SCS-C02 Mock Exam 93 — 25 Questions

Question 1

A financial services company has a multi-account AWS environment with over 200 accounts managed through AWS Organizations. The security team is responsible for monitoring all accounts for security incidents. They have enabled AWS CloudTrail in all accounts with trails that deliver logs to a centralized S3 bucket in the security account. Additionally, they have enabled Amazon GuardDuty in all accounts with the security account as the administrator. The team uses Amazon EventBridge to trigger automated responses to GuardDuty findings. Recently, they noticed that some GuardDuty findings from member accounts are not appearing in the security account. The security team verified that the findings are generated in the member accounts (they can see them in the member account GuardDuty console) but are not being sent to the administrator account. The CloudTrail logs are being delivered correctly. What is the MOST likely cause of this issue?

Accepted Answer

The member accounts have not accepted the invitation from the GuardDuty administrator account.. In GuardDuty multi-account setup, each member account must accept the invitation from the administrator account to enable sharing of findings. If a member account has not accepted the invitation, findings will not be sent to the administrator. This is a common misconfiguration.

Answer

The S3 bucket policy in the centralized logging bucket is blocking GuardDuty findings from being written.

Answer

The EventBridge rules in the security account are not configured to receive events from member accounts.

Answer

The GuardDuty service-linked role in the member accounts does not have permissions to publish findings to the administrator account.

Question 2

A company uses Amazon CloudWatch Logs to collect application logs from EC2 instances. The security team wants to create an alarm that triggers when a specific error pattern appears in the logs. They have set up a metric filter and an alarm. However, the alarm is not triggering even though the error pattern exists in the logs. What is the most likely cause?

Accepted Answer

The metric filter is only applied to log events that occur after the filter is created.. Option B is correct because metric filters are evaluated on incoming log events, not on historical data. If the error pattern existed before the filter was created, it will not be counted. Option A is wrong because the filter can be created after logs are ingested. Option C is wrong because the metric namespace does not affect filtering. Option D is wrong because the log group retention does not affect metric evaluation.

Answer

The log group retention period is set to 1 day.

Answer

The metric filter uses a custom namespace that is not allowed.

Answer

The metric filter was created before the log group.

Question 3

A company stores sensitive data in an S3 bucket with SSE-KMS encryption. The security team wants to log all access attempts to the bucket, including successful and denied requests. They have enabled S3 server access logs and are delivering them to a different bucket. However, they notice that some access attempts are not logged. What is the most likely reason?

Accepted Answer

S3 server access logs do not log requests that are denied before reaching S3.. Option B is correct because S3 server access logs do not log requests that are denied by the bucket ACL or policy before reaching S3; they only log requests that are processed by S3. Option A is wrong because SSE-KMS does not affect access logging. Option C is wrong because access logs can be delivered to the same account. Option D is wrong because access logs do not log requests that are blocked by the bucket policy? Actually, they log both allowed and denied requests, but if the request is denied at the service level (like AuthFailure), it may not be logged. The correct answer is B.

Answer

The delivery bucket is in a different AWS account.

Answer

The access logs only log successful requests.

Answer

The bucket uses SSE-KMS encryption, which prevents logging.

Question 4

A company uses Amazon GuardDuty and AWS Security Hub in a single AWS account. The security team has created a custom action in Security Hub to send findings to a custom Lambda function for automated response. The Lambda function is designed to take remediation actions based on the finding type. During testing, the team notices that the Lambda function is not being invoked when new findings are generated. The Lambda function's resource-based policy allows invocations from Security Hub, and the function's execution role has necessary permissions. What is the most likely reason for the failure?

