SCS-C02 Hard Questions — 25 Difficult Questions

Question 1

A company wants to audit all API calls made to Amazon S3 within a specific AWS account. Which combination of services should be used to meet this requirement?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Logs.. AWS CloudTrail is the service that records all API calls made to Amazon S3 (and other AWS services) within an AWS account, capturing details such as the identity of the caller, the time of the call, the source IP address, and the request parameters. By delivering these logs to Amazon CloudWatch Logs, you can monitor, search, and set alarms on the API activity in real time, enabling comprehensive auditing of S3 operations.

Answer

Amazon Inspector and Amazon CloudWatch Logs.

Answer

Amazon GuardDuty and Amazon CloudWatch Logs.

Answer

AWS Config and Amazon CloudWatch Logs.

Question 2

A security team is designing an automated incident response system. The system must meet the following requirements: (1) automatically respond to GuardDuty findings, (2) ensure that response actions are logged and immutable, and (3) allow for human approval before destructive actions. Which services should the team use? (Select THREE.)

Accepted Answer

Amazon EventBridge. Amazon EventBridge (A) is correct because it can receive GuardDuty findings in near real-time and route them to downstream targets for automated response. This enables the first requirement by triggering workflows directly from GuardDuty events without custom polling.

Answer

AWS Lambda

Answer

Amazon Simple Notification Service (SNS)

Question 3

A security engineer creates an Amazon CloudWatch Events rule with this event pattern to trigger an AWS Lambda function for automated response to GuardDuty findings. However, the Lambda function is not triggered for new findings. What is the MOST likely cause?

Accepted Answer

The event pattern does not match the actual structure of GuardDuty findings.. The event pattern provided in the CloudWatch Events rule must exactly match the JSON structure of a GuardDuty finding as it is published to the default event bus. GuardDuty findings are delivered with a specific schema that includes a `detail` object containing `type`, `severity`, and other fields. If the event pattern uses incorrect field names, nesting, or missing required elements (e.g., `source` must be `aws.guardduty`), CloudWatch Events will not match the incoming events, and the Lambda function will not be triggered.

Answer

The finding type is not specified in the pattern.

Answer

CloudTrail is not enabled in the account.

Answer

The Lambda function does not have permission to be invoked by CloudWatch Events.

Question 4

An IAM policy allows a user to pass a specific role and launch EC2 instances. The user tries to launch an EC2 instance with the role 'ec2-full-access' but receives an error: 'You are not authorized to perform iam:PassRole'. What is the MOST likely cause?

Accepted Answer

The user is attempting to pass a role with an ARN that does not exactly match the one in the policy. The error 'You are not authorized to perform iam:PassRole' indicates that the IAM policy does not allow the user to pass the role. The most likely cause is that the role ARN the user is trying to pass does not exactly match the ARN specified in the policy. Option A is incorrect because if the role didn't exist, the error would be different (e.g., 'The role does not exist'). Option C is incorrect because ec2:InstanceProfile is not a condition key for PassRole; it's a resource attribute. Option D is incorrect because the error is about PassRole, not RunInstances.

Answer

The role 'ec2-full-access' does not exist in the account

Answer

The policy is missing a condition key such as ec2:InstanceProfile

Answer

The user does not have permission to call ec2:RunInstances

Question 5

A security engineer needs to ensure that an EC2 instance can only be launched using an approved Amazon Machine Image (AMI) from a specific AWS account. Which AWS service should be used to enforce this requirement?

Accepted Answer

AWS Service Catalog. AWS Service Catalog allows you to create and manage a portfolio of approved products, such as EC2 instances launched from specific AMIs. By defining a product that uses an approved AMI from a particular AWS account and enforcing launch constraints, you can ensure that only that AMI is used. IAM policies alone cannot restrict the AMI ID at launch time because they lack the granularity to filter by source account or AMI ID in the ec2:RunInstances action.

Answer

IAM policies

Answer

AWS Config

Answer

AWS Image Builder

Question 6

A financial services company uses AWS KMS to encrypt sensitive data in S3 and RDS. The security team requires a centralized audit trail of all KMS key usage, including key creation, deletion, and cryptographic operations. The audit logs must be stored in a separate AWS account for compliance. The team has enabled CloudTrail in the management account and configured a trail that logs to an S3 bucket in the audit account. However, they notice that KMS events such as Decrypt and GenerateDataKey are not appearing in the CloudTrail logs. The KMS key policy includes the following statement: {"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::management-account:root"},"Action":"kms:*","Resource":"*"}. What is the MOST likely reason for the missing KMS events?

