SCS-C02 Hard Questions — 25 Difficult Questions

Question 1

A company uses AWS WAF to protect its web application from common web exploits. The security team wants to block requests that contain SQL injection or cross-site scripting (XSS) in the query string. Which rule type should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Managed rule group for SQL injection and XSS. AWS WAF managed rule groups, such as the AWS-AWSManagedRulesSQLiRuleSet and AWS-AWSManagedRulesXSSRuleSet, are pre-configured to inspect query strings for SQL injection and cross-site scripting (XSS) patterns. Using a managed rule group is the most efficient and accurate approach because it leverages AWS's continuously updated threat signatures, reducing false positives and administrative overhead compared to custom rules.

Answer

Custom regex pattern set

Answer

Rate-based rule

Answer

Geographic match rule

Question 2

Refer to the exhibit. An IAM policy allows kms:Decrypt on a specific KMS key only when the encryption context includes department=finance. A user attempts to decrypt an S3 object that was encrypted with the same KMS key but with encryption context department=hr. Will the decryption succeed?

Accepted Answer

No, because the encryption context does not match.. The IAM policy requires the encryption context to include department=finance for kms:Decrypt. Since the object was encrypted with department=hr, the encryption context does not match, and the decryption fails. Option B is incorrect because the key policy is not the issue; the IAM policy restricts based on encryption context. Option C is incorrect because while the user has kms:Decrypt permission on the key, the condition on that permission is not satisfied. Option D is incorrect because kms:DescribeKey permission is irrelevant to decryption; the condition on kms:Decrypt is not met.

Answer

No, because the key policy does not allow the user to decrypt.

Answer

Yes, because the user has kms:Decrypt permission on the key.

Answer

Yes, if the user also has kms:DescribeKey permission.

Question 3

A company uses AWS Organizations with multiple accounts. The security team needs to ensure that all accounts have CloudTrail enabled and that logs are delivered to a central S3 bucket. A new member account is created and the security engineer wants to enforce this configuration automatically. Which approach meets these requirements with the least operational overhead?

Accepted Answer

Use AWS CloudFormation StackSets to deploy a CloudTrail template to all accounts in the organization.. AWS CloudFormation StackSets allows you to deploy a CloudTrail template across all accounts in an AWS Organization from a single administrative account. This approach ensures that every new member account automatically receives the CloudTrail configuration as part of the StackSet's automatic deployment to accounts added to the organization, providing a fully automated, infrastructure-as-code solution with minimal operational overhead.

Answer

Use AWS Config rules to detect accounts without CloudTrail and trigger a remediation via Systems Manager Automation.

Answer

Use an SCP to deny cloudtrail:StopLogging and cloudtrail:DeleteTrail actions.

Answer

Create an AWS Lambda function that runs periodically to check and enable CloudTrail in each account.

Question 4

A security team wants to grant a Lambda function access to read from a DynamoDB table in the same account. What is the most secure way to do this?

Accepted Answer

Create an IAM role with a policy that allows only the required DynamoDB actions (e.g., GetItem, Query) on the specific table and assign it to the Lambda function.. The most secure method is D because it follows the principle of least privilege by creating a custom IAM role that grants only the necessary DynamoDB actions (like GetItem, Query) on the specific table. This limits the Lambda function's permissions to only what is required. Option A is incorrect because a VPC endpoint allows network access to DynamoDB but does not grant IAM permissions; the Lambda function still needs an IAM role with appropriate permissions. Option B is incorrect because attaching the managed policy AmazonDynamoDBFullAccess grants full access to all DynamoDB resources, violating least privilege and increasing security risk. Option C is incorrect because storing database access keys in Lambda environment variables exposes credentials and is insecure; the recommended approach is to use an IAM execution role.

Answer

Create a VPC endpoint for DynamoDB and associate it with the Lambda function.

Answer

Attach the AWS managed policy AmazonDynamoDBFullAccess to the Lambda execution role.

