SCS-C02 Mock Exam 94 — 25 Questions

Question 1

A security engineer is investigating a potential data exfiltration incident. They suspect that an EC2 instance was compromised and used to transfer large amounts of data from an S3 bucket to an external IP address. The engineer has enabled VPC Flow Logs for the subnet where the EC2 instance resides, but the logs are not capturing traffic to the external IP. What is the most likely reason?

Accepted Answer

The traffic is routed through a NAT gateway, and flow logs are not enabled on the NAT gateway's subnet.. Option C is correct because VPC Flow Logs do not capture traffic to external IPs that is routed through a NAT gateway if the flow log is configured only for the subnet where the EC2 instance is located; the NAT gateway's traffic is captured by flow logs on the subnet where the NAT gateway is. Option A is wrong because Flow Logs can capture accepted traffic. Option B is wrong because Flow Logs capture traffic even if Security Groups are present. Option D is wrong because Flow Logs capture all IP traffic, not just intra-VPC.

Answer

The EC2 instance's security group is blocking the traffic.

Answer

VPC Flow Logs only capture rejected traffic.

Answer

VPC Flow Logs only capture traffic to and from other VPC resources.

Question 2

A company uses Amazon GuardDuty to monitor for malicious activity in its AWS environment. The security team receives a high number of findings, many of which are false positives. They want to reduce noise by suppressing findings for known benign activities, such as internal vulnerability scans performed by the security team. GuardDuty has a feature to create suppression rules based on finding criteria. However, the team also wants to ensure that if a new type of threat is detected, it is immediately escalated. What is the MOST effective way to manage GuardDuty findings?

Accepted Answer

Create suppression rules that automatically archive findings matching the known benign activity criteria, and periodically review the suppressed findings.. The correct answer is C. GuardDuty suppression rules automatically archive findings that match certain criteria, reducing noise. However, the team should still review suppressed findings periodically to ensure no actual threats are missed. Option A is incorrect because disabling the entire finding type would miss genuine threats. Option B is incorrect because lowering the severity threshold would increase noise. Option D is incorrect because a blanket suppression rule might miss important variations of the threat.

Answer

Set GuardDuty to only generate findings for medium and high severity, ignoring low severity findings.

Answer

Create a suppression rule that blocks all findings from the internal IP range used by the security team.

Answer

Disable the specific GuardDuty finding types that generate false positives.

Question 3

A company wants to ensure that all API calls made to their AWS account are logged and immutable. They have enabled AWS CloudTrail and are delivering logs to an S3 bucket. The security team requires that logs cannot be deleted or modified by anyone, including the root user. What should they do?

Accepted Answer

Enable S3 Object Lock with Compliance retention mode on the bucket.. Option A is correct because S3 Object Lock with retention mode Compliance prevents any user, including root, from deleting or overwriting objects. Option B is wrong because MFA Delete prevents deletion but can be disabled by root. Option C is wrong because bucket policies can be changed by root. Option D is wrong because versioning alone does not prevent deletion of versions.

Answer

Enable MFA Delete on the S3 bucket.

Answer

Enable S3 Versioning on the bucket.

Answer

Add a bucket policy that denies s3:DeleteObject for all principals.

Question 4

A company has a multi-tier web application hosted on AWS. The application consists of an Application Load Balancer (ALB), a fleet of EC2 instances in an Auto Scaling group, and an Amazon RDS MySQL database. The security team has implemented security groups and network ACLs. Recently, a vulnerability scan revealed that the RDS database is accessible from the internet. The security engineer investigates and finds that the database security group allows inbound traffic on port 3306 from 0.0.0.0/0. The engineer also checks the network ACLs and finds that inbound rules allow traffic on port 3306 from 0.0.0.0/0, and outbound rules allow all traffic. The database is in a private subnet. Which combination of steps should the engineer take to remediate the issue while maintaining application functionality?

