary actions like dynamodb:DescribeTable, which is often required by SDKs. Option A is wrong because the policy is attached. Option C is wrong because the instance profile is correct. Option D is wrong because the role is not about encryption.

Answer

The IAM policy is not attached to the instance profile.

Answer

The DynamoDB table is encrypted with a customer managed key that the role does not have access to.

Answer

The instance does not have the required instance profile associated.

Question 8

A company is migrating its on-premises file server to Amazon EFS. The data includes sensitive financial records. The security team requires encryption at rest and in transit. The team plans to mount the EFS file system on EC2 instances using the NFS client. They have enabled encryption at rest on the EFS file system. However, they are unsure how to enforce encryption in transit. What should they do to ensure all data transferred between the EC2 instance and EFS is encrypted?

Accepted Answer

Mount the EFS file system using the `mount -t nfs4 -o tls` command on the EC2 instance.. Option B is correct. To enforce encryption in transit for EFS, you must use the `mount` command with the `tls` option. This ensures the NFS client uses TLS encryption. Option A is wrong because enabling encryption in transit in the EFS console only allows it, but the client must also request it. Option C is wrong because VPC Peering does not encrypt traffic. Option D is wrong because AWS Certificate Manager is not used for EFS encryption in transit.

Answer

Enable encryption in transit in the EFS file system policy and rely on the default NFS client behavior.

Answer

Set up a VPN connection between the VPC and the on-premises network to encrypt all traffic.

Answer

Use AWS Certificate Manager to issue a certificate for the EFS file system.

Question 9

A company uses Amazon SQS to decouple its microservices. The messages contain personally identifiable information (PII). The security team requires that all messages be encrypted at rest. Currently, SQS is configured with SSE enabled using a customer managed KMS key. However, the team discovers that some messages are still being stored in plaintext in the dead-letter queue (DLQ) after the maximum receives are exceeded. The DLQ is also an SQS queue. What is the MOST likely reason?

Accepted Answer

The DLQ does not have SSE enabled, so messages are stored in plaintext.. Option D is correct. If the DLQ does not have SSE enabled, or if it uses a different KMS key that is not accessible, messages may be stored in plaintext. Option A is wrong because KMS key policy does not affect encryption of the source queue if the DLQ is not encrypted. Option B is wrong because the DLQ is a separate queue; the source queue's encryption does not apply to it. Option C is wrong because the source queue is already encrypted; the issue is the DLQ.

Answer

The source queue's SSE is configured with AWS managed KMS key, which does not support cross-account DLQ.

Answer

The source queue's SSE configuration uses a different KMS key than the DLQ, causing decryption failure.

Answer

The KMS key policy does not allow the SQS service to decrypt the messages before moving them to the DLQ.

Question 10

A company has an AWS account with multiple S3 buckets that contain sensitive data. The security team wants to ensure that no public access is granted to any bucket. The team has enabled AWS Config and set up a rule to detect public buckets. The rule reports that all buckets are compliant. However, during a security review, a team member finds that one bucket has a bucket policy that grants 's3:GetObject' to 'Principal': '*'. Why did the AWS Config rule not detect this?

Accepted Answer

The AWS Config rule only checks ACLs, not bucket policies.. Option A is correct. The AWS Config managed rule 's3-bucket-public-read-prohibited' checks for public read access via ACLs, not bucket policies. To detect public access via bucket policies, a custom rule is needed. Option B is wrong because CloudTrail would log access, not detect compliance. Option C is wrong because SCPs are for Organizations. Option D is wrong because IAM Access Analyzer analyzes resource-based policies but does not enforce.

Answer

AWS CloudTrail must be enabled for Config to evaluate policies.

Answer

The bucket is in a different AWS account.

Answer

IAM Access Analyzer must be enabled first.

Question 11

A financial services company runs a critical application on Amazon EC2 instances in a VPC. The application processes sensitive financial data and must meet strict compliance requirements. The security team recently discovered that an EC2 instance was compromised due to an unpatched vulnerability. The attacker used the instance's IAM role to access an S3 bucket containing customer data and exfiltrated the data. The security team needs to prevent such incidents in the future. They have implemented the following controls: 
- All EC2 instances are launched in private subnets. 
- The IAM roles used by EC2 instances follow the principle of least privilege. 
- Security groups restrict inbound and outbound traffic. 
- AWS Systems Manager Patch Manager is used to patch instances. 
- AWS CloudTrail is enabled and logs are sent to a centralized S3 bucket. 
- Amazon GuardDuty is enabled.