Accepted Answer

No Amazon EventBridge rule is configured to send Security Hub findings to the Lambda function.. Option C is correct because Security Hub custom actions require an EventBridge rule to route findings to the Lambda function. Without the rule, Security Hub cannot invoke Lambda directly. Option A is wrong because the function's execution role permissions are for accessing other AWS resources, not for being invoked. Option B is wrong because Security Hub findings are generated even if GuardDuty is enabled. Option D is wrong because the Lambda function's resource-based policy allows invocation from Security Hub, but Security Hub does not directly invoke Lambda; it uses EventBridge.

Answer

GuardDuty is not enabled for all required resource types.

Answer

The Lambda function's execution role does not have permission to access GuardDuty.

Answer

The Lambda function's resource-based policy does not include Security Hub as a principal.

Question 5

A company has a serverless application using AWS Lambda, API Gateway, and DynamoDB. The security team wants to detect and respond to potential SQL injection attempts in API requests. They have enabled AWS WAF on the API Gateway and created a rule to block SQL injection. However, they also want to capture the blocked requests for analysis and store them in an S3 bucket. The team has configured WAF to send logs to Amazon Kinesis Data Firehose, which delivers to an S3 bucket. After testing, the team notices that the logs are not being delivered. The Firehose delivery stream is in the same AWS account, and the S3 bucket policy allows the Firehose service to write. What is the most likely cause?

Accepted Answer

The Kinesis Data Firehose delivery stream does not have an IAM role with permissions to write to the S3 bucket.. Option D is correct because Kinesis Data Firehose requires an IAM role to write to S3, and the role must have the necessary permissions. Even if the bucket policy allows, the delivery stream's IAM role must be configured. Option A is wrong because WAF logs are delivered in near real time, not in batch. Option B is wrong because the bucket policy allows Firehose, but the role is separate. Option C is wrong because WAF is enabled and blocking requests, so it should generate logs.

Answer

The WAF web ACL is not configured to log blocked requests.

Answer

The S3 bucket policy does not grant write permissions to the Firehose delivery stream's IAM role.

Answer

Kinesis Data Firehose delivers logs in batches every 5 minutes, so the team should wait longer.

Question 6

A company uses AWS Lambda functions to process data from an S3 bucket. The security team wants to detect any unauthorized attempts to invoke the Lambda function from outside the company's VPC. The Lambda function is configured to be VPC-enabled and is attached to a VPC with a security group. The team has enabled CloudTrail and VPC Flow Logs. However, they are not seeing any logs for the Lambda invocations in CloudTrail. The team has checked that CloudTrail is logging management events and that the Lambda function is being invoked. What is the most likely reason for the missing CloudTrail logs?

Accepted Answer

CloudTrail is not logging Lambda Invoke API calls because they are data events, not management events.. Option D is correct because CloudTrail management events do not include Lambda Invoke API calls unless data events are enabled. Option A is wrong because VPC Flow Logs capture network traffic, not Lambda invocations. Option B is wrong because the Lambda function's VPC configuration does not affect CloudTrail logging. Option C is wrong because CloudTrail is not limited by VPC endpoints.

Answer

The Lambda function is not configured to send logs to CloudTrail.

Answer

The CloudTrail trail is not configured to log data events for Lambda.

Answer

VPC Flow Logs are not enabled for the Lambda function's VPC.

Question 7

A company uses Amazon GuardDuty and AWS Security Hub. The security team has configured a custom insight in Security Hub to track findings related to S3 bucket exposures. They want to automatically remediate these findings by applying an S3 bucket policy that blocks public access. The team has created a Lambda function that applies the bucket policy and configured Security Hub to send findings to the Lambda function via a custom action. However, when a new finding is generated, the Lambda function is invoked but fails to apply the policy because it does not have permission to modify the S3 bucket. The Lambda function's execution role has permissions to modify S3 bucket policies, but the function is in the same account as the bucket. What should the team check?

Accepted Answer

Check the S3 bucket policy for any explicit deny statements that might block the Lambda function's role.. Option C is correct because even if the function has permissions, the bucket policy may explicitly deny access to the Lambda function's role. Option A is wrong because the function is in the same account, so cross-account is not needed. Option B is wrong because S3 block public access settings are separate from bucket policies. Option D is wrong because the function has permissions; the issue is likely at the bucket policy level.