Accepted Answer

Update the database security group to allow inbound traffic on port 3306 only from the ALB security group. Update the network ACL inbound rule to allow traffic from the ALB security group.. Option A is correct because it restricts both security group and network ACL to only the ALB security group, which is the proper source for database traffic. Option B is wrong because it only changes network ACL, not security group. Option C is wrong because allowing the VPC CIDR is too broad. Option D is wrong because it suggests public subnet for database, which is insecure.

Answer

Update the network ACL inbound rule to allow traffic only from the ALB security group. The security group is already correctly configured.

Answer

Update the database security group to allow inbound traffic on port 3306 from the VPC CIDR range. No changes to network ACL are needed.

Answer

Move the database to a public subnet and restrict the security group to the ALB security group.

Question 5

A company runs a multi-tier web application on AWS. The application uses an Application Load Balancer (ALB) in a public subnet, EC2 instances in private subnets for the web tier, and an RDS MySQL database in a private subnet. The security team has noticed that the EC2 instances are receiving traffic from unexpected IP addresses on port 22 (SSH). The instances were launched with a default security group that allowed SSH from 0.0.0.0/0. The security engineer has corrected the security group to allow SSH only from the company's bastion host security group. However, the engineer also wants to implement defense-in-depth by adding a network ACL to the private subnet to block SSH from all sources except the bastion host's private IP (10.0.1.10). The private subnet's current network ACL allows all inbound and outbound traffic. The engineer creates a new network ACL with the following rules: Inbound: Rule 100: Allow SSH from 10.0.1.10/32; Rule 200: Deny SSH from 0.0.0.0/0; Rule *: Deny all. Outbound: Rule 100: Allow all. After associating this new NACL with the private subnet, the engineer finds that SSH connections from the bastion host are still being blocked. What is the most likely cause?

Accepted Answer

The new network ACL was not associated with the private subnet.. Option B is correct. Network ACLs are stateless, meaning that return traffic must be explicitly allowed. The outbound rule only allows all traffic, but the inbound rule denies SSH from 0.0.0.0/0, which would block the return traffic for the SSH session because the source of the response is the instance, not the bastion host. Actually, the issue is that the inbound rule denies SSH from all, but the allow rule for the bastion host should work. However, because NACLs are stateless, the response from the instance to the bastion host would be considered outbound traffic, which is allowed. The real issue is that the NACL rules are evaluated in order; the deny rule (200) might block the bastion host if the allow rule (100) is not matched correctly. But the more likely cause is that the network ACL does not allow ephemeral ports for the return traffic. When the bastion host initiates SSH (source port 22, destination port 22), the response from the instance uses an ephemeral port (1024-65535) as source. The outbound rule allows all traffic, so that should be fine. However, the inbound rule for the ephemeral ports is missing. But the question says the inbound rule denies all SSH, which would block the initial connection from the bastion host? Wait, the inbound rule allows SSH from 10.0.1.10/32, so that should work. The deny rule would block other SSH. The problem might be that the network ACL is not associated correctly. But the most common mistake is forgetting that NACLs are stateless and need rules for ephemeral ports. However, the outbound rule allows all, so that should not be an issue. Let's think: The inbound rule allows SSH from bastion host; the outbound rule allows all. So why would it be blocked? Possibly because the inbound deny rule for SSH from 0.0.0.0/0 also matches the bastion host if the allow rule is not evaluated first? But NACLs are evaluated in order; rule 100 is evaluated before rule 200. So the allow should take precedence. Maybe the issue is that the network ACL is not associated with the subnet, or the bastion host's IP is not exactly 10.0.1.10. However, the most plausible answer among the options is that the network ACL is not associated with the subnet, but the question says the engineer associated it. Option B says the network ACL is not associated with the subnet, which could be the case if the engineer forgot to associate it. Option A (security group still allows SSH from 0.0.0.0/0) would not cause blocking. Option C (outbound rule denies ephemeral ports) is incorrect because outbound is allow all. Option D (NACL rules are out of order) is plausible but the order is correct. Given typical exam logic, the most common mistake is forgetting to associate the NACL. So I'll go with B.