Despite these controls, the team is concerned about the blast radius if an instance is compromised again. Which additional measure would MOST effectively limit the blast radius of a compromised EC2 instance?

Accepted Answer

Use S3 VPC Endpoints with a bucket policy that only allows access from the VPC endpoint, and use Systems Manager Session Manager instead of SSH.. Option B is correct because using an S3 VPC endpoint with a bucket policy that restricts access exclusively to that endpoint ensures that compromised EC2 instances can only reach S3 through the VPC endpoint, preventing data exfiltration over the internet. Additionally, replacing SSH with Systems Manager Session Manager eliminates the need for open inbound SSH ports and provides fine-grained access control through IAM, reducing the attack surface and blast radius.

Answer

Enable VPC Flow Logs to monitor traffic to S3.

Answer

Deploy AWS WAF in front of the S3 bucket.

Answer

Create an AWS Config rule to detect S3 access from EC2 instances.

Question 12

A company has a single AWS account with multiple IAM users. The administrator created an IAM policy that allows all users to launch EC2 instances, but only if they use a specific AMI ID (ami-12345678) and a specific instance type (t3.micro). The policy uses a condition that checks the EC2 instance type and AMI ID. However, a user is able to launch an EC2 instance with a different AMI ID and a larger instance type. The administrator reviews the policy and confirms that the condition is correctly written. What is the most likely reason that the policy is not working as expected?

Accepted Answer

The condition keys used (ec2:InstanceType and ec2:ImageId) are not supported for the RunInstances action in IAM policies.. Option A is correct because the `ec2:InstanceType` and `ec2:ImageId` condition keys are not supported for the `ec2:RunInstances` action in IAM policies. AWS IAM condition keys for EC2 are action-specific, and for RunInstances, only certain keys like `ec2:InstanceType` and `ec2:ImageId` are actually supported in the request context. However, the key detail is that `ec2:ImageId` is not a valid condition key for RunInstances; the correct key is `ec2:ImageId` is not listed in the AWS documentation for RunInstances, meaning the condition is silently ignored, allowing any AMI and instance type.

Answer

The policy is attached to the user but must also be attached to the IAM group.

Answer

The policy does not include an explicit deny statement for non-compliant launches.

Answer

The condition is written incorrectly; it should use StringLike instead of StringEquals.

Question 13

A healthcare company runs a HIPAA-compliant application on AWS. The application uses Amazon S3 to store Protected Health Information (PHI). The company has implemented the following controls: (1) All S3 buckets are configured with default encryption using SSE-S3. (2) Bucket policies restrict access to only authorized IAM roles. (3) S3 access logs are enabled and sent to a centralized logging account. (4) MFA Delete is enabled on all buckets. (5) Object lock is not enabled. Recently, an internal auditor discovered that when an authorized user deletes an object, the object is permanently deleted and cannot be recovered. The company's data retention policy requires that deleted PHI be recoverable for at least 30 days after deletion. A review of the IAM policies shows that users have s3:DeleteObject permission. The auditor also notes that the bucket versioning is not enabled. The security team needs to implement a solution that allows authorized users to delete objects but ensures that deleted objects can be recovered within 30 days. Which of the following is the MOST effective course of action?

Accepted Answer

Enable S3 Versioning on the buckets and ensure that the IAM policies include s3:DeleteObjectVersion where appropriate.. Enabling S3 Versioning is the most effective solution because it preserves all object versions, including deleted objects (which become delete markers). With versioning enabled, authorized users can still use s3:DeleteObject to delete the current version, but the previous versions remain recoverable. Since the requirement is to recover deleted PHI within 30 days, versioning combined with a lifecycle policy to permanently delete old versions after 30 days would meet the retention policy without blocking immediate deletion.

Answer

Enable S3 Object Lock in Governance mode with a retention period of 30 days.

Answer

Remove the s3:DeleteObject permission from all IAM policies and use S3 Lifecycle policies to expire objects after 30 days.

Answer

Change the default encryption from SSE-S3 to SSE-C and use a separate key for each object.

Question 14

A company has a three-tier web application running on AWS. The application consists of an Application Load Balancer (ALB), an EC2 Auto Scaling group for web servers, and an RDS MySQL database. The Security team recently discovered that the database is publicly accessible from the internet. They need to remediate this immediately while minimizing downtime. The database is critical for the application, and the application must remain available. The team has identified that the database security group currently allows inbound traffic from 0.0.0.0/0 on port 3306. The web servers are in a security group named 'web-sg'. The database security group is named 'db-sg'. The team wants to restrict access to only the ALB and the web servers. Which action should the team take to resolve the issue with the least downtime?