Answer

Add the Lambda function's execution role to the bucket's Access Control List (ACL).

Answer

Ensure that the Lambda function's execution role has a trust policy that allows Security Hub to assume it.

Answer

Verify that the S3 bucket's block public access settings are not preventing the policy update.

Question 8

A company uses Amazon GuardDuty in a single AWS account to detect threats. The security team receives an alert that a specific EC2 instance is communicating with a known command and control (C2) server. The security engineer needs to immediately isolate the instance while preserving the root cause evidence. The engineer has access to the AWS Management Console. Which action should the engineer take FIRST?

Accepted Answer

Take a snapshot of the EBS volume and then isolate the instance by modifying the security group.. Option D is correct. Taking a snapshot of the EBS volume preserves evidence before isolation. Option A is wrong because terminating the instance loses evidence. Option B is wrong because changing the security group may stop communication but evidence is not preserved. Option C is wrong because CloudWatch Logs agent is not installed and may not capture historical data.

Answer

Terminate the instance immediately to stop the communication.

Answer

Modify the security group to block all outbound traffic.

Answer

Install the CloudWatch Logs agent on the instance to capture logs.

Question 9

A company has a multi-account AWS environment managed by AWS Organizations. The security team wants to enable a centralized logging solution where all VPC flow logs, CloudTrail logs, and AWS Config configuration items are sent to a single S3 bucket in the security account. The team has already created the S3 bucket with appropriate bucket policies to allow cross-account writes. However, logs are not appearing from all accounts. What is the MOST likely reason for this issue?

Accepted Answer

The member accounts do not have the required IAM roles to allow the logging services to write to the central bucket.. When using AWS Organizations, you can enable trusted access for CloudTrail, Config, and VPC Flow Logs to centrally manage logging. However, the service-linked roles must be created in each member account to allow the logging service to write to the central bucket. Option A is correct because the member accounts need the appropriate IAM roles. Option B is wrong because Organizations does not need to be the master account for logging; a designated account can serve as the central logging account. Option C is wrong because the bucket policy should allow the logging service principal, not the account root. Option D is wrong because KMS encryption is not required for cross-account logging.

Answer

The security account is not the master account of the AWS Organization.

Answer

The S3 bucket policy does not grant write access to the root user of each member account.

Answer

The S3 bucket is encrypted with SSE-KMS and the KMS key policy does not allow cross-account access.

Question 10

A security engineer is troubleshooting an issue where CloudTrail logs for a single AWS account are not being delivered to the centralized S3 bucket in the logging account. The engineer has verified that the CloudTrail trail is enabled, the S3 bucket policy allows CloudTrail to write, and the bucket exists. However, no log files have been delivered for the past 6 hours. The engineer checks the CloudTrail console and sees that the trail status shows 'Logging' but the latest log file time is from 8 hours ago. The engineer suspects a permission issue but cannot find any explicit deny in the bucket policy. What is the MOST likely cause of this issue?

Accepted Answer

The KMS key policy used by the S3 bucket does not grant CloudTrail permission to use the key.. The issue is likely that the KMS key used for server-side encryption of the S3 bucket is not configured to allow CloudTrail to decrypt logs. CloudTrail requires decrypt permission on the KMS key to write logs, even if the trail uses SSE-S3 for the log files themselves. The bucket policy may allow CloudTrail to write, but if the KMS key policy does not grant kms:Decrypt to the CloudTrail service principal, log delivery will fail. Option A is correct because the KMS key policy likely needs a statement allowing CloudTrail to use the key. Option B is wrong because CloudTrail does not need S3 full access, only write access. Option C is wrong because the bucket exists and is accessible. Option D is wrong because CloudTrail can deliver to a bucket in another account with proper permissions.