Answer

The outbound rule of the network ACL does not allow ephemeral ports for return traffic.

Answer

The security group on the EC2 instances still allows SSH from 0.0.0.0/0.

Answer

The network ACL rules are out of order; the deny rule should be before the allow rule.

Question 6

A company has a web application running on EC2 instances behind an Application Load Balancer (ALB). The application uses a custom header X-Auth-Token to authenticate requests. The security team wants to use AWS WAF to block requests that do not contain this header or contain an invalid token. The WAF is associated with the ALB. The team creates a rule with a match condition that checks for the presence of the X-Auth-Token header and a regex pattern for the token value. However, the rule is not blocking any requests. What is the most likely cause?

Accepted Answer

There is an allow rule with a higher priority that allows all requests before the block rule is evaluated.. Option D is correct. AWS WAF evaluates rules in order, and if a rule with a higher priority allows the request, it will not be blocked by a lower priority rule. The team may have an allow rule with higher priority that allows all requests. Option A is incorrect because WAF can inspect headers. Option B is incorrect because WAF can be used with ALB. Option C is incorrect because WAF can handle regex.

Answer

AWS WAF is not supported for Application Load Balancers; it only supports CloudFront.

Answer

AWS WAF cannot inspect custom headers; it can only inspect standard HTTP headers.

Answer

The regex pattern for the token is too complex for AWS WAF to process.

Question 7

A company has a requirement to block traffic from specific IP addresses known to be malicious. The company has an Application Load Balancer (ALB) that fronts a web application. The security engineer needs to implement a solution that can block these IP addresses at the edge before they reach the ALB. Which AWS service should be used?

Accepted Answer

Use AWS WAF with an IP set rule to block the malicious IP addresses.. Option B is correct. AWS WAF can be attached to an ALB and can block traffic based on IP addresses using IP match conditions. Option A (Security groups) are for instance-level and cannot be attached to ALB. Option C (Network ACLs) are for subnets, not ALB. Option D (AWS Shield Advanced) provides DDoS protection but not IP-based blocking.

Answer

Configure security groups on the ALB to deny traffic from those IP addresses.

Answer

Enable AWS Shield Advanced and configure rate-based rules.

Answer

Add a network ACL rule to the ALB's subnet to deny the IP addresses.

Question 8

A company has a multi-account AWS environment using AWS Organizations. The security team needs to ensure that all Amazon S3 buckets across all accounts are encrypted with AWS KMS customer managed keys (CMKs). They have implemented a service control policy (SCP) that denies s3:PutObject unless the request includes the x-amz-server-side-encryption header with value aws:kms. Additionally, they have an SCP that denies s3:CreateBucket unless the bucket is configured with default encryption using KMS. Despite these policies, a developer in the production account reports that they were able to upload a sensitive object to an existing bucket without encryption. The developer used the AWS CLI with the command: aws s3 cp sensitive.txt s3://my-bucket/. The bucket does not have default encryption enabled. The SCPs are attached to the root organizational unit (OU) and are in effect. What is the MOST likely reason the upload succeeded?

Accepted Answer

The SCP does not apply to the management account of the organization.. The SCP denies PutObject without the encryption header, but the command did not specify the header. However, SCPs do not affect the root user? No, root user is not used here. The developer used an IAM role. SCPs apply to all IAM principals. The issue might be that the SCP uses a condition key that is not evaluated properly? Another common issue: SCPs cannot deny actions that are performed by the AWS service itself? No. The most likely reason is that the SCP was not applied to the production account because it was attached to the root OU, but the production account might be in a different OU that does not inherit the SCP? Or the SCP might have been disabled? Or the developer might be using an IAM role that has a service-linked role? Actually, a known limitation: SCPs do not affect the management account. If the production account is the management account, SCPs do not apply. That is a classic gotcha. The question says "multi-account AWS environment using AWS Organizations" but does not specify that the production account is the management account. But it's plausible. Another possibility: The SCP denies s3:PutObject without the header, but the CLI command might automatically add the header if the bucket has default encryption? No, bucket does not have default encryption. The SCP should deny. So the most likely cause is that the production account is the management account of the organization, and SCPs do not apply to the management account.