Accepted Answer

Modify the inbound rule of the db-sg security group to allow traffic from the web-sg security group on port 3306 and remove the rule allowing traffic from 0.0.0.0/0.. Option B is correct because modifying the db-sg security group to allow inbound traffic from the web-sg security group (instead of 0.0.0.0/0) on port 3306 directly restricts database access to only the web servers. This change is applied immediately without requiring any resource recreation or downtime, as security group rules are stateful and take effect in real time. Removing the overly permissive rule eliminates the public exposure while keeping the existing database endpoint and application connectivity intact.

Answer

Create a new security group that allows inbound traffic from the web-sg security group on port 3306, then attach the new security group to the database instance.

Answer

Update the network ACL for the database subnet to deny inbound traffic from 0.0.0.0/0 on port 3306.

Answer

Move the RDS instance to a private subnet and update the application's database endpoint to use the new private IP address.

Question 15

A company uses Amazon S3 to store sensitive documents. The security engineer notices that an S3 bucket named 'documents-prod' has been configured with a bucket policy that allows s3:PutObject from any principal, but only if the request includes the x-amz-server-side-encryption header set to 'AES256'. The company's security policy requires that all objects be encrypted at rest using server-side encryption with AWS KMS (SSE-KMS). The engineer needs to ensure that any new objects uploaded to the bucket are encrypted with SSE-KMS, and that existing objects remain accessible. What should the engineer do?

Accepted Answer

Update the bucket policy to require the x-amz-server-side-encryption header set to 'aws:kms' and specify the desired KMS key ARN. Option C is correct because adding a condition for KMS encryption to the bucket policy will enforce SSE-KMS for future uploads, and existing objects are still decryptable. Option A is wrong because changing default encryption does not enforce the policy. Option B is wrong because it ignores existing objects. Option D is wrong because it only affects future uploads via a specific encryption key, not the enforcement.

Answer

Create a new bucket with a bucket policy that requires SSE-KMS, and migrate all objects using S3 Batch Operations

Answer

Modify the bucket's default encryption configuration to use SSE-KMS

Answer

Enable S3 Object Lock on the bucket to prevent overwrites, and use a lifecycle policy to expire objects that are not encrypted with SSE-KMS

Question 16

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer. The application uses an Amazon RDS for MySQL database. The security team requires that all data in transit between the EC2 instances and the database be encrypted. The database is in a private subnet. The EC2 instances are in a public subnet. The security team also wants to minimize latency. What should be done to meet these requirements?

Accepted Answer

Enable SSL/TLS on the RDS instance and configure the application to use encrypted connections. Option B is correct because enabling SSL/TLS on the RDS instance and requiring encrypted connections from the application encrypts data in transit. Option A is wrong because RDS does not natively support IPsec VPN. Option C is wrong because using a NAT gateway adds latency and does not encrypt the database connection. Option D is wrong because AWS Certificate Manager is for load balancers and CloudFront, not for database connections.

Answer

Use AWS Certificate Manager to issue a certificate for the RDS endpoint

Answer

Set up a VPN connection between the EC2 instances and the RDS instance using an IPsec VPN

Answer

Place the EC2 instances and RDS in the same subnet and use a NAT gateway

Question 17

A company runs a critical web application on a fleet of EC2 instances behind an Application Load Balancer (ALB). The application uses an Aurora MySQL database. The security team receives an alert from Amazon GuardDuty that a specific EC2 instance is exhibiting behavior consistent with a cryptocurrency mining attack, including outbound connections to known mining pools. The instance is part of an Auto Scaling group that uses a launch template with a security group that allows outbound HTTPS traffic to 0.0.0.0/0. The security engineer needs to contain the incident while minimizing downtime for the application. The engineer has already taken a forensic snapshot of the instance's EBS volume. Which course of action should the engineer take next?

Accepted Answer

Modify the security group attached to the instance to deny all outbound traffic, and let Auto Scaling launch a replacement instance.. Option A is correct because modifying the security group to deny all outbound traffic immediately stops the cryptocurrency mining communication to known mining pools without terminating the instance, preserving forensic data. The Auto Scaling group will detect the instance's health check failure (due to the application becoming unreachable) and automatically launch a replacement instance, minimizing downtime. This approach contains the incident while allowing the application to recover through the Auto Scaling group's self-healing mechanism.