Answer

The CloudTrail trail is not configured to deliver to a cross-account bucket.

Answer

The CloudTrail trail is configured with a role that does not have S3 full access.

Answer

The S3 bucket is in a different region than the CloudTrail trail.

Question 11

A company has a multi-account AWS environment using AWS Organizations. The security team has enabled AWS CloudTrail with an organization trail that delivers logs to a centralized S3 bucket in the management account. They have also enabled Amazon GuardDuty in all accounts. Recently, they noticed that some EC2 instances in a member account are exhibiting unusual network behavior, such as outbound traffic to known malicious IP addresses. The security engineer needs to quickly determine the source of the traffic and identify which EC2 instances are affected. The engineer has access to the management account and the member account. Which course of action should the engineer take to most efficiently investigate this incident?

Accepted Answer

Use Amazon Detective to investigate the GuardDuty findings and analyze VPC Flow Logs to identify the affected instances.. Option A is correct because Amazon Detective can automatically analyze VPC Flow Logs, CloudTrail logs, and GuardDuty findings to provide a visual investigation of the incident, including identifying the affected EC2 instances and the source of the traffic. Option B is wrong because manually querying VPC Flow Logs with Athena is time-consuming and less efficient. Option C is wrong because AWS Config does not provide network traffic analysis. Option D is wrong because Amazon Inspector is for vulnerability assessment, not network traffic analysis.

Answer

Use AWS Config to review the configuration changes of the EC2 instances and identify any anomalies.

Answer

Use Amazon Inspector to scan the EC2 instances for vulnerabilities and correlate with network traffic.

Answer

Query the VPC Flow Logs stored in the centralized S3 bucket using Amazon Athena to find the source IP and affected instances.

Question 12

A company is using Amazon GuardDuty to detect threats in its AWS environment. The security team notices that GuardDuty is generating a high number of 'UnauthorizedAccess:IAMUser/MaliciousIPCaller' findings for an IAM user that is used by a legacy application. The security team has verified that the IP addresses flagged are not malicious but are legitimate IPs used by the application's third-party service. The company wants to suppress these findings without disabling GuardDuty entirely. Which solution is the MOST effective and secure?

Accepted Answer

Create a GuardDuty suppression rule that automatically archives findings for that IAM user.. GuardDuty supports suppression rules that allow you to automatically archive findings that match certain criteria. You can create a suppression rule based on the finding type and the IAM user's ARN to automatically archive these false positives. Option C is correct because it uses GuardDuty's built-in suppression feature. Option A is wrong because disabling the finding type would suppress all similar findings for all users, which is too broad. Option B is wrong because modifying the IAM user's permissions does not affect GuardDuty findings. Option D is wrong because creating a VPC flow log filter does not suppress GuardDuty findings.

Answer

Disable the specific finding type in GuardDuty settings.

Answer

Create a VPC flow log filter to exclude traffic from those IP addresses.

Answer

Modify the IAM user's permissions to restrict the IP addresses it can use.

Question 13

A security engineer is responsible for monitoring AWS account activity. The engineer needs to receive real-time notifications when specific API calls are made, such as 'DeleteTrail' or 'UpdateTrail'. The engineer wants to use AWS services to achieve this with minimal latency. Which combination of services should the engineer use?

Accepted Answer

CloudTrail -> CloudWatch Logs -> CloudWatch metric filter -> CloudWatch alarm -> Amazon SNS. CloudTrail delivers events to CloudWatch Logs in near real-time. You can then create a CloudWatch Logs metric filter to match specific API calls and set up a CloudWatch alarm that triggers an SNS notification. This provides real-time alerts. Option A is correct. Option B is wrong because EventBridge can directly receive CloudTrail events, but CloudTrail logs are not automatically sent to EventBridge; you need to set up a rule. Option C is wrong because CloudWatch Logs subscription filters are for streaming to other services, not for real-time alarms. Option D is wrong because S3 event notifications are not real-time and are for object-level events.