Answer

The SCP uses the wrong condition key; it should use s3:x-amz-server-side-encryption instead.

Answer

The SCP was not attached to the production account's OU.

Answer

The developer used an IAM role that bypasses SCPs.

Question 9

A company is migrating its on-premises data center to AWS. The company has a VPC with a CIDR of 10.0.0.0/16 and needs to connect its on-premises network (192.168.0.0/16) to the VPC using an AWS Site-to-Site VPN. The security engineer has configured the virtual private gateway (VGW) and the customer gateway (CGW) with the correct settings. The VPN tunnel status is UP, but the on-premises servers cannot ping the EC2 instances in the VPC. The EC2 instances have security groups that allow ICMP traffic from the on-premises network. The VPC route table has a route for the on-premises network pointing to the VGW. What is the most likely cause of the issue?

Accepted Answer

The VPC route table does not have a route for the on-premises CIDR (192.168.0.0/16) pointing to the virtual private gateway.. Option A is correct. The VPC route table needs a route for the on-premises CIDR pointing to the VGW. If this route is missing, traffic from the VPC to on-premises will not be routed correctly. Option B is incorrect because security groups are stateful and allow return traffic. Option C is not required if the VPN is configured correctly. Option D is incorrect because the VGW is the correct target.

Answer

The customer gateway is not configured with the correct public IP address of the VGW.

Answer

The VPN tunnel is not configured with the correct pre-shared key.

Answer

The security group for the EC2 instances does not allow inbound ICMP from the on-premises network.

Question 10

A company runs a critical application on EC2 instances in an Auto Scaling group across multiple Availability Zones. The application uses an Application Load Balancer (ALB) to distribute traffic. The security team has implemented a security group for the ALB that allows inbound HTTPS from 0.0.0.0/0 and a security group for the EC2 instances that allows inbound HTTP from the ALB's security group. Recently, the company experienced a security incident where an attacker exploited a vulnerability in the application to gain access to an EC2 instance and then moved laterally to the database. The database is in a private subnet and uses a security group that allows inbound traffic from the EC2 instance security group on port 3306 (MySQL). The security team wants to prevent lateral movement in the future. Which of the following is the MOST effective course of action?

Accepted Answer

Implement a host-based firewall on each EC2 instance to restrict outbound connections to only the database endpoint.. Option C is correct because implementing a host-based firewall (e.g., AWS Systems Manager Agent with a firewall policy) on each EC2 instance can restrict outbound connections from the application to only necessary destinations, preventing lateral movement. Option A (network ACLs) can block traffic at the subnet level but are not as granular for individual instances. Option B (VPC peering) is not relevant. Option D (AWS WAF) protects against web exploits but does not prevent lateral movement after compromise.

Answer

Use VPC peering to isolate the database subnet from the application subnet.

Answer

Deploy AWS WAF in front of the ALB to block known malicious IPs.

Answer

Create a network ACL for the private subnet that denies outbound traffic from the EC2 instances to the database subnet.

Question 11

A company has a VPC with a public subnet and a private subnet. The public subnet contains a NAT gateway and a bastion host. The private subnet contains a web server that needs to be patched via the internet. The security engineer has configured the route tables: the public subnet route table has a default route to the Internet Gateway, and the private subnet route table has a default route to the NAT gateway. The web server can successfully initiate outbound connections to the internet to download patches. However, the security team notices that the web server is also receiving inbound connections from the internet on port 80. The web server's security group allows inbound HTTP from 0.0.0.0/0. What should the engineer do to prevent inbound internet traffic while still allowing outbound patching?