Accepted Answer

CloudTrail is not configured to log KMS data events.. CloudTrail does log KMS events by default, but they are data events and must be explicitly enabled. Option B is correct because KMS data events (like Decrypt and GenerateDataKey) are not logged unless CloudTrail is configured to capture them. Option C is wrong because the key policy grants full access to the management account, so it is sufficient. Option D is wrong because cross-account access is not the issue; the trail is logging to an S3 bucket in the audit account, but that does not affect which events are logged.

Answer

The S3 bucket in the audit account does not have a bucket policy allowing writes from CloudTrail.

Answer

CloudTrail does not log KMS Decrypt and GenerateDataKey events.

Answer

The KMS key policy does not grant CloudTrail permission to log events.

Question 7

A security engineer is designing an incident response plan for a containerized application running on Amazon ECS with Fargate. The engineer needs to ensure that if a container is compromised, the incident response team can capture a memory dump and disk snapshot for forensic analysis. The containers are stateless and use ephemeral storage. Which approach provides the necessary forensic data?

Accepted Answer

Use ECS Exec to access the container and capture a memory dump; snapshot the task's ephemeral storage.. ECS Exec allows interactive access to a running container without stopping it, enabling the capture of a memory dump (e.g., via `gcore` or `/proc/kcore`). Additionally, the task's ephemeral storage can be snapshotted while the container is still running, preserving disk state for forensic analysis. This approach aligns with incident response best practices for stateless containers on Fargate, where traditional host-level forensics are unavailable.

Answer

Configure the container to stream /dev/mem to CloudWatch Logs.

Answer

Enable ECS task memory dumps to CloudWatch Logs.

Answer

Stop the task and create a new task from the same image.

Question 8

A security engineer is investigating a potential compromise. The engineer has captured a memory dump from an EC2 instance and needs to analyze it for malware. Which TWO actions should the engineer take to preserve the chain of custody? (Choose TWO.)

Accepted Answer

Record the date, time, and digital signature of the acquisition.. Recording the date, time, and digital signature of the acquisition establishes a clear audit trail, which is essential for proving that the evidence has not been tampered with. In forensic investigations, this metadata is part of the standard chain-of-custody documentation that demonstrates who collected the evidence, when, and that it remains unaltered. A digital signature (e.g., using a tool like gpg or a signed hash) provides non-repudiation and integrity verification beyond a simple hash.

Answer

Create an EBS snapshot of the instance's root volume.

Answer

Analyze the memory dump on the same EC2 instance.

Answer

Upload the memory dump to a public S3 bucket for analysis.

Question 9

A company uses AWS KMS to encrypt data in Amazon S3. The security team needs to audit all KMS key usage, including who used the key, when, and what operation was performed. Which AWS service should be used to meet this requirement?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all AWS KMS API calls as events, including who made the request, the source IP address, the time of the request, and the specific operation performed (e.g., Encrypt, Decrypt, GenerateDataKey). These audit logs are stored in an S3 bucket and can be analyzed to meet the security team's requirement for full key usage auditing.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

AWS CloudHSM

Question 10

A company uses Amazon S3 to store sensitive documents. They must ensure that all objects are encrypted at rest and that any attempt to upload an unencrypted object is denied. Which S3 bucket policy statement achieves this?

Accepted Answer

Deny s3:PutObject unless the request includes x-amz-server-side-encryption: AES256 AND the encryption is SSE-S3.. Option C is correct because it explicitly denies PutObject unless the request includes both the x-amz-server-side-encryption header with value AES256 (which requests SSE-S3) and the encryption type is SSE-S3. This ensures only objects encrypted with SSE-S3 can be uploaded. Option A is incorrect because it only checks for the header value AES256; while AES256 is specific to SSE-S3 and would also enforce SSE-S3, Option C provides a more explicit condition. Option B is incorrect because it denies all PutObject requests. Option D is incorrect because an Allow statement cannot enforce a denial; a Deny statement is required to block unencrypted uploads.

Answer

Deny s3:PutObject unless the request includes x-amz-server-side-encryption: AES256.

Answer

Deny s3:PutObject for all principals.

Answer

Allow s3:PutObject only when x-amz-server-side-encryption: AES256 is present.