Answer

Store the database access keys in the Lambda environment variables.

Question 5

Refer to the exhibit. A security engineer runs the describe-instances command for an EC2 instance. The instance has a public IP address. The security group "allow-ssh-http" has inbound rules that allow SSH from 0.0.0.0/0 and HTTP from 0.0.0.0/0. The engineer wants to block SSH access from the internet while keeping HTTP access. Which change should be made?

Accepted Answer

Remove the inbound rule that allows SSH from 0.0.0.0/0 from the security group.. Security groups are stateful and support only allow rules; removing the inbound SSH rule from the security group effectively blocks SSH access from the internet (0.0.0.0/0) while the HTTP rule remains, allowing HTTP traffic. Since the instance already has a public IP address, removing the SSH rule is the simplest and most direct way to achieve the goal without affecting other traffic.

Answer

Add a network ACL rule to deny SSH inbound from 0.0.0.0/0.

Answer

Disassociate the public IP address from the instance.

Answer

Modify the security group to add a deny rule for SSH from 0.0.0.0/0.

Question 6

A company has enabled Amazon GuardDuty in multiple AWS accounts. The security team wants to centralize GuardDuty findings into a single account for analysis. Which THREE steps are required to achieve this? (Choose THREE.)

Accepted Answer

Invite member accounts to join the GuardDuty master account.. In Amazon GuardDuty, to centralize findings from multiple accounts, you must designate a master account and then invite member accounts to join. The invitation process establishes a trusted relationship where the master account can aggregate and analyze findings from all member accounts. Without this step, the master account cannot receive findings from other accounts.

Answer

Configure CloudWatch Logs cross-account subscription to aggregate findings.

Answer

Create an EventBridge rule to forward findings to the master account.

Question 7

A security engineer notices that an IAM user has been performing suspicious actions in an AWS account. The engineer needs to generate a credential report to identify the age of the user's access keys. Which AWS CLI command should the engineer run?

Accepted Answer

aws iam generate-credential-report && aws iam get-credential-report. The AWS CLI command to generate and retrieve an IAM credential report is a two-step process: first run 'aws iam generate-credential-report' to trigger report generation, then run 'aws iam get-credential-report' to retrieve it. The report includes access key age, password age, MFA status, and other credential metadata for all IAM users, which is exactly what the engineer needs.

Answer

aws iam get-account-authorization-details

Answer

aws iam generate-service-last-accessed-details

Answer

aws iam list-access-keys --user-name suspectUser

Question 8

A company has a multi-account AWS environment with 50 accounts. The security team uses AWS CloudTrail to log management events in each account and delivers logs to a centralized S3 bucket in the security account. Recently, the team noticed that some CloudTrail logs are missing from the central bucket for a few accounts. The logs appear to be delivered intermittently. The security engineer checks the CloudTrail configuration in one of the affected accounts and sees that the trail is configured to deliver to the central bucket. The bucket policy in the security account allows CloudTrail to write from all accounts. The engineer also checks the CloudTrail console and sees that the trail status is 'Logging'. What is the MOST likely cause of the intermittent log delivery?

Accepted Answer

The CloudTrail trail is using Kinesis Data Firehose for delivery, which has a throughput limit.. The most likely cause is that the CloudTrail trail is configured to deliver logs via Kinesis Data Firehose, which has a throughput limit. If the volume of log data exceeds the Firehose stream's capacity, some logs may fail to be delivered, resulting in intermittent missing logs. Option A is incorrect because S3 default encryption (SSE-S3) does not interfere with CloudTrail writes; CloudTrail can write to encrypted buckets. Option B is incorrect because a lifecycle policy deletes objects after they are stored, not during delivery, so it would not cause intermittent missing logs. Option D is incorrect because CloudTrail does not use SQS for log delivery; it delivers directly to S3 or via Firehose.

Answer

The S3 bucket has default encryption enabled, which interferes with CloudTrail writes.