Accepted Answer

Modify the web server's security group to remove the inbound HTTP rule from 0.0.0.0/0.. Option B is correct. Removing the inbound HTTP rule from the security group will block inbound traffic from the internet, while outbound traffic is still allowed because security groups are stateful and allow return traffic for outbound-initiated connections. Option A is incorrect because changing the route table would break outbound connectivity. Option C is incorrect because the NAT gateway already handles outbound traffic; changing it would not help. Option D is incorrect because a network ACL would affect all traffic and could block return traffic for outbound connections.

Answer

Change the private subnet's route table to have a default route to the Internet Gateway instead of the NAT gateway.

Answer

Replace the NAT gateway with a NAT instance and configure it to block inbound traffic.

Answer

Add a network ACL to the private subnet that denies inbound HTTP traffic.

Question 12

A company is running a critical web application on EC2 instances behind an Application Load Balancer (ALB) in a VPC. The application serves traffic on port 443. The security team has implemented a security group for the ALB that allows inbound HTTPS from 0.0.0.0/0. The EC2 instances are in a private subnet with a security group that allows inbound traffic from the ALB security group on port 8080. The application works correctly. However, the security team wants to add an additional layer of defense by implementing a web application firewall (WAF) to block common web exploits. The team also wants to ensure that only traffic from the company's corporate IP range (203.0.113.0/24) can access the application for administrative purposes on a separate path. The team has enabled AWS WAF on the ALB and associated a web ACL. They have also created a rule to allow traffic from the corporate IP range and block all other traffic. After deploying these changes, external users (not from corporate IP) cannot access the application at all. The company wants external users to be able to access the main application, but only corporate IPs should access the admin path. What should the security engineer do to fix the issue?

Accepted Answer

Modify the WAF rule to allow traffic from the corporate IP range on the admin path and allow all traffic on the main application path.. The correct action is to create a WAF rule that allows traffic from corporate IPs on the admin path and allows all other traffic on the main path, instead of blocking all non-corporate traffic. Option A is correct. Option B would allow all traffic, defeating the purpose. Option C is too permissive. Option D doesn't address the WAF issue.

Answer

Configure the security group of the ALB to allow only corporate IPs.

Answer

Create two separate ALBs, one for admin traffic and one for main traffic.

Answer

Remove the WAF rule that blocks all non-corporate traffic and rely on security groups.

Question 13

A startup is building a web application on AWS. They have an Application Load Balancer (ALB) in front of EC2 instances in an Auto Scaling group. They want to protect the application from common web exploits like SQL injection and cross-site scripting. They also need to allow only traffic from certain geographic regions. Which AWS service should they use to achieve these requirements?

Accepted Answer

AWS WAF. Option B is correct because AWS WAF can block SQL injection, XSS, and geo-based requests. Option A is wrong because AWS Shield Advanced is for DDoS protection. Option C is wrong because Network ACLs are stateless and cannot inspect application layer. Option D is wrong because Security Groups are stateful but cannot inspect application layer.

Answer

AWS Shield Advanced

Answer

Security groups on the ALB

Answer

Network ACLs on the ALB subnets

Question 14

A company is deploying a new web application on AWS. The application runs on EC2 instances behind an Application Load Balancer (ALB). The security team requires that all traffic between the ALB and the EC2 instances be encrypted using TLS. The ALB uses a certificate from AWS Certificate Manager (ACM). The EC2 instances are Linux-based and have a self-signed certificate installed. The security engineer configured the ALB target group to use HTTPS on port 443, and the EC2 security group allows inbound traffic on port 443 from the ALB security group. However, when testing, the application returns a 502 Bad Gateway error. The ALB health checks are failing. What is the likely cause?