Answer

SSH into the instance and run a script to kill the mining process.

Answer

Detach the instance from the Auto Scaling group and isolate it by removing all security group rules.

Answer

Immediately terminate the compromised EC2 instance and allow Auto Scaling to launch a new instance.

Question 18

A company runs a multi-account AWS environment using AWS Organizations. The security team needs to implement centralized logging for all AWS CloudTrail events across all accounts. They create a new trail in the management account with the following configuration: trail name 'central-trail', apply to all accounts in the organization, enable data events for all S3 buckets, and store logs in a centralized S3 bucket. After one week, they notice that some accounts are not delivering CloudTrail logs to the central bucket. The security engineer verifies that the trail is still configured to apply to all accounts and that the S3 bucket policy allows cross-account access. What is the MOST likely reason for the missing logs?

Accepted Answer

Some accounts were added to the organization after the trail was created, and the trail was not updated to include them. When a trail is created in the management account with 'apply to all accounts in the organization', it automatically includes all current member accounts. However, if new accounts are added to the AWS Organization after the trail is created, the trail does not automatically extend to those new accounts. The trail must be updated (e.g., via the CloudTrail console or API) to include the newly added accounts, or the organization trail feature must be re-enabled. This is why logs from accounts added after trail creation are missing.

Answer

The member accounts have not enabled CloudTrail Insights

Answer

The S3 bucket policy does not grant the correct permissions to the member accounts

Answer

The trail is not configured as a multi-region trail

Question 19

A company has a multi-account AWS Organization with three accounts: Management, Development, and Production. The Security team uses the Management account to manage IAM policies centrally. They have created a service control policy (SCP) named 'RestrictRootAccess' that denies all actions for the root user in all accounts. The SCP is attached to the root organizational unit. The Development account has an IAM role 'DevAdmin' with full administrator access via an IAM policy. The role's trust policy allows the Management account's 'SecurityAudit' role to assume it. A security engineer in the Management account assumes the 'SecurityAudit' role and then tries to assume the 'DevAdmin' role in the Development account. The assumption fails with an 'AccessDenied' error. What is the most likely cause?

Accepted Answer

The trust policy of the 'DevAdmin' role does not grant sts:AssumeRole to the 'SecurityAudit' role. The error 'AccessDenied' occurs because the trust policy of the 'DevAdmin' role in the Development account does not explicitly grant the 'sts:AssumeRole' action to the 'SecurityAudit' role from the Management account. Even though the 'SecurityAudit' role has permission to call sts:AssumeRole via its IAM policy, the target role's trust policy acts as a resource-based policy that must allow the incoming principal. Without that allow, the assumption fails regardless of permissions in the source account.

Answer

The SCP is attached to the root OU and overrides any allow in the member accounts

Answer

The SCP 'RestrictRootAccess' denies the sts:AssumeRole action for all principals except root

Answer

The 'SecurityAudit' role requires MFA to assume the 'DevAdmin' role

Question 20

A global e-commerce company operates in three AWS Regions: us-east-1, eu-west-1, and ap-southeast-1. The company uses AWS Organizations with 50 member accounts grouped by business unit. The security team recently discovered that several S3 buckets containing customer data were accidentally made public due to misconfigured bucket policies. The team wants to implement a preventive control that blocks any S3 bucket from becoming public across all accounts, while still allowing authorized cross-account access. The solution must be centrally managed and not require changes to existing IAM policies. Additionally, the team needs to be notified immediately when a public bucket is attempted. Which solution meets all requirements?

Accepted Answer

Create an SCP that denies s3:PutBucketPolicy and s3:PutBucketAcl when the condition includes making the bucket public, and use CloudTrail and CloudWatch Events to send notifications on denied API calls.. Option C is correct because it uses an SCP to centrally deny the s3:PutBucketPolicy and s3:PutBucketAcl actions when the request would make a bucket public, which is a preventive control that blocks the operation before it happens. The requirement for immediate notification is met by using CloudTrail to log the denied API calls and CloudWatch Events to trigger alerts, all without modifying existing IAM policies or requiring per-account changes.

Answer

Use Amazon Macie to discover public buckets and alert the security team.

Answer

Create an SCP that denies s3:PutBucketPolicy only for policies that specify 'Principal': '*' or 'Principal': {'AWS': '*'}

Answer

Deploy an AWS Config rule in each account that triggers a Lambda function to make non-compliant buckets private.