Answer

The S3 bucket has a Lifecycle policy that deletes objects prematurely.

Answer

The CloudTrail trail in each account is not associated with an SQS queue, causing delivery failures.

Question 9

An IAM role has the above trust policy. Users from account 123456789012 try to assume the role. What is required for the AssumeRole API call to succeed?

Accepted Answer

The user must have MFA enabled and present the MFA token.. The trust policy includes a condition requiring MFA (e.g., aws:MultiFactorAuthPresent: true). Therefore, users must have MFA enabled and provide the MFA token when calling AssumeRole. Option A is incorrect because the role can be assumed by users from another account, but MFA is still required. Option B is incorrect because the user does not need an IAM policy allowing sts:AssumeRole; the trust policy grants the permission. Option D is incorrect because the condition is about MFA, not IP address.

Answer

The user must be an IAM user in the same account as the role.

Answer

The user must have an IAM policy that allows sts:AssumeRole.

Answer

The request must originate from a specific IP address range.

Question 10

A company has a critical application that stores sensitive data in Amazon DynamoDB. The security team requires that all data stored in DynamoDB is encrypted at rest using a customer-managed KMS key. Additionally, they want to ensure that the key can be rotated automatically every year. Which combination of actions should be taken?

Accepted Answer

Use a customer-managed KMS key and enable automatic key rotation. DynamoDB encryption at rest is always enabled and uses AWS owned keys by default, but to meet the requirement of a customer-managed key with annual automatic rotation, you must configure a customer-managed KMS key and enable its automatic rotation. Customer-managed keys give the organization control over key policy, grants, and rotation schedule, and KMS supports automatic annual rotation for symmetric customer-managed keys. This satisfies both the customer-managed key and rotation requirements.

Answer

Use a CloudHSM key store and enable automatic rotation

Answer

Use an AWS managed KMS key and enable automatic key rotation

Answer

Enable encryption on the existing DynamoDB table and use a customer-managed KMS key

Question 11

A company uses AWS CloudHSM to generate and store encryption keys for a custom application. The security team is concerned about key durability and wants to ensure that keys are not lost if the HSM fails. Which action should be taken?

Accepted Answer

Regularly back up the HSM to an Amazon S3 bucket and restore to a new cluster if needed. AWS CloudHSM supports taking backups of the HSM content to an Amazon S3 bucket. These backups can be used to restore to a new HSM cluster in case of failure, ensuring key durability. Option A is incorrect because CloudHSM clusters are single-region; multi-region clusters are not supported. Option B is incorrect because storing keys on an encrypted EBS volume bypasses the security of the HSM and is not a recommended practice for key durability. Option C is incorrect because AWS KMS cannot directly import keys from CloudHSM; KMS and CloudHSM are separate services with different key management capabilities.

Answer

Create a multi-region CloudHSM cluster

Answer

Store the keys in a file on an encrypted EBS volume

Answer

Use AWS KMS to import the keys from CloudHSM

Question 12

A developer is trying to upload a file to an S3 bucket using the AWS CLI, but receives an 'AccessDenied' error. The IAM policy attached to the user includes 's3:PutObject' on the bucket. The bucket policy has a Deny statement with the condition 'aws:Referer': ['example.com']. The CLI command does not include a referer header. What is the cause of the error?

Accepted Answer

The bucket policy denies requests that do not include the required referer header.. The Deny statement with a condition that does not match the request (no referer header) still denies the request if the condition is not met? Actually, the Deny statement with a condition only denies if the condition evaluates to true. Since the request has no referer, the condition 'StringNotEquals'? Wait, typical bucket policy is: Deny unless referer equals example.com. But if the request has no referer, the condition fails, so the Deny does not apply. However, the error persists. Possibly the bucket policy has an explicit Deny for all requests without the referer. In that case, the Deny applies. So Option B is correct: the Deny is blocking requests without the referer. Option A is wrong because CLI uses HTTPS. Option C is irrelevant. Option D is not the cause.