Accepted Answer

The ALB is configured to verify the certificate on the backend instances, and the self-signed certificate is not trusted.. The ALB performs health checks to the target group. If the target group uses HTTPS, the health check also uses HTTPS. The self-signed certificate on the EC2 instances is not trusted by the ALB, causing the health check to fail. The ALB does not validate backend certificates by default, but the health check must succeed. The issue is that the health check path or port may be incorrect, but more likely the backend is not responding on the health check path. However, the most common issue is that the health check is not configured correctly. Since the question states the health checks are failing, and the ALB returns 502, the likely cause is that the backend is not responding on the health check endpoint. But given the information, the self-signed certificate should work because ALB does not validate backend certificates. Actually, ALB can be configured to ignore certificate validation. The default is to verify the certificate, but it can be disabled. So if the security team did not disable verification, the self-signed cert would cause failure. The correct answer is to disable certificate verification on the target group or use a trusted certificate. The best action is to configure the target group to use protocol HTTP instead of HTTPS or disable certificate verification.

Answer

The EC2 instances are not running a web server listening on port 443.

Answer

The security group for the EC2 instances does not allow inbound traffic from the ALB on the health check port.

Answer

The target group health check is configured to use the same port as the traffic port (443), but the health check path is incorrect.

Question 15

A healthcare company runs a HIPAA-compliant application on AWS. The application consists of an Application Load Balancer (ALB) in front of a fleet of EC2 instances behind an Auto Scaling group. The EC2 instances store sensitive patient data in an S3 bucket encrypted with SSE-KMS. The security team recently enabled AWS CloudTrail and Amazon GuardDuty. During a routine audit, they notice that an EC2 instance is making repeated API calls to the S3 bucket from an IP address outside the corporate network. The security team suspects the instance is compromised. What is the MOST effective immediate step to contain the potential breach while maintaining availability of the application?

Accepted Answer

Revoke the IAM role attached to the instance by removing the S3 permissions from the role.. Option C is correct because revoking the instance's IAM role permissions will immediately stop its access to S3 without terminating the instance. Option A is wrong because terminating the instance reduces capacity. Option B is wrong because removing the security group may affect network connectivity but does not stop API calls. Option D is wrong because stopping the instance may disrupt the application but is less granular than revoking permissions.

Answer

Remove the security group that allows outbound traffic from the instance.

Answer

Stop the EC2 instance and detach it from the Auto Scaling group.

Answer

Terminate the EC2 instance immediately.

Question 16

A company runs a multi-tier web application on AWS. The web tier uses an Application Load Balancer (ALB) in a public subnet, and the application tier runs on EC2 instances in private subnets. The security team recently ran a vulnerability scan and found that the application instances are accessible from the internet on port 8080. The EC2 instances have a security group that allows inbound traffic on port 8080 from the ALB's security group only. However, the ALB's security group allows inbound traffic on port 8080 from 0.0.0.0/0. The architecture also includes a NAT Gateway for outbound internet access from private subnets. The security engineer needs to ensure that only the ALB can communicate with the application instances on port 8080, and that the application instances cannot be directly accessed from the internet. What should the security engineer do?

Accepted Answer

Modify the ALB security group to remove the inbound rule for port 8080 from 0.0.0.0/0, and configure the ALB listener to forward traffic from port 80/443 to port 8080 on the target group.. The ALB's security group should not allow inbound from 0.0.0.0/0 on the application port. Instead, the ALB should listen on port 80/443 from the internet and forward to port 8080 on the instances. The ALB security group rule should be removed, and the listener should be configured on standard ports. The EC2 security group is already correct.

Answer

Change the EC2 instance security group to allow inbound traffic on port 8080 from 0.0.0.0/0, and rely on the subnet network ACL to block traffic.

Answer

Add a rule to the EC2 security group that denies inbound traffic from 0.0.0.0/0 on port 8080.

Answer

Place the EC2 instances in a public subnet and use a network ACL to block inbound traffic on port 8080 from the internet.