Answer

CloudTrail -> Amazon EventBridge -> Amazon SNS

Answer

CloudTrail -> Amazon S3 -> S3 event notification -> AWS Lambda -> Amazon SNS

Answer

CloudTrail -> CloudWatch Logs -> CloudWatch Logs subscription filter -> AWS Lambda -> Amazon SNS

Question 14

A company has an S3 bucket that stores sensitive data. The bucket policy allows access only from a specific VPC endpoint. The security team notices that an object was accessed from an IP address outside the allowed VPC. CloudTrail logs show that the access was made using temporary credentials from an assumed role. The role was assumed by an EC2 instance in the allowed VPC. What is the MOST likely reason the access was allowed despite the bucket policy restriction?

Accepted Answer

The bucket policy allows access from the VPC endpoint, and the request was made through that endpoint.. Option A is correct. If the bucket policy only checks the VPC endpoint condition, but the request came through the VPC endpoint, it would be allowed even if the source IP is outside the VPC because the VPC endpoint condition overrides IP-based restrictions. Option B is wrong because the role is allowed. Option C is wrong because there is no encryption requirement. Option D is wrong because the bucket policy is not malformed.

Answer

The bucket policy does not require encryption in transit.

Answer

The bucket policy has a syntax error that makes it ineffective.

Answer

The IAM role used by the EC2 instance has permissions that override the bucket policy.

Question 15

A financial services company uses AWS CloudTrail to log all API calls in their account. They store the logs in an S3 bucket with server-side encryption using AWS KMS (SSE-KMS). The security team needs to ensure that only authorized users can decrypt and read the logs. They have created a KMS key with a key policy that grants decrypt permissions to the security team's IAM roles. However, when a security engineer tries to download a log file from the S3 bucket using the AWS CLI, they receive an 'AccessDenied' error. The engineer has s3:GetObject permission on the bucket. What is the most likely cause?

Accepted Answer

The KMS key policy does not grant the engineer's role permission to decrypt.. Option C is correct because the KMS key policy must grant the engineer's role kms:Decrypt permission. Option A is wrong because the error is not about S3 permissions. Option B is wrong because S3 bucket policy does not control KMS permissions. Option D is wrong because CloudTrail does not need decrypt permission for reading logs.

Answer

The CloudTrail trail is not configured to use SSE-KMS.

Answer

The S3 bucket has a bucket policy that denies access to the engineer's IAM role.

Answer

The S3 bucket policy does not allow the engineer to read objects.

Question 16

A company uses Amazon GuardDuty to monitor for malicious activity in their AWS account. The security team receives a GuardDuty finding that indicates an EC2 instance is communicating with a known cryptocurrency mining pool. The team needs to investigate the finding and determine which security group rules allowed the outbound traffic. The EC2 instance is in a VPC with a single security group attached. Which AWS service should the security team use to review the outbound traffic details?

Accepted Answer

VPC Flow Logs. Option A is correct because VPC Flow Logs capture network traffic metadata, including outbound connections. Option B is wrong because CloudTrail does not capture network traffic. Option C is wrong because GuardDuty provides findings but not traffic logs. Option D is wrong because Config does not log network traffic.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon GuardDuty

Question 17

A security team wants to detect and alert when an EC2 instance is terminated. They have enabled CloudTrail and are sending logs to CloudWatch Logs. Which combination of services should they use to achieve this with minimal latency?

Accepted Answer

Amazon CloudWatch Events (EventBridge) and Amazon SNS. Option A is correct because CloudWatch Events (EventBridge) can match the TerminateInstances event in real-time and trigger an SNS notification. Option B is wrong because a metric filter and alarm have some latency. Option C is wrong because Config evaluates changes periodically. Option D is wrong because GuardDuty does not monitor EC2 termination.