Answer

The user’s access keys are expired.

Answer

The IAM policy does not include s3:PutObjectAcl.

Answer

The CLI is not using HTTPS.

Question 13

A security engineer is reviewing AWS CloudTrail logs and notices a large number of `DescribeInstances` API calls from a single IAM user in a short period. The engineer suspects a credential compromise. What is the most effective way to automatically revoke the compromised credentials and notify the security team?

Accepted Answer

Create an Amazon EventBridge rule that triggers an AWS Lambda function to revoke the keys and send an SNS notification.. It uses Amazon EventBridge to detect the anomalous DescribeInstances API calls (via CloudTrail as an event source), then triggers an AWS Lambda function to programmatically revoke the IAM user's access keys (using the `deactivate_access_key` or `delete_access_key` API), and sends an SNS notification to the security team. This provides an automated, near-real-time response to a suspected credential compromise without manual intervention.

Answer

Use AWS CloudTrail to automatically disable the IAM user's access keys.

Answer

Create an AWS Config rule that checks for excessive API calls and revokes keys.

Answer

Enable Amazon GuardDuty to automatically revoke compromised credentials.

Question 14

A security engineer is investigating a potential incident where an EC2 instance was compromised. The engineer has access to the following logs: CloudTrail, VPC Flow Logs, and OS-level logs from the instance. Which TWO log sources would be MOST useful to determine the initial attack vector? (Choose TWO.)

Accepted Answer

OS-level authentication and system logs. OS-level authentication and system logs (option B) are critical because they record local login attempts, sudo commands, and process executions that can reveal how an attacker gained initial access—such as via SSH brute force, a compromised user account, or a vulnerable service. CloudTrail logs (option C) are equally important because they capture API calls made to AWS services, including RunInstances, CreateKeyPair, and ModifySecurityGroup, which can show if the attacker launched the instance from a compromised AWS account or modified security groups to allow inbound traffic. Together, these two sources provide the evidence needed to trace the initial compromise vector, whether it originated from within the OS or through AWS API manipulation.

Answer

Amazon CloudWatch Metrics for the instance

Answer

AWS Config configuration history

Answer

VPC Flow Logs

Question 15

Refer to the exhibit. An IAM policy is attached to a group. A user in the group accesses the S3 bucket from an IP address 203.0.113.5 using HTTPS. What will be the result?

Accepted Answer

The user will be denied access because the source IP is not in the allowed ranges.. The IAM policy includes a condition that restricts access to only the IP ranges 192.0.2.0/24 and 198.51.100.0/24. The user's IP address 203.0.113.5 does not fall within these ranges, so access is denied. Option B is incorrect because an Allow with conditions does not grant access by default; all conditions must be satisfied. Option C is incorrect because the policy does explicitly allow the s3:GetObject action, but only under the specified conditions. Option D is incorrect because while SecureTransport is satisfied, the IP condition is not met, and all conditions must be true for the Allow to take effect.

Answer

The user can access objects because an Allow with conditions grants access by default.

Answer

The user will be denied access because the policy does not allow the action explicitly.

Answer

The user can access objects because the condition for SecureTransport is met.

Question 16

A company uses AWS PrivateLink to connect to a SaaS provider's VPC endpoint service. The security team wants to ensure that traffic between the company's VPC and the SaaS provider's VPC is encrypted in transit and that no other AWS service can access the data. Which configuration meets these requirements?

Accepted Answer

Use an AWS PrivateLink endpoint (interface endpoint) in the company's VPC to connect to the SaaS provider's VPC endpoint service.. AWS PrivateLink uses interface VPC endpoints (powered by AWS PrivateLink) to establish a private connection between the company's VPC and the SaaS provider's VPC endpoint service. Traffic stays within the AWS network and is encrypted in transit using TLS (Transport Layer Security) when the application layer uses HTTPS, ensuring no other AWS service can intercept the data. This meets both the encryption and exclusive access requirements without traversing the internet or relying on VPNs.