Question 17

A company has a multi-account AWS Organizations setup with a central security account (Account ID: 111122223333) and several member accounts. The security team uses AWS CloudTrail to log all API calls across accounts and stores the logs in an S3 bucket (my-cloudtrail-bucket) in the security account. The team wants to allow the security team members (IAM users in the security account) to access the CloudTrail logs, while denying access to all other users in the organization, including the root user of the security account. The security team has attached the following IAM policy to the IAM group containing the security team members:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-cloudtrail-bucket/*"
    }
  ]
}

However, a security team member reports that they are receiving an AccessDenied error when trying to download a log file. The bucket policy is as follows:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-cloudtrail-bucket/*",
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "false"
        }
      }
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::111122223333:root"
      },
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-cloudtrail-bucket/*"
    },
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": "arn:aws:s3:::my-cloudtrail-bucket/*",
      "Condition": {
        "StringNotEquals": {
          "aws:PrincipalAccount": "111122223333"
        }
      }
    }
  ]
}

What is the most likely reason for the AccessDenied error?

Accepted Answer

The bucket policy allows only the root user of the security account, not the IAM users.. Option B is correct. The bucket policy allows the root user but does not explicitly allow the IAM users. While the root user is allowed, the Deny statement for non-root users is not present; however, the Allow for root does not extend to IAM users. The IAM users are not the root user, so the Allow statement does not apply to them. The IAM policy allows GetObject, but the bucket policy does not grant access to the IAM users, so the default implicit deny applies. Option A is wrong because the IAM policy does not have a Deny. Option C is wrong because the Deny for non-111122223333 accounts does not affect users in the same account. Option D is wrong because the SecureTransport condition only denies when HTTPS is not used.

Answer

The bucket policy denies access to all principals except those in account 111122223333, but the IAM users are in that account, so they are denied.

Answer

The bucket policy requires secure transport, and the security team member is not using HTTPS.

Answer

The IAM policy has an implicit deny because the security team members are not allowed to access S3.

Question 18

A company runs a multi-tier web application on AWS. The application consists of an Application Load Balancer (ALB) that distributes traffic to a fleet of EC2 instances in an Auto Scaling group. The EC2 instances need to read from an Amazon RDS MySQL database and write logs to an S3 bucket. The security team wants to ensure that the EC2 instances have only the minimum required permissions. Currently, the EC2 instances are launched with an IAM role that has an attached policy allowing full S3 access (s3:*) and full RDS access (rds:*). The security team has identified that this is overly permissive and wants to restrict access to only the specific resources needed. Additionally, the team wants to ensure that the EC2 instances can only access the RDS database using SSL/TLS. Which combination of actions should the security team take?

Accepted Answer

Update the IAM role to have two policies: one that allows s3:PutObject on the specific S3 bucket with a prefix, and another that allows rds:Connect on the specific RDS instance ARN with a condition requiring rds:ForceSsl. Also, ensure the RDS instance requires SSL.. Option B is correct. It creates separate policies for S3 and RDS, restricts S3 to the specific bucket and prefix, and restricts RDS to the specific resource and enforces SSL. Option A is wrong because using an IAM user and storing credentials on EC2 is insecure. Option C is wrong because using a single policy with wildcards is still overly permissive and does not enforce SSL. Option D is wrong because resource-based policies on the S3 bucket and RDS instance would not be sufficient without the IAM role permissions; also, S3 bucket policies are not the primary method for granting EC2 access.

Answer

Remove the IAM role from the EC2 instances and instead use resource-based policies on the S3 bucket and RDS instance to grant access to the EC2 instances' VPC or subnet.

Answer

Create an IAM user with the required permissions, generate access keys, and store them in a secure S3 bucket. Have the EC2 instances retrieve the credentials at startup using an instance profile.

Answer

Create a single IAM policy that allows s3:PutObject on the specific bucket and rds:Connect on the specific RDS instance without any conditions. Attach it to the IAM role.