Question 11

A company's security team is designing an incident response plan for AWS resources. They want to ensure that when a security incident is detected in a production account, a pre-defined runbook is executed automatically. The runbook includes steps to isolate the compromised resource and collect forensic evidence. Which combination of services should the team use to implement this automation?

Accepted Answer

AWS Systems Manager Incident Manager and AWS Systems Manager Automation. AWS Systems Manager Incident Manager provides the incident management lifecycle, including automated response plans that trigger runbooks when an incident is detected. AWS Systems Manager Automation runbooks contain predefined steps (e.g., isolating EC2 instances, capturing memory dumps, and collecting logs) that can be executed automatically. This combination directly meets the requirement for a pre-defined runbook that isolates the compromised resource and collects forensic evidence.

Answer

Amazon EventBridge and AWS Lambda

Answer

AWS Config and Amazon EC2 Auto Scaling

Answer

AWS Step Functions and AWS Lambda

Question 12

A company uses Amazon RDS for PostgreSQL with encryption at rest enabled using AWS KMS. The security team wants to ensure that database backups (automated snapshots) are also encrypted and that the encryption key can be rotated on demand without re-encrypting the data. Which approach should be taken?

Accepted Answer

Create a new KMS key and modify the RDS instance to use the new key. The existing backup will be re-encrypted with the new key when the instance is modified.. You can create a new KMS key and modify the RDS instance to use the new key. This action re-encrypts the database and its automated snapshots with the new key, providing on-demand key rotation. The re-encryption is performed automatically during the modification. Option A is incorrect because RDS does not allow specifying a separate KMS key for backups; backups use the same key as the instance. Option B is incorrect because disabling the old KMS key would break access to existing backups that are still encrypted with that key. Option C is incorrect because automatic key rotation in KMS does not trigger re-encryption of existing data; it only generates new key material for future encryption operations.

Answer

Use a separate KMS key for backups by enabling 'Copy tags to snapshots' and specifying a different key.

Answer

Disable the old KMS key and enable a new KMS key for the RDS instance. The old backup will remain encrypted with the old key.

Answer

Enable automatic key rotation in KMS and import new key material every 90 days.

Question 13

Refer to the exhibit. A user from IP 10.1.2.3 attempts to download an object from my-secret-bucket using HTTP (not HTTPS). What will be the outcome?

Accepted Answer

Failure, because the Deny statement blocks HTTP requests.. The Deny statement with condition aws:SecureTransport=false will block HTTP requests. Even though the IP matches the allow rule, the explicit Deny overrides the Allow.

Answer

Success, because the Allow statement is evaluated first.

Answer

Failure, because the user's IP is not in the allowed range.

Answer

Success, because the user's IP is within the allowed range.

Question 14

A company stores data in Amazon S3 and uses AWS KMS with Customer Master Keys (CMKs) for encryption. The security team wants to audit when the CMK is used to decrypt data. Which of the following will provide this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail logs all KMS Decrypt API calls, which is exactly what is needed to audit CMK decryption. Option A (AWS Config) records configuration changes, not API calls. Option B (Amazon CloudWatch Logs) can store logs but does not generate the KMS decrypt logs itself; CloudTrail generates them. Option D (S3 server access logs) record requests to S3 objects, not the KMS decryption calls that happen when accessing encrypted objects.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

S3 server access logs

Question 15

A company has enabled Amazon GuardDuty in multiple AWS accounts. The security team wants to centralize GuardDuty findings into a single account for analysis. Which THREE steps are required to achieve this? (Choose THREE.)

Accepted Answer

Invite member accounts to join the GuardDuty master account.. In Amazon GuardDuty, to centralize findings from multiple accounts, you must designate a master account and then invite member accounts to join. The invitation process establishes a trusted relationship where the master account can aggregate and analyze findings from all member accounts. Without this step, the master account cannot receive findings from other accounts.

Answer

Configure CloudWatch Logs cross-account subscription to aggregate findings.

Answer

Create an EventBridge rule to forward findings to the master account.

Question 16

A security engineer needs to enable VPC Flow Logs to capture traffic metadata. Which THREE components are required to create a VPC Flow Log?

Accepted Answer

A CloudWatch Logs log group to publish the flow logs.. A CloudWatch Logs log group is required because VPC Flow Logs publish traffic metadata to CloudWatch Logs as the default destination. The flow logs are stored as log streams within the specified log group, enabling querying and monitoring via CloudWatch Logs Insights. Without a log group, there is no destination for the flow log records to be sent to.