Answer

Use a Site-to-Site VPN connection between the VPC and the SaaS provider's on-premises network.

Answer

Create a VPC peering connection and use security groups to restrict traffic.

Answer

Use an AWS Transit Gateway with inter-region peering.

Question 17

A security engineer runs the above CloudTrail lookup command to investigate a change to the S3 bucket policy. The command only returns one event, but the engineer knows that the bucket policy was changed multiple times. What is the most likely reason?

Accepted Answer

The command is limiting results to one event.. The command uses --max-results 1, limiting output to one event. Option A is wrong because changes through the AWS Management Console are logged by CloudTrail. Option B is wrong because PutBucketPolicy is supported by CloudTrail and the event shown confirms it. Option C is wrong because filtering by ResourceName is not the issue; the --max-results parameter is the cause.

Answer

The bucket policy changes were made through the AWS Management Console, which is not logged.

Answer

The event is not logged because PutBucketPolicy is not supported by CloudTrail.

Answer

The command is filtering by the wrong attribute.

Question 18

A company wants to enforce that all IAM users in an AWS Organization must have a password policy that includes a minimum length of 12 characters. Which THREE steps are part of implementing this using SCPs?

Accepted Answer

Include a condition in the SCP that checks if the requested minimum password length is less than 12.. Options A, D, and E are correct. Option A is correct because you can use a condition in the SCP to deny changes to the password policy if the minimum length is less than 12; for example, using a condition like `aws:RequestedRegion` is not relevant here. Option D is correct because SCPs can deny the `iam:UpdateAccountPasswordPolicy` action, effectively preventing users from modifying the policy. Option E is correct because attaching the SCP to the root OU ensures it applies to all accounts in the organization. Option B is incorrect because IAM is a global service and cannot be restricted to a specific Region via SCPs. Option C is incorrect because SCPs cannot directly set a password policy; they only allow or deny actions.

Answer

Use an SCP condition to restrict password policy changes to a specific Region.

Answer

Write an SCP that sets the password policy to require minimum length 12.

Question 19

A company uses AWS Organizations with all features enabled. The security team needs to ensure that no member account can disable AWS CloudTrail logging or delete CloudTrail logs stored in S3. Which combination of preventive controls should be implemented?

Accepted Answer

Apply a service control policy (SCP) at the root OU to deny CloudTrail and S3 delete actions, and enable CloudTrail organizational trail.. The most effective preventive controls are applying a Service Control Policy (SCP) at the root OU to deny CloudTrail stop/delete and S3 delete actions, combined with enabling an organizational trail in CloudTrail. SCPs enforce guardrails across all member accounts, preventing even account administrators from disabling logging or deleting logs, while the organizational trail ensures centralized logging to a protected S3 bucket.

Answer

Set up CloudWatch alarms to notify when CloudTrail is modified or logs are deleted.

Answer

Use IAM policies in each member account to deny CloudTrail and S3 delete actions.

Answer

Apply an S3 bucket policy denying delete actions, and enable CloudTrail organizational trail.

Question 20

A company is designing a disaster recovery plan for encrypted Amazon EBS volumes. Which THREE steps are required to ensure that encrypted EBS snapshots can be restored in a different AWS Region?

Accepted Answer

Copy the encrypted snapshot to the target AWS Region. To restore encrypted EBS snapshots in a different AWS Region, you must copy the encrypted snapshot to the target region (B) and ensure the customer managed key (CMK) used for encryption is available in the target region (D). Re-encrypting the snapshot with a CMK in the target region (A) is optional if you want to use a different key, but it is not a required step. Options C and E are incorrect because AWS CloudHSM is not used for EBS encryption and sharing snapshots via AWS RAM does not guarantee key availability.

Answer

Re-encrypt the snapshot with a customer managed key (CMK) in the target region

Answer

Store the encryption key in AWS CloudHSM in the target region

Answer

Share the snapshot with the target region using AWS RAM