Question 19

A company runs a critical application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application processes financial transactions and must store transaction logs in an Amazon S3 bucket. The security team requires that all API calls to AWS services are logged and that the logs are stored in a secure, tamper-proof manner. The team enables AWS CloudTrail to log management events and Amazon S3 server access logs for the S3 bucket. They also enable AWS Config to track resource changes. The compliance team wants to ensure that no one can disable CloudTrail logging or delete the CloudTrail log files. The security engineer proposes a solution using an SCP in AWS Organizations to deny actions that would disable CloudTrail or delete log files. However, the engineer is concerned that the SCP might be applied too broadly and affect legitimate administrative actions. The engineer wants to ensure that only the security team’s IAM role (SecurityAdminRole) can perform these restricted actions, while all other principals (including IAM users, roles, and the root user) are denied. The engineer creates an SCP that denies cloudtrail:StopLogging, cloudtrail:DeleteTrail, and s3:DeleteObject on the CloudTrail S3 bucket. The SCP includes a condition that allows the action if the principal is SecurityAdminRole. However, after applying the SCP, the security team finds that even SecurityAdminRole is unable to stop CloudTrail logging. What is the most likely cause of this issue?

Accepted Answer

The condition in the SCP is incorrectly scoped, causing the deny to apply to all principals including SecurityAdminRole.. C: Correct – The root user is not affected by SCPs by default, but if the condition incorrectly references the root user, it may block all principals including SecurityAdminRole. However, the more common issue is that the SCP was applied without an explicit allow for the SecurityAdminRole, or the condition was not properly scoped. In this scenario, the most likely cause is that the condition in the SCP is not correctly scoped to allow SecurityAdminRole. The SCP should use a condition like "StringNotEquals": {"aws:PrincipalArn": "arn:aws:iam::*:role/SecurityAdminRole"} to deny only when the principal is not that role. If the condition is incorrectly written, it may deny all principals. Alternatively, the SCP might be applied to the management account where root user cannot be denied, but the issue is that SecurityAdminRole is denied. The typical mistake is using "Deny" without a proper condition that excludes the allowed role. A: Incorrect – If the SCP is applied to the root OU, it applies to all accounts including the security team's account. B: Incorrect – S3 bucket policies can grant access, but if the SCP denies, the deny overrides. D: Incorrect – The correct answer is that the SCP is too restrictive; the condition is flawed.

Answer

The SCP is applied to the root organizational unit (OU), which includes the management account where the root user is not affected by SCPs.

Answer

The SecurityAdminRole does not have the necessary IAM permissions to stop CloudTrail logging.

Answer

The S3 bucket policy on the CloudTrail bucket denies access to the SecurityAdminRole.

Question 20

A company has an AWS Lambda function that processes messages from an Amazon SQS queue. The Lambda function is configured with an execution role that has the following IAM policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "sqs:ReceiveMessage",
        "sqs:DeleteMessage",
        "sqs:GetQueueAttributes"
      ],
      "Resource": "arn:aws:sqs:us-east-1:123456789012:MyQueue"
    },
    {
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents"
      ],
      "Resource": "*"
    }
  ]
}

The Lambda function is also configured with an SQS trigger that uses the same queue. The function code tries to send a message to an Amazon SNS topic, but the send fails with an AccessDenied error. What is the most likely cause?

Accepted Answer

The Lambda execution role does not have permissions to publish to SNS.. Option A is correct. The Lambda execution role does not include permissions to publish to SNS. The function can only perform actions that are allowed by the role. Option B is wrong because the SQS trigger does not affect the function's ability to call SNS. Option C is wrong because the SQS policy is not relevant to SNS. Option D is wrong because the SNS topic policy may not exist or may not deny; the error is due to missing IAM permissions.

Answer

The SQS queue has a resource-based policy that denies the Lambda function from sending to SNS.

Answer

The SNS topic has a resource-based policy that denies the Lambda function.

Answer

The SQS queue is not configured to allow the Lambda function to send messages to SNS.