Answer

An S3 bucket to store the flow logs.

Answer

An Amazon Kinesis Data Firehose delivery stream.

Question 17

A company is using AWS Organizations to manage multiple accounts. The security team wants to ensure that all accounts have AWS CloudTrail enabled in all regions. Which approach should be used?

Accepted Answer

Enable AWS CloudTrail from the master account as an organization trail.. AWS Organizations allows you to create an organization trail from the management account that automatically applies to all member accounts and all regions. This ensures CloudTrail is enabled across the entire organization without requiring per-account configuration, and it centralizes log delivery to a single Amazon S3 bucket for auditing.

Answer

Create an SCP that requires CloudTrail to be enabled.

Answer

Enable CloudTrail in each account using a cross-account IAM role.

Answer

Use AWS Config rules to detect non-compliant accounts and automatically enable CloudTrail.

Question 18

A company is using AWS KMS to encrypt data at rest. The security team needs to ensure that keys cannot be deleted before a retention period. Which THREE steps should be taken? (Choose three.)

Accepted Answer

Enable AWS CloudTrail to log key deletion events.. Options A, B, and E are correct. Enabling CloudTrail to log key deletion events helps audit attempts. Setting CloudWatch alarms on kms:ScheduleKeyDeletion events provides notification. Scheduling key deletion with a waiting period (e.g., 7 days) implements a retention period. Option C is incorrect because IAM policies can prevent deletion but do not enforce a retention period; the question asks to ensure keys cannot be deleted before a retention period, which requires a waiting period, not just denial. Option D is incorrect because automatic rotation does not prevent deletion.

Answer

Create an IAM policy that denies kms:ScheduleKeyDeletion.

Answer

Enable automatic key rotation.

Question 19

A company uses AWS KMS to encrypt objects in an S3 bucket. The security team wants to ensure that only users with the appropriate KMS key permissions can decrypt objects. Which TWO conditions should be included in the S3 bucket policy to enforce this? (Choose TWO.)

Accepted Answer

"Condition": {"StringEquals": {"kms:ViaService": "s3.us-east-1.amazonaws.com"}}. Options A and E are the only distinct conditions that can be used in an S3 bucket policy to enforce that only users with appropriate KMS key permissions can decrypt objects. kms:ViaService restricts the use of the KMS key to requests coming via the S3 service, and kms:EncryptionContext restricts decryption to requests that include the specific S3 bucket ARN. Option C is identical to A and thus does not provide an additional constraint, making it redundant. Options B and D are not valid condition keys for S3 bucket policies.

Answer

"Condition": {"StringEquals": {"kms:KeySpec": "SYMMETRIC_DEFAULT"}}

Answer

"Condition": {"StringEquals": {"kms:ViaService": "s3.us-east-1.amazonaws.com"}}

Answer

"Condition": {"StringEquals": {"kms:GranteePrincipal": "arn:aws:iam::123456789012:role/Admin"}}

Question 20

A company has a VPC with a public subnet and a private subnet. The public subnet contains a NAT gateway and a bastion host. The private subnet contains a web server that needs to be patched via the internet. The security engineer has configured the route tables: the public subnet route table has a default route to the Internet Gateway, and the private subnet route table has a default route to the NAT gateway. The web server can successfully initiate outbound connections to the internet to download patches. However, the security team notices that the web server is also receiving inbound connections from the internet on port 80. The web server's security group allows inbound HTTP from 0.0.0.0/0. What should the engineer do to prevent inbound internet traffic while still allowing outbound patching?

Accepted Answer

Modify the web server's security group to remove the inbound HTTP rule from 0.0.0.0/0.. Removing the inbound HTTP rule from the security group will block inbound traffic from the internet, while outbound traffic is still allowed because security groups are stateful and allow return traffic for outbound-initiated connections. Option A is incorrect because changing the route table would break outbound connectivity. Option C is incorrect because the NAT gateway already handles outbound traffic; changing it would not help. Option D is incorrect because a network ACL would affect all traffic and could block return traffic for outbound connections.

Answer

Change the private subnet's route table to have a default route to the Internet Gateway instead of the NAT gateway.

Answer

Replace the NAT gateway with a NAT instance and configure it to block inbound traffic.

Answer

Add a network ACL to the private subnet that denies inbound HTTP traffic.