Answer

CloudWatch Logs metric filter and CloudWatch alarm

Answer

AWS Config and AWS Lambda

Answer

Amazon GuardDuty and Amazon SNS

Question 18

A financial services company has a production AWS account with hundreds of EC2 instances running a mix of Linux and Windows workloads. The security team is responsible for detecting and responding to security incidents. They have enabled CloudTrail, VPC Flow Logs, and GuardDuty. Recently, GuardDuty generated a finding indicating that an EC2 instance is communicating with a known malicious IP address. The security engineer needs to investigate the incident. The engineer examines the GuardDuty finding and sees the affected resource is an EC2 instance ID. The engineer wants to identify which user or role launched the instance and what security groups were associated with it at launch time. Which approach should the engineer take to gather this information?

Accepted Answer

Search CloudTrail logs for the RunInstances event that created the instance, using the instance ID to filter.. Option A is correct because CloudTrail logs the RunInstances API call which includes the user identity, instance ID, and security group IDs. Option B is wrong because AWS Config records the configuration but not the user who launched it. Option C is wrong because EC2 console does not provide historical launch details. Option D is wrong because Systems Manager Inventory does not track launch user or initial security groups.

Answer

Log in to the EC2 console and view the instance details under the 'Security' tab.

Answer

Use AWS Systems Manager Inventory to collect metadata about the instance.

Answer

Use AWS Config to view the configuration history of the EC2 instance and check the security group changes.

Question 19

A company runs a critical application on Amazon EC2 instances in an Auto Scaling group. The security team needs to monitor for unauthorized changes to security groups. They have enabled AWS Config with the security-group-change detection rule. However, they notice that changes are being detected but not all changes trigger a notification. The team wants to ensure that every security group modification (create, delete, or rule change) sends an alert to the security operations center via Amazon SNS. The current setup: AWS Config rules evaluate resources periodically, and SNS notifications are sent only when the rule compliance status changes. What should the team do to achieve real-time alerts for all security group changes?

Accepted Answer

Configure an Amazon EventBridge rule that matches API calls via CloudTrail for security group modifications and sends notifications to an SNS topic.. The correct answer is B. CloudTrail logs all API calls, including security group modifications, in real time. By creating a CloudWatch Events (now Amazon EventBridge) rule that matches SecurityGroup events and targets SNS, the team can receive immediate notifications. Option A is incorrect because AWS Config rules are not real-time; they evaluate periodically or on configuration changes but are not designed for real-time alerting. Option C is incorrect because VPC Flow Logs monitor network traffic, not security group changes. Option D is incorrect because GuardDuty focuses on threat detection, not configuration changes.

Answer

Deploy Amazon GuardDuty and enable the Security Group Monitoring feature.

Answer

Increase the frequency of AWS Config rule evaluations to every minute to reduce detection latency.

Answer

Enable VPC Flow Logs and set up a metric filter for security group-related traffic anomalies.

Question 20

A company runs a multi-tier web application on AWS. The application consists of an Application Load Balancer (ALB), a fleet of EC2 instances in an Auto Scaling group, and an RDS MySQL database. The security team wants to monitor for SQL injection attempts. They have enabled AWS WAF on the ALB and are logging all requests. The security engineer needs to analyze the WAF logs to identify if any SQL injection attacks have been attempted. The logs are stored in an S3 bucket. The engineer needs to query the logs for patterns like 'SELECT * FROM' or 'DROP TABLE' in the URI. Which service should the engineer use to perform this analysis?

Accepted Answer

Amazon Athena. Option B is correct because Amazon Athena can query WAF logs stored in S3 using SQL. Option A is wrong because CloudWatch Logs Insights works with CloudWatch Logs, not S3. Option C is wrong because QuickSight is for visualization, not direct querying. Option D is wrong because Kinesis Data Analytics is for real-time streaming, not static S3 logs.

Answer

Amazon Kinesis Data Analytics

Answer

Amazon QuickSight

Answer

CloudWatch Logs Insights